Network security protection system based on firewall technology

Abstract

The invention belongs to the technical field of network security, and particularly relates to a network security protection system based on a firewall technology, which comprises an intelligent analysis module, a dynamic defense module, a firewall test module, a protection test evaluation module and a network security supervision end, according to the invention, the intelligent analysis module carries out deep analysis and intelligent analysis on the network flow by adopting deep learning and machine learning technologies, and the dynamic defense module dynamically adjusts the protection strategy of the firewall according to the detection analysis result of the intelligent analysis module, thereby achieving the precise recognition and quick response of the network threat. The firewall test module is used for testing the protection performance of the firewall, the protection test evaluation module is used for comprehensively evaluating the protection performance of the firewall based on various test results, and corresponding optimization and improvement measures are taken for the firewall when a protection performance early warning signal is generated, so that the network security is ensured; the management difficulty for network security protection is obviously reduced, and the intelligent degree is high.

Description

Technical Field

[0001] The present invention relates to the technical field of network security, in particular to a network security protection system based on firewall technology. Background Art

[0002] Network security covers the processes and technologies of protecting computer network systems from unauthorized access, disclosure, interruption, modification or destruction to ensure the confidentiality, integrity, availability and other related security attributes of information. With the rapid development of network technology, network security issues are becoming increasingly prominent.

[0003] At present, when using firewall technology for network security protection, it is often difficult to conduct a comprehensive test of the firewall and accurately judge its protection performance, and it is difficult to reasonably analyze and accurately feedback the network security management status, which is not conducive to ensuring network security. The management of network security protection is difficult and the degree of intelligence is low;

[0004] In view of the above technical defects, a solution is now proposed. Summary of the invention

[0005] The purpose of the present invention is to provide a network security protection system based on firewall technology, which solves the problem that the prior art is difficult to comprehensively test the firewall and accurately judge its protection performance, and is difficult to reasonably analyze and accurately feedback the network security management status, which is not conducive to ensuring network security and has a low degree of intelligence.

[0006] To achieve the above object, the present invention provides the following technical solutions:

[0007] A network security protection system based on firewall technology, including intelligent analysis module, dynamic defense module, firewall test module, protection test evaluation module and network security supervision terminal;

[0008] The intelligent analysis module uses deep learning and machine learning technologies to perform in-depth analysis and intelligent analysis of network traffic, and sends the detection and analysis results to the dynamic defense module and network security supervision end;

[0009] The dynamic defense module dynamically adjusts the firewall's protection strategy according to the detection and analysis results of the intelligent analysis module, records the defense execution monitoring information of the corresponding protection process, and sends the defense execution monitoring information to the network security supervision end;

[0010] The firewall test module is used to test the protection performance of the firewall, obtain various test results through the protection performance test, and send all test results to the protection test evaluation module;

[0011] The protection test evaluation module conducts a comprehensive evaluation of the firewall's protection performance based on the test results, generates a protection performance qualification signal or a protection performance warning signal through analysis, and sends the protection performance qualification signal or the protection performance warning signal to the network security supervision end. The network security supervision end issues a corresponding warning when it receives the protection performance warning signal.

[0012] Furthermore, the protection performance test of the firewall test module includes throughput test, delay test, concurrent connection number test, packet loss rate test and defense security test. In the throughput test, a special traffic generator is used to simulate network traffic, and the throughput limit of the firewall is tested by continuously increasing the traffic, thereby obtaining the throughput detection value;

[0013] When performing a delay test, a data packet of a specific size is sent to test the time interval from when the data packet enters the firewall to when it leaves the firewall, and the delay detection value is obtained accordingly;

[0014] When testing the number of concurrent connections, use a stress test tool to send a large number of concurrent connection requests to the firewall to test its concurrent processing capability. Based on this, the maximum number of connections that can be established simultaneously between hosts that pass through the firewall or between a host and the firewall is obtained and marked as the concurrent connection detection value.

[0015] When performing a packet loss rate test, the firewall is tested at a given rate and the packet loss situation is recorded. The packet loss rate of the firewall under different loads is averaged to obtain the packet loss detection value.

