Internet data operation management method based on AI security

Abstract

The application relates to the field of AI data operation management methods, and particularly discloses an internet data operation management method based on AI security, which comprises the following steps: S1, marking and generating a historical event list according to historical attack events and historical security events; S2, performing correlation degree analysis according to the historical event list and a historical operation knowledge graph, and judging whether the correlation degree is less than a preset correlation degree; if yes, the method proceeds to step S3; if no, the method proceeds to step S4; S3, performing noise reduction processing on the correlation events based on an AI model, performing risk sorting on the noise reduction processed correlation events by the AI model, and determining an event priority; performing risk scoring processing according to the event priority and the event correlation degree, and judging whether malicious attack behavior data exists; if yes, an emergency event technical route is built; if no, the method proceeds to step S4; S4, determining a user behavior data type, building a common event technical route according to the user behavior data type and the AI model, and realizing a collaborative process of operation management.

Description

Technical Field

[0001] This invention relates to the field of AI data operation and management methods, specifically to an AI-based security-based internet data operation and management method. Background Technology

[0002] In the process of data asset management, due to the large number of asset management systems for different Internet data, relying solely on host monitoring equipment results in incomplete coverage. Therefore, it is necessary to conduct network security management for Internet data of various asset systems. However, the existing security system lacks a unified security collaboration method, which fails to achieve the integrated effect of Internet data operation and management.

[0003] With the rapid development of various intelligent training methods for AI models, AI is being applied to data asset management to promote high-quality data engineering management. In existing applications of AI models for internet data operation and management, language models and machine learning models are commonly used for data information screening and identification to build a secure data operation and management environment. However, for complex operation and management systems and diverse operation and management methods, it is difficult to quickly select events and determine risks, thus lacking a unified differentiated processing mechanism to improve the collaborative response efficiency of operation and management. Summary of the Invention

[0004] The purpose of this invention is to provide an AI-based secure internet data operation and management method to solve the following technical problems: How can we leverage AI models to achieve collaborative processes for secure operational data and improve the efficiency of internet data operation and management?

[0005] The objective of this invention can be achieved through the following technical solutions: AI-based secure internet data operation and management methods, including: S1. Collect historical attack events and historical security events from the Internet big data database based on the AI ​​model, label the historical attack events and historical security events and generate a list of historical events; S2. Based on the generated historical event list and historical operation knowledge graph, perform correlation analysis to extract related events and determine whether the correlation is less than the preset correlation. If yes, proceed to step S3; otherwise, proceed to step S4. S3. Based on the AI ​​model, noise reduction is performed on the related events. The risk ranking of the related events after noise reduction is determined according to the AI ​​model. The event priority is determined according to the risk ranking result. Risk scoring is performed based on event priority and relevance to determine if there is malicious attack data; if so, an emergency response technical roadmap is established; otherwise, proceed to step S4; the emergency response technical roadmap includes emergency event interpretation, emergency event handling, and emergency event operation; S4. Match and analyze the related events with the security database to determine the user behavior data type. Based on the user behavior data type and AI model, build a technical route for ordinary events. The technical route for ordinary events includes ordinary event interpretation, ordinary event processing, and ordinary event execution.

[0006] Preferably, the historical event list is generated as follows: The historical event list is structured, and the attack event subject, security event subject, and the target of the attack event subject and the target of the security event subject are extracted after the structured processing. Text annotations were created for the subject of the attack, the subject of the security incident, the target of the attack, and the target of the security incident. Based on the historical operational knowledge corpus, data synthesis is performed on the attack event subject, security event subject, and the target of the attack event subject and the target of the security event subject after text annotation to obtain attack event description text and security event description text; Generate a list of historical events by annotating attack event description text and security event description text.

