Network security system based on cloud computing and artificial intelligence

Abstract

The present invention belongs to the technical field of network security. Specifically disclosed is a network security system based on cloud computing and artificial intelligence. The system comprises: a cloud threat intelligence center; an edge computing node cluster, which is deployed at a user network boundary to execute lightweight threat detection; a dynamic behavior analysis engine, which learns and predicts attacker behavior patterns in real time on the basis of a deep reinforcement learning model; an adaptive defense policy generation module, which dynamically adjusts a protection rule on the basis of a threat level; and a blockchain-based evidence preservation unit, which is used for immutably recording attack events and response logs. Combining federated learning with edge computing resolves the trade-off between data privacy and real-time performance, thereby accurately identifying advanced threats such as APT attacks, and reducing the false positive rate; moreover, an ST-GNN is used to model spatiotemporal behavior features of attackers, thereby enabling an adaptive defense engine to adjust policies in real time, such as performing isolation and traffic scrubbing.

Description

A cybersecurity system based on cloud computing and artificial intelligence Technical Field

[0001] This invention relates to the field of network security technology, specifically to a network security system based on cloud computing and artificial intelligence. Background Technology

[0002] Artificial intelligence (AI) is a branch of computer science that attempts to understand the essence of intelligence and produce a new kind of intelligent machine that can react in a way similar to human intelligence. Research in this field includes robotics, speech recognition, image recognition, natural language processing, and expert systems. Since its inception, AI has seen its theories and technologies mature, and its applications have expanded continuously. It is conceivable that future AI-driven technological products will be "containers" of human wisdom. AI can simulate the information processes of human consciousness and thought. While AI is not human intelligence, it can think like a human and may even surpass human intelligence. With societal development, network technology is becoming increasingly sophisticated; however, network technology also presents some security issues, such as:

[0003] Rule-based signature-based detection (such as IDS / IPS) cannot handle zero-day vulnerabilities and advanced persistent threats (APTs), resulting in a high false positive rate.

[0004] Static defense strategies lack dynamic adjustment capabilities, resulting in delayed responses or excessive disruption of business operations;

[0005] Threat propagation risks are amplified in multi-tenant architectures, rendering traditional perimeter protection ineffective. Summary of the Invention

[0006] The purpose of this section is to outline some aspects of the embodiments of the present invention and to briefly describe some preferred embodiments. Simplifications or omissions may be made in this section, as well as in the abstract and title of this application, to avoid obscuring the purpose of these documents; however, such simplifications or omissions should not be construed as limiting the scope of the invention.

[0007] Therefore, the purpose of this invention is to provide a network security system based on cloud computing and artificial intelligence, which combines federated learning with edge computing to resolve the contradiction between data privacy and real-time performance, accurately identify advanced threats such as APT attacks, reduce false alarm rates, and at the same time use ST-GNN to model the spatiotemporal behavioral characteristics of attackers, and the adaptive defense engine adjusts strategies in real time, such as isolation and traffic scrubbing.

[0008] To address the aforementioned technical problems, according to one aspect of the present invention, the present invention provides the following technical solution:

[0009] A network security system based on cloud computing and artificial intelligence, comprising:

[0010] A cloud-based threat intelligence center is used to aggregate multi-source heterogeneous threat data in real time.

[0011] Edge computing node clusters are deployed at the user network boundary to perform lightweight threat detection;

[0012] The dynamic behavior analysis engine, based on a deep reinforcement learning model, learns and predicts attacker behavior patterns in real time.

[0013] The adaptive defense strategy generation module dynamically adjusts protection rules based on the threat level.

[0014] Blockchain-based evidence storage units are used to immutably record attack events and response logs.

[0015] As a preferred embodiment of the network security system based on cloud computing and artificial intelligence described in this invention, the dynamic behavior analysis engine includes:

[0016] A multimodal feature extraction layer that integrates three-dimensional features of network traffic, user behavior, and device fingerprint;

[0017] Spatiotemporal graph neural networks are used to model the interconnected behaviors of attackers across time and devices.

[0018] An online incremental learning mechanism automatically triggers model updates when a zero-day attack is detected.