[0016] When conducting defense security testing, various network attacks are simulated to observe whether the firewall can accurately identify and intercept these attacks, and the defense detection value is obtained through attack identification, interception, detection and analysis.

[0017] Furthermore, the specific analysis process of attack identification, interception, detection and analysis is as follows:

[0018] If the firewall fails to identify and intercept the corresponding network attack within the specified time, the corresponding network attack will be marked as an invalid defense object; a set of preset risk weight values ​​is set in advance for each network attack, and the preset risk weight values ​​of all invalid defense objects are summed up to obtain the invalid risk value;

[0019] If the firewall completes the identification and interception of the corresponding network attack within the corresponding specified time, the ratio of the actual completion time to the corresponding specified time will be marked as the identification and interception time value, and the corresponding network attack will be marked as an effective defense object, and the identification and interception time values ​​of all effective defense objects will be averaged to obtain the defense effectiveness inspection value; the defense detection value will be obtained by numerically calculating the invalid hidden danger value and the defense effectiveness inspection value.

[0020] Furthermore, the specific operation process of the protection test evaluation module includes:

[0021] The throughput detection value, delay detection value, concurrent connection detection value, packet loss detection value and defense detection value sent by the firewall test module are obtained, and the throughput detection value, delay detection value, concurrent connection detection value, packet loss detection value and defense detection value are numerically compared with the corresponding preset thresholds respectively. If the throughput detection value or the concurrent connection detection value does not exceed the corresponding preset threshold and the delay detection value, packet loss detection value or defense detection value exceeds the corresponding preset threshold, a protection performance warning signal is generated.

[0022] Further, if the throughput detection value and the concurrent connection detection value both exceed the corresponding preset thresholds and the delay detection value, the packet loss detection value and the defense detection value do not exceed the corresponding preset thresholds, the firewall performance detection coefficient is obtained by numerically calculating the throughput detection value, the delay detection value, the concurrent connection detection value, the packet loss detection value and the defense detection value;

[0023] The firewall performance inspection coefficient is numerically compared with the preset firewall performance inspection coefficient threshold. If the firewall performance inspection coefficient exceeds the preset firewall performance inspection coefficient threshold, a protection performance warning signal is generated; if the firewall performance inspection coefficient does not exceed the preset firewall performance inspection coefficient threshold, a protection performance qualified signal is generated.

[0024] Furthermore, the network security supervision end is communicated with the network security management decision-making module. The network security management decision-making module is used to set the detection period, analyze the network security management status during the detection period, and obtain the test execution judgment symbol CP-1 or CP-2 and the threat defense judgment symbol LP-1 or LP-2. If CP-2∩LP-2 is obtained, a management qualification signal is generated. In other cases, a management exception signal is generated, and the management qualification signal or the management exception signal is sent to the network security supervision end. When the network security supervision end receives the management exception signal, it will issue a corresponding warning.

[0025] Furthermore, the network security management decision module is connected to the test execution tracing module and the threat defense detection module in communication. The test execution tracing module analyzes the test execution status of the firewall during the detection period, assigns a test execution judgment symbol CP-1 or CP-2 through the analysis, and sends the test execution judgment symbol CP-1 or CP-2 to the network security management decision module;

[0026] The threat defense detection module analyzes the defense status against network threats during the detection period, assigns a threat defense judgment symbol LP-1 or LP-2 through analysis, and sends the threat defense judgment symbol LP-1 or LP-2 to the network security management decision module.

[0027] Furthermore, the specific analysis process of the test execution traceability module is as follows:

[0028] The interval between two adjacent test times for the firewall protection performance test during the detection period is obtained and marked as the test interval value, and the average of all the test interval values ​​during the detection period is calculated to obtain the test interval value; the test interval value is numerically compared with the preset test interval threshold, and the number of test interval values ​​exceeding the preset test interval threshold during the detection period is marked as the test interval value;

[0029] And mark the test interval value with the largest numerical value during the detection period as the test interval value, obtain the test execution traceability value by numerically calculating the test condition value, the test difference value and the test interval value, and compare the test execution traceability value with the preset test execution traceability threshold value. If the test execution traceability value exceeds the preset test execution traceability threshold value, the test execution judgment symbol CP-1 is assigned; if the test execution traceability value does not exceed the preset test execution traceability threshold value, the test execution judgment symbol CP-2 is assigned.