[0007] Preferably, the process of extracting related events through correlation analysis based on the generated historical event list and historical operation knowledge graph is as follows: Based on the historical operational knowledge graph, entity features are extracted to extract the main features of security corpus events. Based on the main features of security corpus events, entity relationships and dynamic attributes of entities are extracted from security corpus events; Based on graph structure features, entity relationships and dynamic attributes of entities in security corpus events are extracted to obtain adjacent entity relationship values; Both attack event description texts and security event description texts are input into the BERT model for encoding and training. The adjacent entity relationship values ​​are input into the BERT model after encoding and training for target optimization. The correlation degree is output based on the target optimization result, and the correlation event is output based on the correlation degree.

[0008] Preferably, the relevance is determined by the product of the weights of the adjacent entity relationship values ​​in the event description text and the dynamic path distance of the entities of adjacent events; the relevance includes the relevance of attack events and the relevance of security events; the weights of the adjacent entity relationship values ​​are determined by the ratio of the adjacent entity relationship values ​​to the preset relationship values.

[0009] Preferably, the risk ranking is performed in descending order of event risk, meaning the lower the event risk, the higher the ranking number. This is achieved by performing risk ranking analysis on the noise-reduced associated events. Based on AI models, user behavior analysis is performed on the subjects of related events to identify the risks associated with these events. Sort the risks of related events and obtain the ranking number corresponding to the risks of related events; The sort number is compared with the preset sort number to determine if it is less than the preset sort number. If it is less than the preset sort number, the associated event is judged to have a high risk and the associated event is determined to have an event priority; otherwise, the event priority is not found.

[0010] Preferably, the method for determining whether malicious attack data exists is as follows: Risk scoring is performed based on event priority and event relevance. The event priority and event relevance of related events are used as the first and second scoring parameters, respectively, and input into the recognition machine model for training. User behavior data is input into the trained recognition machine model for verification, an event risk scoring model is constructed, and the optimization results are output; the optimization results include the risk scoring results of the user behavior data.

[0011] Preferably, the user behavior data types include malicious attack behavior data and security behavior data; when the risk score result exceeds the warning threshold, it is determined that there is malicious attack behavior data, and a warning signal is generated.

[0012] The present invention also proposes a computer system comprising: a memory and a processor connected in communication, and a computer program stored in the memory and capable of running on the processor, wherein the processor executes a method for implementing AI-based secure Internet data operation and management when running the computer program.

[0013] A computer-readable storage medium storing a computer program that is executed by a processor. When the computer program is executed in a computer, it causes the computer to execute an AI-based secure internet data operation and management method. This AI-based secure internet data operation and management method can be applied in software form, such as by designing a program that can run independently on the computer-readable storage medium. The computer-readable storage medium can initiate the program of the entire method through an external trigger.

[0014] The beneficial effects of this invention are: (1) This invention identifies potential malicious behavior by cleaning and prioritizing low-correlation events; it uses an AI model to denoise related events to remove outliers that may affect the accuracy of the analysis; after processing, it uses an AI model to rank the denoised related events by risk to determine the priority of the events; based on the priority and correlation of the events, it performs risk scoring to determine whether there is data on malicious attack behavior; if malicious attack behavior data is detected, an emergency event technical route is immediately established; otherwise, it proceeds to step S4; wherein the emergency event technical route includes the interpretation, processing and operation management of emergency events to ensure a rapid and effective response in the face of emergency situations.

[0015] (2) This invention performs routine processing on highly correlated or low-risk events through step S4, focusing on risk control rather than emergency response; it uses the contents of the security database to determine legitimate operation and maintenance operations and low-risk behavior patterns, specifically conducting behavior sequence analysis: using the LSTM model to determine whether it conforms to the normal user behavior sequence determination, comparing the matched correlated events with the security database to determine the user behavior data type; identifying malicious attack behavior data and security behavior data; when the risk score result exceeds the warning threshold, it is determined that there is malicious attack behavior data, and a warning signal is generated; ensuring improved collaborative response efficiency of operation and management.