[0019] As a preferred embodiment of the cloud computing and artificial intelligence-based network security system described in this invention, the adaptive defense strategy generation module operates through the following steps:

[0020] a) Quantitatively assess the potential impact and business criticality of the attack;

[0021] b) Generate a combined defense strategy that includes network isolation, traffic scrubbing, and honeypot trapping;

[0022] c) Continuously optimize the strategy selection weights based on the Q-learning algorithm.

[0023] As a preferred embodiment of the network security system based on cloud computing and artificial intelligence described in this invention, the edge computing node cluster adopts:

[0024] A containerized microservice architecture with on-demand loading of detection algorithms;

[0025] A federated learning mechanism collaboratively updates the detection model while protecting data privacy.

[0026] The hardware acceleration module uses an FPGA to achieve real-time decryption of encrypted traffic.

[0027] As a preferred embodiment of the cloud computing and artificial intelligence-based cybersecurity system described in this invention, the cloud-based threat intelligence center further includes:

[0028] Threat knowledge graph building module, which associates attackers, vulnerabilities, and malware entities;

[0029] Virtual patch generator generates temporary protection rules by semantically analyzing CVE descriptions;

[0030] A cross-tenant threat propagation prediction model, based on complex network theory, assesses the risks of multi-tenant cloud environments.

[0031] As a preferred embodiment of the cloud computing and artificial intelligence-based cybersecurity system described in this invention, the cloud-based threat intelligence center is connected to an adversarial training subsystem, which includes the following:

[0032] Generate adversarial attack samples in a sandbox environment;

[0033] Enhance the robustness of the detection model by using generative adversarial networks;

[0034] Regularly conduct red-blue team exercises and provide feedback to optimize the detection logic.

[0035] A security protection method based on any of the above-mentioned cloud computing and artificial intelligence-based network security systems is characterized by comprising the following steps:

[0036] S1. Collect network metadata through edge nodes and perform preliminary anomaly detection;

[0037] S2. Transmit suspicious events to the cloud for in-depth correlation analysis;

[0038] S3. When an advanced persistent threat is detected, initiate cross-platform coordinated defense;

[0039] S4. Use digital twin technology to simulate attack paths and preview defense effects.

[0040] As a preferred embodiment of the security protection method based on cloud computing and artificial intelligence described in this invention, the coordinated defense in step S3 includes:

[0041] Synchronously update the access control policies of all edge nodes;

[0042] Dynamically reroute high-risk traffic in the SDN controller;

[0043] Threat intelligence sharing alerts are sent to affiliated companies.

[0044] Compared with the prior art, the beneficial effects of the present invention are as follows:

[0045] 1. Combining federated learning with edge computing resolves the conflict between data privacy and real-time performance, accurately identifies advanced threats (such as APT attacks), and reduces false positive rates;

[0046] 2. ST-GNN is used to model the spatiotemporal behavioral characteristics of attackers, and the adaptive defense engine adjusts the strategy (such as isolation and traffic scrubbing) in real time;

[0047] 3. Q-learning enables dynamic optimization of defense strategies, reducing the manpower required for threat analysis. Attached Figure Description

[0048] To more clearly illustrate the technical solutions of the embodiments of the present invention, the present invention will be described in detail below with reference to the accompanying drawings and detailed embodiments. Obviously, the drawings described below are only some embodiments of the present invention. For those skilled in the art, other drawings can be obtained based on these drawings without creative effort. Wherein:

[0049] Figure 1 is a schematic diagram of the overall structure of the present invention;

[0050] Figure 2 is a schematic block diagram of the safety protection method steps of the present invention. Detailed Implementation

[0051] To make the above-mentioned objects, features and advantages of the present invention more apparent and understandable, the specific embodiments of the present invention will be described in detail below with reference to the accompanying drawings.

[0052] Many specific details are set forth in the following description in order to provide a full understanding of the invention. However, the invention may also be practiced in other ways different from those described herein, and those skilled in the art can make similar extensions without departing from the spirit of the invention. Therefore, the invention is not limited to the specific embodiments disclosed below.

[0053] Secondly, the present invention is described in detail with reference to the schematic diagrams. When detailing the embodiments of the present invention, for ease of explanation, the cross-sectional views illustrating the device structure may be partially enlarged, not according to the usual scale. Furthermore, the schematic diagrams are merely examples and should not limit the scope of protection of the present invention. In addition, actual fabrication should include three-dimensional spatial dimensions of length, width, and depth.