[0030] Furthermore, the specific analysis process of the threat defense detection module is as follows:

[0031] When the dynamic defense module dynamically adjusts the protection strategy of the firewall to deal with the existing network threats, if the corresponding network threats cannot be eliminated within the corresponding preset time, the corresponding network threats will be marked as eliminated threats;

[0032] All the elimination threats within the detection period are obtained and classified, the number of the corresponding type of elimination threats within the detection period is collected and marked as the threat number check value, each type of elimination threat is set in advance to correspond to a set of preset threat impact values, and the product of the threat number check value of the corresponding type of elimination threat and the corresponding preset threat impact value is marked as the threat judgment value;

[0033] The threat defense detection value is calculated by summing up the threat judgment values ​​of all types of anomaly elimination threats existing during the detection period, and the threat defense detection value is numerically compared with the preset threat defense detection threshold. If the threat defense detection value exceeds the preset threat defense detection threshold, the threat defense judgment symbol LP-1 is assigned; if the threat defense detection value does not exceed the preset threat defense detection threshold, the threat defense judgment symbol LP-2 is assigned.

[0034] Compared with the prior art, the present invention has the following beneficial effects:

[0035] 1. In the present invention, the intelligent analysis module uses deep learning and machine learning technology to perform in-depth analysis and intelligent analysis of network traffic. The dynamic defense module dynamically adjusts the protection strategy of the firewall according to the detection and analysis results of the intelligent analysis module to achieve accurate identification and rapid response to network threats. The firewall is tested for protection performance through the firewall test module. The protection test evaluation module comprehensively evaluates the protection performance of the firewall based on various test results to achieve timely optimization of the firewall, which is conducive to ensuring network security and significantly reducing the management difficulty of network security protection.

[0036] 2. In the present invention, the test execution status of the firewall during the detection period is analyzed through the test execution tracing module, the threat defense detection module analyzes the defense status against network threats during the detection period, and the network security management decision module conducts a comprehensive assessment of the network security management status based on the test execution tracing analysis results and the threat defense analysis results. When a management exception signal is generated, the test execution supervision of the firewall is strengthened and the supervision is optimized to ensure the protection performance of the firewall, further improve network security, and have a high degree of intelligence. BRIEF DESCRIPTION OF THE DRAWINGS

[0037] In order to facilitate understanding by those skilled in the art, the present invention is further described below in conjunction with the accompanying drawings;

[0038] Figure 1 This is a system block diagram of Embodiment 1 of the present invention;

[0039] Figure 2 This is a system block diagram of Embodiment 2 of the present invention. DETAILED DESCRIPTION

[0040] The following will be combined with the drawings in the embodiments of the present invention to clearly and completely describe the technical solutions in the embodiments of the present invention. Obviously, the described embodiments are only part of the embodiments of the present invention, not all of the embodiments. Based on the embodiments of the present invention, all other embodiments obtained by ordinary technicians in this field without creative work are within the scope of protection of the present invention.

[0041] Embodiment 1: Figure 1 As shown, the network security protection system based on firewall technology proposed in the present invention includes an intelligent analysis module, a dynamic defense module, a firewall test module, a protection test evaluation module and a network security supervision terminal;

[0042] The intelligent analysis module uses deep learning and machine learning technologies to perform in-depth analysis and intelligent analysis of network traffic, and sends the detection and analysis results to the dynamic defense module and the network security supervision end, so that the dynamic defense module can take corresponding countermeasures in time to ensure network security; the details are as follows:

[0043] Step 1: Data collection and preprocessing: The intelligent analysis module collects network traffic data in real time. These data include packets of various network protocols, such as TCP, UDP, etc., and the load information they carry. The collected data is preprocessed, including data cleaning (removing noise, duplicate data, etc.), data formatting (unifying data format for subsequent processing) and data compression (reducing storage and transmission costs).