[0016] Of course, any product implementing this invention does not necessarily need to achieve all the advantages described above at the same time. Attached Figure Description

[0017] To more clearly illustrate the technical solutions of the embodiments of the present invention, the accompanying drawings used in the description of the embodiments will be briefly introduced below. Obviously, the drawings described below are only some embodiments of the present invention. For those skilled in the art, other drawings can be obtained based on these drawings without creative effort.

[0018] Figure 1 This is a flowchart illustrating the steps of an AI-based secure internet data operation and management method according to the present invention. Detailed Implementation

[0019] The technical solutions of the embodiments of the present invention will be clearly and completely described below with reference to the accompanying drawings. Obviously, the described embodiments are only some embodiments of the present invention, and not all embodiments. Based on the embodiments of the present invention, all other embodiments obtained by those skilled in the art without creative effort are within the scope of protection of the present invention.

[0020] The challenge discovered by this invention lies in the fact that, during the secure processing of internet data, it is difficult to quickly train a fixed machine model for a large number of complex operation and management systems and diverse operation and management methods. Furthermore, there is a lack of a unified and differentiated processing mechanism for the application of AI models. Therefore, a management method is needed to accurately select and assess risks related to complex events in operation data, thereby ensuring improved collaborative response efficiency in operation and management.

[0021] The technical approaches include: Firstly, the complex event correlation verification method adopted in this design is to solve the event error correlation problem in traditional methods by using existing knowledge graph technology to conduct correlation comparison analysis of specific events (with a preset correlation threshold); Secondly, by implementing a risk grading mechanism and adopting a two-level judgment process (correlation judgment → malicious attack judgment) to achieve a dynamic risk grading response and adaptive processing system: constructing a dual-path technical route (emergency / normal) to achieve collaborative operation of attack defense and routine maintenance.

[0022] Please see Figure 1 As shown, this invention is an AI-based secure internet data operation and management method, the method comprising: S1. Collect historical attack events and historical security events from the Internet big data database based on the AI ​​model, label the historical attack events and historical security events and generate a list of historical events; S2. Based on the generated historical event list and historical operation knowledge graph, perform correlation analysis to extract related events and determine whether the correlation is less than the preset correlation. If yes, proceed to step S3; otherwise, proceed to step S4. S3. Based on the AI ​​model, noise reduction is performed on the related events. The risk ranking of the related events after noise reduction is determined according to the AI ​​model. The event priority is determined according to the risk ranking result. Risk scoring is performed based on event priority and relevance to determine if there is malicious attack data; if so, an emergency response technical roadmap is established; otherwise, proceed to step S4; the emergency response technical roadmap includes emergency event interpretation, emergency event handling, and emergency event operation; S4. Match and analyze the related events with the security database to determine the user behavior data type. Based on the user behavior data type and AI model, build a technical route for ordinary events. The technical route for ordinary events includes ordinary event interpretation, ordinary event processing, and ordinary event execution.

[0023] The above technical solution aims to improve the efficiency of collaborative response in operations management and ensure the secure processing of data. The specific steps are as follows: First, step S1 uses an AI model to collect operational information from a large internet database, mainly collecting historical attack events and historical security events. By labeling these events and generating a list of historical events, an initial distinction is made between operational security-related events, ensuring that subsequent processes for accurate filtering and processing of related information are carried out.