[0054] To make the objectives, technical solutions, and advantages of the present invention clearer, the embodiments of the present invention will be described in further detail below with reference to the accompanying drawings.

[0055] This invention provides a network security system based on cloud computing and artificial intelligence, as shown in Figure 1, including:

[0056] A cloud-based threat intelligence center is used to aggregate multi-source heterogeneous threat data in real time.

[0057] Edge computing node clusters are deployed at the user network boundary to perform lightweight threat detection;

[0058] The dynamic behavior analysis engine, based on a deep reinforcement learning model, learns and predicts attacker behavior patterns in real time.

[0059] The adaptive defense strategy generation module dynamically adjusts protection rules based on the threat level.

[0060] Blockchain-based evidence storage units are used to immutably record attack events and response logs.

[0061] The dynamic behavior analysis engine includes:

[0062] A multimodal feature extraction layer that integrates three-dimensional features of network traffic, user behavior, and device fingerprint;

[0063] Spatiotemporal graph neural networks are used to model the interconnected behaviors of attackers across time and devices.

[0064] An online incremental learning mechanism automatically triggers model updates when a zero-day attack is detected.

[0065] The adaptive defense strategy generation module operates through the following steps:

[0066] Quantitatively assess the potential impact and business criticality of the attack;

[0067] Generate a combined defense strategy that includes network isolation, traffic scrubbing, and honeypot trapping;

[0068] The strategy selection weights are continuously optimized based on the Q-learning algorithm.

[0069] Edge computing node clusters adopt:

[0070] A containerized microservice architecture with on-demand loading of detection algorithms;

[0071] A federated learning mechanism collaboratively updates the detection model while protecting data privacy.

[0072] The hardware acceleration module uses an FPGA to achieve real-time decryption of encrypted traffic.

[0073] The cloud-based threat intelligence center also includes:

[0074] Threat knowledge graph building module, which associates attackers, vulnerabilities, and malware entities;

[0075] Virtual patch generator generates temporary protection rules by semantically analyzing CVE descriptions;

[0076] A cross-tenant threat propagation prediction model, based on complex network theory, assesses the risks of multi-tenant cloud environments.

[0077] It also includes an adversarial training subsystem:

[0078] Generate adversarial attack samples in a sandbox environment;

[0079] Enhance the robustness of the detection model by using generative adversarial networks;

[0080] Regularly conduct red-blue team exercises and provide feedback to optimize the detection logic.

[0081] A security protection method for a network security system based on cloud computing and artificial intelligence includes the following steps:

[0082] S1. Collect network metadata through edge nodes and perform preliminary anomaly detection;

[0083] S2. Transmit suspicious events to the cloud for in-depth correlation analysis;

[0084] S3. When an advanced persistent threat is detected, initiate cross-platform coordinated defense;

[0085] S4. Use digital twin technology to simulate attack paths and preview defense effects.

[0086] The coordinated defense in step S3 includes:

[0087] Synchronously update the access control policies of all edge nodes;

[0088] Dynamically reroute high-risk traffic in the SDN controller;

[0089] Threat intelligence sharing alerts are sent to affiliated companies.

[0090] Working principle: When in use, this invention employs a "cloud-edge" collaborative architecture, achieving efficient threat detection and response through distributed deployment.

[0091] Edge nodes (close to the data source) process real-time traffic and perform lightweight detection (such as abnormal traffic identification);

[0092] The cloud-based (centralized) center performs complex analyses (such as APT attack correlations) to form a global threat view;

[0093] Blockchain ensures that the logs of all nodes are immutable, enhancing the credibility of attack attribution tracing;

[0094] Dynamic threat detection process:

[0095] Step 1: Multi-dimensional data collection

[0096] Edge nodes collect network traffic, user operation logs, and device behavior data, and decrypt encrypted traffic in real time through a hardware acceleration module (FPGA).

[0097] Step 2: Layered Detection Mechanism

[0098] Edge layer: Use lightweight AI models (such as pruned CNNs) to quickly filter suspicious events (such as brute-force attempts);

[0099] Cloud layer:

[0100] The ST-GNN model analyzes the correlation of attacker behavior across different times and devices (e.g., attackers first scan ports and then move laterally).

[0101] Knowledge graphs are used to associate vulnerabilities, malicious IPs, and other entities to identify potential attack chains (such as attempts to exploit the CVE-2023-1234 vulnerability).