[0044] Step 2: Feature extraction: After preprocessing, the intelligent analysis module uses the feature extraction capability of deep learning technology to deeply analyze the network traffic data. This step aims to extract features from the raw traffic data that are useful for subsequent analysis. Feature extraction can be achieved through deep learning models such as convolutional neural networks (CNN) and recurrent neural networks (RNN). These models can automatically learn and extract key features from traffic data, such as traffic patterns, protocol behaviors, abnormal behaviors, etc.

[0045] Step 3: Intelligent analysis and detection: Based on feature extraction, the intelligent analysis module uses machine learning algorithms to perform intelligent analysis and detection on the extracted features. This process includes the following key steps:

[0046] Classification and identification: Use classification algorithms (such as support vector machines, random forests, neural networks, etc.) to classify traffic and distinguish normal traffic from abnormal traffic. Abnormal traffic includes network attacks, virus transmission, malware, etc.

[0047] Anomaly detection: Through the trained anomaly detection model, traffic data is monitored in real time to identify abnormal behaviors that do not match the normal traffic pattern. These abnormal behaviors may be new network attack methods or variants of known attacks.

[0048] Intrusion Detection: Combined with the technology of Intrusion Detection System (IDS), it conducts in-depth analysis of malicious behaviors in traffic to determine whether there is any intrusion.

[0049] The dynamic defense module dynamically adjusts the firewall's protection strategy based on the detection and analysis results of the intelligent analysis module, records the defense execution monitoring information of the corresponding protection process, and sends the defense execution monitoring information to the network security supervision end, which can achieve accurate identification and rapid response to network threats and significantly improve the network security protection effect; the details are as follows:

[0050] Step 1: Receive detection results: The dynamic defense module receives detection results from the intelligent analysis module in real time. These detection results usually contain key information such as abnormal behavior of network traffic, potential threat types, attack source IP, target port, etc.

[0051] Threat assessment: After receiving the detection results, the dynamic defense module evaluates the threat. The evaluation process includes the following aspects:

[0052] Threat type identification: Determine the type of threat detected, such as DDoS attack, SQL injection, malware propagation, etc.

[0053] Threat level determination: Determine the threat level based on the severity of the threat, the scope of impact, and other factors, so as to decide on subsequent treatment measures;

[0054] Attack source analysis: Analyze the source of the attack, including IP address, geographic location, historical attack records and other information, so as to carry out targeted defense;

[0055] Step 2: Protection strategy selection: Based on the threat assessment results, the dynamic defense module will select or generate corresponding protection strategies, including:

[0056] Rule Update: Dynamically add or update rules to the firewall to intercept traffic from specific IP addresses or ports, or block specific types of network protocols and packets;

[0057] Traffic redirection: redirect suspicious traffic to a dedicated isolation area or sandbox environment for analysis and processing to prevent it from affecting normal business;

[0058] Resource isolation: When a large-scale attack is detected, the affected network resources (such as servers, network devices, etc.) are automatically isolated to prevent the attack from spreading;

[0059] Dynamic response: Dynamically adjust the firewall's response speed and interception strength according to real-time changes in threats to maintain the best protection effect;

[0060] Step 3: Policy execution and monitoring: The selected protection policy will be executed immediately and continuously monitored by the dynamic defense module. The monitoring content includes but is not limited to:

[0061] Verify the effectiveness of the policy: Verify whether the new policy effectively intercepts threat traffic by monitoring changes in network traffic;

[0062] Performance evaluation: Evaluate the impact of new policies on system performance to ensure that normal business operations are not affected while ensuring security;

[0063] Feedback mechanism: Establish a feedback mechanism to collect problems and suggestions during the implementation of new strategies for subsequent optimization and improvement.

[0064] The firewall test module is used to test the protection performance of the firewall. Various test results are obtained through the protection performance test, and all test results are sent to the protection test evaluation module to provide data support for the analysis process of the protection test evaluation module and ensure the accuracy of its analysis results. It should be noted that the protection performance test of the firewall test module includes throughput test, delay test, concurrent connection number test, packet loss rate test and defense security test.