[0024] In this embodiment, the method for generating the historical event list in step S1 is as follows: First, the historical event list is structured, and the attack event subject, security event subject, and the target of the attack event subject and the target of the security event subject are extracted using a large language model. By converting unstructured historical event data (such as text reports and logs) into a structured format, it is easier for machines to process and analyze, and key entity information is extracted for subsequent annotation and analysis. Secondly, text annotation is performed on the attack subject, security subject, and the target of the attack subject and the target of the security subject, respectively. By adding semantic tags to entities in structured data, it is helpful to clarify and distinguish the semantic content of the attack subject and the security subject, and enhance machine readability. Text annotation requires the use of natural language processing (NLP) techniques, such as named entity recognition (NER) and regular expression matching. Third, by combining the historical knowledge base, the annotated text is transformed to generate natural language description of the event text. The main transformation method is to synthesize the attack event subject, security event subject, and the target of the attack event subject and the target of the security event subject after the text is annotated based on the historical operation knowledge corpus to obtain the attack event description text and security event description text. By transforming it into descriptive content, the data diversity is enriched, the scene attributes of the event text are ensured, and logical errors and other contradictory information are avoided. Fourth, the annotation of attack event description text and security event description text generates a historical event list. The historical event list includes three parts: raw data, annotation labels, and synthetic text, ensuring that a structured event list that can be used for querying, analysis, and model training can be further generated.

[0025] Then, step S2 performs in-depth correlation analysis based on the historical event list generated in the previous step and the existing historical operation knowledge graph. The historical operation knowledge graph is a relationship network containing known attack patterns, vulnerability associations, and threat intelligence entities. In this embodiment, the correlation analysis is performed by analyzing the correlation dimensions of entity dynamic attributes, adjacent entity analysis, and adjacent entity dynamic attributes to ensure that the correlation of these related events is evaluated and determined whether it is lower than the preset correlation threshold. If the correlation is less than the preset value, the process continues to step S3; otherwise, it proceeds to step S4.

[0026] Next, in step S3, potential malicious behavior is identified by cleaning and prioritizing low-relevance events. Specifically, an AI model is used to denoise related events to remove outliers that may affect the accuracy of the analysis. After processing, the AI ​​model is used to rank the denoised related events by risk to determine their priority. Based on the priority and relevance of the events, a risk score is performed to determine whether there is data indicating malicious attack behavior. If malicious attack behavior data is detected, an emergency response technical route is immediately established; otherwise, proceed to step S4. The emergency response technical route includes the interpretation, processing, and operational management of emergency events to ensure a rapid and effective response in the face of emergencies.

[0027] Finally, in step S4, high-correlation or low-risk events are processed routinely, focusing on risk control rather than emergency response; the contents of the security database are used to determine legitimate operation and maintenance operations and low-risk behavior patterns, specifically behavior sequence analysis: the LSTM model is used to determine whether it conforms to the normal user behavior sequence, and the matched related events are compared with the security database to determine the user behavior data type.

[0028] In one embodiment, the user behavior data types include malicious attack behavior data and security behavior data; when the risk score result exceeds the warning threshold, it is determined that there is malicious attack behavior data, and a warning signal is generated. Furthermore, based on user behavior data types and AI models, a technical roadmap for ordinary events is established. This roadmap also includes the interpretation, processing, and operational management of events, but its processing methods differ from those for emergency events, focusing more on data management and risk control under normal circumstances.

[0029] As one embodiment of the present invention, the process of extracting related events through correlation analysis based on the generated historical event list and historical operational knowledge graph is as follows: Based on the historical operational knowledge graph, entity features are extracted to extract the main features of security corpus events. Based on the main features of security corpus events, entity relationships and dynamic attributes of entities are extracted from security corpus events; Based on graph structure features, entity relationships and dynamic attributes of entities in security corpus events are extracted to obtain adjacent entity relationship values; Both attack event description texts and security event description texts are input into the BERT model for encoding and training. The adjacent entity relationship values ​​are input into the BERT model after encoding and training for target optimization. The correlation degree is output based on the target optimization result, and the correlation event is output based on the correlation degree.