[0102] Step 3: Enhanced Adversarial Force

[0103] The system periodically trains its model using adversarial examples (such as obfuscated malware signatures) generated by GANs to improve its resistance to evasion attacks. 3. Adaptive defense response;

[0104] Step 4: Dynamically generate strategies

[0105] Q-learning algorithms evaluate the long-term benefits of different defensive actions (such as blocking IPs and traffic scrubbing) and select the optimal combination.

[0106] Step 5: Cross-platform integration

[0107] Dynamically adjust network topology using an SDN controller (e.g., redirect attack traffic to honeypots);

[0108] Share threat intelligence (such as a blacklist of malicious domains) with affiliated companies to form a collaborative defense.

[0109] Although the present invention has been described above with reference to embodiments, various modifications can be made and components can be replaced with equivalents without departing from the scope of the invention. In particular, as long as there is no structural conflict, the features in the disclosed embodiments can be combined with each other in any manner. The lack of an exhaustive description of these combinations in this specification is merely for the sake of brevity and resource conservation. Therefore, the present invention is not limited to the specific embodiments disclosed herein, but includes all technical solutions falling within the scope of the claims.

Claims

1. A cloud computing and artificial intelligence based cyber security system, characterized in that, include: A cloud-based threat intelligence center is used to aggregate multi-source heterogeneous threat data in real time. Edge computing node clusters are deployed at the user network boundary to perform lightweight threat detection; The dynamic behavior analysis engine, based on a deep reinforcement learning model, learns and predicts attacker behavior patterns in real time. The adaptive defense strategy generation module dynamically adjusts protection rules based on the threat level. Blockchain-based evidence storage units are used to immutably record attack events and response logs.

2. The network security system based on cloud computing and artificial intelligence according to claim 1, characterized in that, The dynamic behavior analysis engine includes: A multimodal feature extraction layer that integrates three-dimensional features of network traffic, user behavior, and device fingerprint; Spatiotemporal graph neural networks are used to model the interconnected behaviors of attackers across time and devices. An online incremental learning mechanism automatically triggers model updates when a zero-day attack is detected.

3. The network security system based on cloud computing and artificial intelligence according to claim 1, characterized in that, The adaptive defense strategy generation module operates through the following steps: a) Quantitatively assess the potential impact and business criticality of the attack; b) Generate a combined defense strategy that includes network isolation, traffic scrubbing, and honeypot trapping; c) Continuously optimize the strategy selection weights based on the Q-learning algorithm.

4. The network security system based on cloud computing and artificial intelligence according to claim 1, characterized in that, The edge computing node cluster adopts: A containerized microservice architecture with on-demand loading of detection algorithms; A federated learning mechanism collaboratively updates the detection model while protecting data privacy. The hardware acceleration module uses an FPGA to achieve real-time decryption of encrypted traffic.

5. The network security system based on cloud computing and artificial intelligence according to claim 1, characterized in that, The cloud-based threat intelligence center also includes: Threat knowledge graph building module, which associates attackers, vulnerabilities, and malware entities; Virtual patch generator generates temporary protection rules by semantically analyzing CVE descriptions; A cross-tenant threat propagation prediction model, based on complex network theory, assesses the risks of multi-tenant cloud environments.

6. The network security system based on cloud computing and artificial intelligence of claim 1, wherein, The cloud-based threat intelligence center is connected to the adversarial training subsystem, which includes the following: Generate adversarial attack samples in a sandbox environment; Enhance the robustness of the detection model by using generative adversarial networks; Regularly conduct red-blue team exercises and provide feedback to optimize the detection logic.

7. A security protection method based on the network security system based on cloud computing and artificial intelligence according to any one of claims 1-6, characterized in that, Includes the following steps: S1. Collect network metadata through edge nodes and perform preliminary anomaly detection; S2. Transmit suspicious events to the cloud for in-depth correlation analysis; S3. When an advanced persistent threat is detected, initiate cross-platform coordinated defense; S4. Use digital twin technology to simulate attack paths and preview defense effects.

8. The network security protection method based on cloud computing and artificial intelligence according to claim 7, characterized in that, The coordinated defense in step S3 includes: Synchronously update the access control policies of all edge nodes; Dynamically reroute high-risk traffic in the SDN controller; Threat intelligence sharing alerts are sent to affiliated companies.

Images