[0065] When conducting a throughput test, throughput refers to the number of data packets or traffic size that the firewall can process per second. A dedicated traffic generator (such as Ixia, Spirent, etc.) is used to simulate network traffic. The throughput limit of the firewall is tested by continuously increasing traffic, and the throughput detection value is obtained based on this. The larger the throughput detection value, the stronger the firewall's ability to handle data traffic.

[0066] When performing a delay test, delay refers to the time delay for a data packet to pass through the firewall. By sending a data packet of a specific size, the time interval from the data packet entering the firewall to leaving the firewall is tested (that is, the round-trip time is measured to evaluate the delay performance of the firewall), and the delay detection value is obtained based on this. The smaller the delay detection value, the better the corresponding performance of the firewall.

[0067] When testing the number of concurrent connections, use a stress test tool to send a large number of concurrent connection requests to the firewall to test its concurrent processing capabilities. Based on this, the maximum number of connections that can be established simultaneously between hosts passing through the firewall or between a host and the firewall is obtained and marked as the concurrent connection detection value. Among them, when the concurrent connection detection value is larger, it indicates that the firewall can handle more network connections at the same time, and the corresponding performance is better.

[0068] When conducting a packet loss rate test, the firewall is tested at a given rate and the packet loss situation is recorded. The packet loss rate of the firewall under different loads is averaged to obtain the packet loss detection value. The packet loss rate reflects the data packet loss of the firewall during the transmission process. The smaller the packet loss detection value, the better.

[0069] When conducting defense security testing, simulate various network attacks (such as IP address spoofing attacks, ICMP attacks, DoS attacks, etc.) to observe whether the firewall can accurately identify and intercept these attacks. Through attack identification, interception, detection and analysis, we can obtain the defense detection value, as follows:

[0070] If the firewall fails to identify and intercept the corresponding network attack within the corresponding specified time, indicating that it is difficult to efficiently identify and intercept the corresponding network attack, the corresponding network attack will be marked as an invalid defense object; a set of preset risk weight values ​​is set in advance for each network attack, wherein the values ​​of the preset risk weight values ​​are all positive numbers, and the greater the threat level brought by the corresponding network attack, the greater the value of the preset risk weight value that matches it; the preset risk weight values ​​of all invalid defense objects are summed up to calculate the invalid risk value;

[0071] If the firewall completes the identification and interception of the corresponding network attack within the corresponding specified time, the ratio of the actual completion time to the corresponding specified time is marked as the identification and interception time value, and the corresponding network attack is marked as an effective defense object. The identification and interception time values ​​of all effective defense objects are averaged to obtain the defense effectiveness inspection value;

[0072] The invalid risk value FW and the defense effectiveness check value FM are numerically calculated using the formula FX=g1*FW+g2*FM to obtain the defense detection value FX; wherein g1 and g2 are preset weight coefficients whose values ​​are greater than zero, and the larger the value of the defense detection value FX is, the worse the defense security test result is, and the less the defense performance of the firewall meets the requirements.

[0073] The protection test evaluation module comprehensively evaluates the protection performance of the firewall based on the test results, generates a qualified protection performance signal or a protection performance warning signal through analysis, and sends the qualified protection performance signal or the protection performance warning signal to the network security supervision end. The network security supervision end issues a corresponding warning when receiving the protection performance warning signal, and can comprehensively analyze and comprehensively evaluate the protection performance of the firewall. After the warning is issued, the cause investigation and analysis is carried out and corresponding optimization and improvement measures are taken for the firewall, so as to ensure its subsequent protection performance for network security and reduce the management difficulty of network security protection. The specific operation process of the protection test evaluation module is as follows:

[0074] The throughput detection value, delay detection value, concurrent connection detection value, packet loss detection value and defense detection value sent by the firewall test module are obtained, and the throughput detection value, delay detection value, concurrent connection detection value, packet loss detection value and defense detection value are numerically compared with the corresponding preset thresholds respectively. If the throughput detection value or the concurrent connection detection value does not exceed the corresponding preset threshold and the delay detection value, packet loss detection value or defense detection value exceeds the corresponding preset threshold, a protection performance warning signal is generated.