[0030] In the above technical solution, correlation analysis ensures the accurate mining of event correlations from multi-dimensional and multi-modal data by deeply integrating the structured relationships of the knowledge graph with the semantic understanding capabilities of BERT, providing interpretable decision-making basis for security operations. Specifically, firstly, entity features are extracted from the historical operation knowledge graph to extract the main features of security corpus events; the structured features of the event subjects are extracted from the historical operation knowledge graph as the basis for subsequent correlation analysis; then, based on the main features of security corpus events, entity relationships and dynamic attributes of security corpus events are extracted to ensure the mining of correlation patterns between entities and attributes that evolve over time; next, based on graph structure features, entity relationships and dynamic attributes of security corpus events are extracted to obtain adjacent entity relationship values; the method for obtaining adjacent entity relationship values ​​is: based on the relationship between two adjacent entities in the knowledge graph... The weights of the shortest path are accumulated to determine the direct association strength between entities. The relationship values ​​between adjacent entities are used to quantify the direct association strength between entities. The output is usually an adjacency matrix or a list of triples, such as "Entity A, Entity B, Relationship value = 0.85", where Entity A and Entity B are adjacent entities. Further, attack event description texts are used as negative samples, and security event description texts are used as positive samples, both of which are input into the BERT model for encoding training. Encoding training ensures that the high-association time is selected through contrastive learning training. Finally, the BERT model is optimized by inputting the relationship values ​​of adjacent entities into the encoded training. The correlation degree is output according to the optimization result. The output value of the BERT model is normalized to the [0,1] interval. The top 5% to 10% of historical data are selected as high-association events by setting a dynamic threshold.

[0031] As one embodiment of the present invention, the correlation degree is determined by the product of the weight of the adjacent entity relationship value in the event description text and the entity dynamic path distance of adjacent events; the correlation degree includes the correlation degree of attack events and the correlation degree of security events; the weight of the adjacent entity relationship value is determined by the ratio of the adjacent entity relationship value to the preset relationship value.

[0032] In the above technical solution, the obtained relevance calculation method is to add the weight of the cumulative adjacent entity relationship value to the adjacent entity relationship value and multiply it by the path decay value, wherein the path decay value... The calculation formula is: ;in The attenuation rate; Data weights; This represents the age of the data at this path length.

[0033] In one embodiment of the present invention, the risk ranking is arranged in reverse order according to the magnitude of the event risk; that is, the lower the event risk, the higher the ranking number. This is achieved by performing risk ranking analysis on the associated events after noise reduction processing. Based on AI models, user behavior analysis is performed on the subjects of related events to identify the risks associated with these events; based on the identified related events, event risk information is obtained and stored in encrypted form. Sort the risks of related events and obtain the ranking number corresponding to the risks of related events; The sort number is compared with the preset sort number to determine if it is less than the preset sort number. If it is less than the preset sort number, the associated event is judged to have a high risk and the associated event is determined to have an event priority; otherwise, the event priority is not found.

[0034] In the above technical solution, the risk ranking criteria include: threat level: using CVSS scores and attack impact range (such as involving core databases); analyzing the behavior of the event subject based on AI models, quantifying risk information and storing it in encryption. Specifically, firstly, low-correlation events cleaned in step S3 (such as logs after filtering false positives); determining user behavior data through structured information such as operation logs, network traffic, and access permissions; the analysis dimensions for determining the risk of related events based on user behavior data include: firstly, determining user behavior patterns, including abnormal login times (such as access outside of working hours) and high-frequency sensitive operations (such as batch downloads); secondly, contextual association, judging whether the behavior matches a known attack chain (such as attempting privilege escalation after brute-force attack). The quantification method for determining event risk information based on user behavior patterns and corresponding contextual associations is as follows: rule engine: predefined risk weights (e.g., abnormal login count × 0.3 + sensitive operation count × 0.7); AI model: using supervised learning models (such as XGBoost, LSTM) to predict risk probabilities, with an output value range of [0,1]; and storing the information in an encrypted format according to the corresponding settings.