[0075] Furthermore, if the throughput detection value and the concurrent connection detection value both exceed the corresponding preset thresholds and the delay detection value, packet loss detection value, and defense detection value do not exceed the corresponding preset thresholds, then the formula The throughput detection value WF, the delay detection value TP, the concurrent connection detection value NY, the packet loss detection value WY and the defense detection value FX are numerically calculated to obtain the firewall detection coefficient HX;

[0076] Among them, eu1, eu2, eu3, eu4, and eu5 are preset proportional coefficients with values ​​greater than zero, and the larger the value of the firewall performance detection coefficient HX, the worse the overall protection performance of the firewall; the firewall performance detection coefficient HX is numerically compared with the preset firewall performance detection coefficient threshold. If the firewall performance detection coefficient HX exceeds the preset firewall performance detection coefficient threshold, it indicates that the overall protection performance of the firewall is poor, and a protection performance warning signal is generated; if the firewall performance detection coefficient HX does not exceed the preset firewall performance detection coefficient threshold, it indicates that the overall protection performance of the firewall is good, and a protection performance qualified signal is generated.

[0077] Embodiment 2: Figure 2 As shown, the difference between this embodiment and the first embodiment is that the network security supervision terminal is communicated with the network security management decision module, and the network security management decision module is used to set the detection period, analyze the network security management status during the detection period, and obtain the test execution judgment symbol CP-1 or CP-2 and the threat defense judgment symbol LP-1 or LP-2;

[0078] If CP-2∩LP-2 is obtained, a management qualification signal is generated. In other cases (CP-1∩LP-1, CP-1∩LP-2 or CP-2∩LP-1), a management exception signal is generated, and the management qualification signal or the management exception signal is sent to the network security supervision end. When the network security supervision end receives the management exception signal, it will issue a corresponding warning. When the corresponding warning is issued, the management personnel will subsequently strengthen the test execution supervision and optimization supervision of the firewall to ensure the protection performance of the firewall and further improve network security.

[0079] Specifically, the network security management decision module communicates with the test execution tracing module and the threat defense detection module. The test execution tracing module analyzes the test execution status of the firewall during the detection period and assigns the test execution judgment symbol CP-1 or CP-2 through the analysis;

[0080] The test execution judgment symbol CP-1 or CP-2 is sent to the network security management decision module, which can not only accurately feedback the test execution management status of the firewall during the detection period, but also provide information support for the analysis process of the network security management decision module to ensure the accuracy of its analysis results; the specific analysis process of the test execution tracing module is as follows:

[0081] The interval between two adjacent test times for the firewall protection performance test during the detection period is obtained and marked as the test interval value, and the average of all the test interval values ​​during the detection period is calculated to obtain the test interval value; the test interval value is numerically compared with the preset test interval threshold, and the number of test interval values ​​exceeding the preset test interval threshold during the detection period is marked as the test interval difference value; and the test interval value with the largest value during the detection period is marked as the test interval amplitude value;

[0082] The test execution traceability value XP is obtained by numerically calculating the test condition value XL, the test difference value XW and the test amplitude value XF through the formula XP=ry2*XW+(ry1*XL+ry3*XF) / 2; wherein ry1, ry2 and ry3 are preset proportional coefficients, ry2>ry1>ry3>0; and the larger the value of the test execution traceability value XP is, the worse the test execution management status of the firewall during the detection period is;

[0083] The test execution traceability value XP is numerically compared with the preset test execution traceability threshold. If the test execution traceability value XP exceeds the preset test execution traceability threshold, indicating that the test execution management status of the firewall during the detection period is poor, then the test execution judgment symbol CP-1 is assigned; if the test execution traceability value XP does not exceed the preset test execution traceability threshold, indicating that the test execution management status of the firewall during the detection period is good, then the test execution judgment symbol CP-2 is assigned.

[0084] Furthermore, the threat defense detection module analyzes the defense status against network threats during the detection period, assigns threat defense judgment symbols LP-1 or LP-2 through analysis, and sends the threat defense judgment symbols LP-1 or LP-2 to the network security management decision module, which can not only accurately feedback the threat defense status of the firewall during the detection period to evaluate the optimization performance of the firewall, but also provide information support for the analysis process of the network security management decision module, further ensuring the accuracy of its analysis results; the specific analysis process of the threat defense detection module is as follows:

[0085] When the dynamic defense module dynamically adjusts the protection strategy of the firewall to deal with the existing network threats, if the corresponding network threats cannot be eliminated within the corresponding preset time, the corresponding network threats will be marked as eliminated threats;

[0086] All the threats to eliminate anomalies in the detection period are obtained and classified, the number of the corresponding type of threats to eliminate anomalies in the detection period is collected and marked as the threat number detection value, and each type of threat to eliminate anomalies is set in advance to correspond to a set of preset threat impact values, wherein the values ​​of the preset threat impact values ​​are all greater than zero, and the greater the adverse impact of the corresponding type of threat to network security, the greater the value of the preset threat impact value that matches it;

[0087] The product of the threat number detection value of the corresponding type of threat elimination anomaly and the corresponding preset threat impact value is marked as the threat judgment value; the threat judgment values ​​of all types of threat elimination anomalies existing in the detection period are summed up to obtain the threat defense anomaly detection value, and the threat defense anomaly detection value is numerically compared with the preset threat defense anomaly detection threshold;

[0088] If the threat defense detection value exceeds the preset threat defense detection threshold, it indicates that the threat defense status of the firewall during the detection period is poor, and the optimization performance of the firewall is not good, then the threat defense judgment symbol LP-1 is assigned; if the threat defense detection value does not exceed the preset threat defense detection threshold, it indicates that the threat defense status of the firewall during the detection period is good, and the optimization performance of the firewall is good, then the threat defense judgment symbol LP-2 is assigned.

[0089] The working principle of the present invention is as follows: when in use, the network traffic is deeply parsed and intelligently analyzed by the intelligent analysis module using deep learning and machine learning technologies. The dynamic defense module dynamically adjusts the protection strategy of the firewall according to the detection and analysis results of the intelligent analysis module, so as to achieve accurate identification and rapid response to network threats, significantly improve the network security protection effect, and perform a protection performance test on the firewall through the firewall test module to obtain various test results. The protection test evaluation module comprehensively evaluates the protection performance of the firewall based on the test results, and generates a qualified protection performance signal or a protection performance warning signal through analysis. When the protection performance warning signal is generated, a cause investigation and analysis is performed and corresponding optimization and improvement measures are made for the firewall, so as to ensure its subsequent protection performance for network security, reduce the management difficulty for network security protection, and have a high degree of intelligence.

[0090] The above formulas are all dimensionless and numerical calculations. The formula is a formula obtained by collecting a large amount of data and performing software simulation to obtain the most recent real situation. The preset parameters in the formula are set by technicians in this field according to actual conditions. The preferred embodiments of the present invention disclosed above are only used to help explain the present invention. The preferred embodiments do not describe all the details in detail, nor do they limit the invention to only specific implementation methods. Obviously, many modifications and changes can be made according to the contents of this specification. This specification selects and specifically describes these embodiments in order to better explain the principles and practical applications of the present invention, so that technicians in the relevant technical field can understand and use the present invention well. The present invention is only limited by the claims and their full scope and equivalents.