[0035] Then, the quantified risk information is represented as risk values, which are sorted in descending order of risk. The descending order logic is: the smaller the risk value, the larger the ranking number (e.g., risk value 0.2 → ranking number 100, risk value 0.8 → ranking number 20). The calculation method for ranking based on risk values ​​is as follows:

[0036] in, Risk value; These are normalization parameters; The sort number; Furthermore, the sorted number is compared with a preset sorted number to determine if it is less than the preset sorted number. If it is less than the preset sorted number, the associated event is considered to have a higher risk and is given event priority; otherwise, no event priority is given. The preset sorted number threshold is set according to business needs (e.g., threshold = 30, indicating that events with a risk value > 0.7 need to be processed first). The judgment logic is as follows: if the actual sorted number is less than the preset sorted number threshold, the risk is considered higher and it has priority (it needs to be processed immediately); conversely, if the actual sorted number is greater than or equal to the preset sorted number threshold, the risk is considered lower and it has no priority (it is archived or delayed).

[0037] As one embodiment of the present invention, the method for determining whether malicious attack behavior data exists is as follows: Risk scoring is performed based on event priority and event relevance. The event priority and event relevance of the associated events are obtained as the first and second scoring parameters, respectively, and then input into the recognition machine model for training. User behavior data is input into the trained recognition machine model for verification, an event risk scoring model is constructed, and the optimization results are output; the optimization results include the risk scoring results of the user behavior data.

[0038] The above technical solution first designs a machine learning model (neural network model) architecture to ensure that the model is trained using labeled data and learns the mapping relationship from priority and relevance to risk score. Then, it uses new user behavior data to validate the model, outputs a risk score, and iteratively optimizes it. Specifically, based on this machine learning model, it performs active learning, triggers manual review for events with low model prediction confidence (e.g., confidence 0.4-0.6), and incorporates the labeled results into the training set. The decay factor reduces the weight of old data over time to ensure the model adapts to the latest attack patterns. The model's anti-attack capability is improved by injecting adversarial examples (e.g., perturbed priority / relevance values). Noise is added during training to prevent the model from leaking sensitive user behavior information. Through risk score processing, the system can deeply integrate event priority and relevance to achieve accurate quantitative scoring of user behavior risk and provide the security team with interpretable and actionable decision-making basis.

[0039] The present invention also proposes a computer system comprising: a memory and a processor connected in communication, and a computer program stored in the memory and capable of running on the processor, wherein the processor executes a method for implementing AI-based secure Internet data operation and management when running the computer program.

[0040] A computer-readable storage medium storing a computer program that is executed by a processor. When the computer program is executed in a computer, it causes the computer to execute an AI-based secure internet data operation and management method. This AI-based secure internet data operation and management method can be applied in software form, such as by designing a program that can run independently on the computer-readable storage medium. The computer-readable storage medium can initiate the program of the entire method through an external trigger.

[0041] The various embodiments in this specification are described in a progressive manner. Similar or identical parts between embodiments can be referred to mutually. Each embodiment focuses on describing the differences from other embodiments. In particular, the embodiments of apparatus, devices, and non-volatile computer storage media are basically similar to the method embodiments, so the descriptions are relatively simple; relevant parts can be referred to the descriptions of the method embodiments.

[0042] The above content is merely an example and illustration of the concept of the present invention. Those skilled in the art can make various modifications or additions to the specific embodiments described or use similar methods to replace them, as long as they do not deviate from the concept of the invention or exceed the scope defined in this application, they should all fall within the protection scope of the present invention.

Claims

1. An internet data operation and management method based on AI security, characterized in that, The method includes: S1. Collect historical attack events and historical security events from the Internet big data database based on the AI ​​model, label the historical attack events and historical security events, and generate a list of historical events; S2. Based on the generated historical event list and historical operation knowledge graph, perform correlation analysis to extract related events, and determine whether the correlation degree is less than the preset correlation degree; if yes, proceed to step S3; if no, proceed to step S4. S3. Based on the AI ​​model, the associated events are denoised; the associated events after denoising are ranked according to the AI ​​model; and the event priority is determined according to the risk ranking result. Risk scoring is performed based on the event priority and the event correlation to determine whether there is malicious attack data; if so, an emergency event technical route is established; if not, proceed to step S4; the emergency event technical route includes emergency event interpretation, emergency event handling, and emergency event operation; S4. Match and analyze the associated events with the security database to determine the user behavior data type. Based on the user behavior data type and the AI ​​model, build a technical route for ordinary events. The technical route for ordinary events includes ordinary event interpretation, ordinary event processing, and ordinary event execution.

2. The internet data operation and management method based on AI security according to claim 1, characterized in that, The historical event list is generated as follows: The historical event list is structured, and the attack event subject, security event subject, and the target of the attack event subject and the target of the security event subject are extracted after the structured processing. Text annotations were created for the subject of the attack, the subject of the security incident, the target of the attack, and the target of the security incident. Based on the historical operational knowledge corpus, data synthesis is performed on the attack event subject, security event subject, and the target of the attack event subject and the target of the security event subject after text annotation to obtain attack event description text and security event description text; The attack event description text and security event description text are labeled to generate a historical event list.

3. The internet data operation and management method based on AI security according to claim 2, characterized in that, The process of extracting related events by performing correlation analysis based on the generated historical event list and historical operational knowledge graph is as follows: Based on the historical operational knowledge graph, entity features are extracted to extract the main features of security corpus events. Based on the main features of the security corpus events, entity relationships and dynamic attributes of the entities in the security corpus events are extracted; Based on graph structure features, entity relationships and dynamic attributes of entities in security corpus events are extracted to obtain adjacent entity relationship values; Both attack event description texts and security event description texts are input into the BERT model for encoding and training. The adjacent entity relationship values ​​are input into the BERT model after encoding and training for target optimization. The correlation degree is output based on the target optimization result, and the correlation event is output based on the correlation degree.

4. The internet data operation and management method based on AI security according to claim 3, characterized in that, The correlation is determined based on the product of the weights of the adjacent entity relationship values ​​in the event description text and the dynamic path distance between adjacent events; the correlation includes the correlation of attack events and the correlation of security events; the weights of the adjacent entity relationship values ​​are determined based on the ratio of the adjacent entity relationship values ​​to a preset relationship value.

5. The method for internet data operation and management based on AI security according to claim 1, characterized in that, The risk ranking is performed in descending order of event risk, meaning the lower the event risk, the higher the ranking number. This is achieved by performing risk ranking analysis on the associated events after noise reduction. Based on AI models, user behavior analysis is performed on the subjects of related events to identify the risks associated with these events. The risks of the associated events are sorted, and the ranking number corresponding to the risk of the associated events is obtained. The sorting number is compared with a preset sorting number to determine whether it is less than the preset sorting number. If it is less than the preset sorting number, the associated event is determined to have a high risk, and the associated event is determined to have an event priority. Otherwise, there is no event priority.

6. The internet data operation and management method based on AI security according to claim 5, characterized in that, The method for determining whether malicious attack data exists is as follows: Risk scoring is performed based on the event priority and the event correlation. The event priority and event relevance of the associated events are respectively used as the first scoring parameter and the second scoring parameter and input into the recognition machine model for training; User behavior data is input into a trained recognition machine model for verification, an event risk scoring model is constructed, and the optimization results are output; the optimization results include the risk scoring results of the user behavior data.

7. The method for internet data operation and management based on AI security according to claim 1, characterized in that, The user behavior data types include malicious attack behavior data and security behavior data; when the risk score exceeds the warning threshold, it is determined that there is malicious attack behavior data, and a warning signal is generated.

8. A computer system, comprising: A memory and processor connected by communication, and a computer program stored on the memory and capable of running on the processor, characterized in that: when the processor runs the computer program, it executes the AI-secure Internet data operation and management method according to any one of claims 1-7.

9. A computer-readable storage medium having a computer program stored thereon, which, when executed in a computer, causes the computer to perform the AI-secure Internet data operation and management method according to any one of claims 1-7.

Images