Claims

1. A network security protection system based on firewall technology, characterized by: It includes intelligent analysis module, dynamic defense module, firewall test module, protection test evaluation module and network security supervision terminal; The intelligent analysis module uses deep learning and machine learning technologies to perform in-depth analysis and intelligent analysis of network traffic, and sends the detection and analysis results to the dynamic defense module and network security supervision end; The dynamic defense module dynamically adjusts the firewall's protection strategy according to the detection and analysis results of the intelligent analysis module, records the defense execution monitoring information of the corresponding protection process, and sends the defense execution monitoring information to the network security supervision end; The firewall test module is used to test the protection performance of the firewall, obtain various test results through the protection performance test, and send all test results to the protection test evaluation module; The protection test evaluation module conducts a comprehensive evaluation of the firewall's protection performance based on the test results, generates a protection performance qualification signal or a protection performance warning signal through analysis, and sends the protection performance qualification signal or the protection performance warning signal to the network security supervision end. The network security supervision end issues a corresponding warning when it receives the protection performance warning signal.

2. The network security protection system based on firewall technology according to claim 1 is characterized in that: The protection performance test of the firewall test module includes throughput test, delay test, concurrent connection number test, packet loss rate test and defense security test. When conducting the throughput test, a traffic generator is used to simulate network traffic, and the throughput limit of the firewall is tested by continuously increasing the traffic, thereby obtaining the throughput detection value; When performing a delay test, a data packet of a specific size is sent to test the time interval from when the data packet enters the firewall to when it leaves the firewall, and the delay detection value is obtained accordingly; When testing the number of concurrent connections, use a stress test tool to send a large number of concurrent connection requests to the firewall to test its concurrent processing capability. Based on this, the maximum number of connections that can be established simultaneously between hosts that pass through the firewall or between a host and the firewall is obtained and marked as the concurrent connection detection value. When performing a packet loss rate test, the firewall is tested at a given rate and the packet loss situation is recorded. The packet loss rate of the firewall under different loads is averaged to obtain the packet loss detection value. When conducting defense security testing, various network attacks are simulated to observe whether the firewall can accurately identify and intercept these attacks, and the defense detection value is obtained through attack identification, interception, detection and analysis.

3. The network security protection system based on firewall technology according to claim 2 is characterized in that: The specific analysis process of attack identification, interception, detection and analysis is as follows: If the firewall fails to identify and intercept the corresponding network attack within the specified time, the corresponding network attack will be marked as an invalid defense object; a set of preset risk weight values ​​is set in advance for each network attack, and the preset risk weight values ​​of all invalid defense objects are summed up to obtain the invalid risk value; If the firewall completes the identification and interception of the corresponding network attack within the corresponding specified time, the ratio of the actual completion time to the corresponding specified time will be marked as the identification and interception time value, and the corresponding network attack will be marked as an effective defense object, and the identification and interception time values ​​of all effective defense objects will be averaged to obtain the defense effectiveness inspection value; the defense detection value will be obtained by numerically calculating the invalid hidden danger value and the defense effectiveness inspection value.

4. The network security protection system based on firewall technology according to claim 1 is characterized in that: The specific operation process of the protection test evaluation module includes: The throughput detection value, delay detection value, concurrent connection detection value, packet loss detection value and defense detection value sent by the firewall test module are obtained, and the throughput detection value, delay detection value, concurrent connection detection value, packet loss detection value and defense detection value are numerically compared with the corresponding preset thresholds respectively. If the throughput detection value or the concurrent connection detection value does not exceed the corresponding preset threshold and the delay detection value, packet loss detection value or defense detection value exceeds the corresponding preset threshold, a protection performance warning signal is generated.

5. The network security protection system based on firewall technology according to claim 4 is characterized in that: If the throughput detection value and the concurrent connection detection value both exceed the corresponding preset thresholds and the delay detection value, the packet loss detection value and the defense detection value do not exceed the corresponding preset thresholds, the firewall performance detection coefficient is obtained by numerically calculating the throughput detection value, the delay detection value, the concurrent connection detection value, the packet loss detection value and the defense detection value; Compare the firewall performance test coefficient with the preset firewall performance test coefficient threshold, and generate a protection performance warning signal if the firewall performance test coefficient exceeds the preset firewall performance test coefficient threshold; If the firewall performance test coefficient does not exceed the preset firewall performance test coefficient threshold, a protection performance qualified signal is generated.

6. The network security protection system based on firewall technology according to claim 1 is characterized in that: The network security supervision end is communicated with the network security management decision module. The network security management decision module is used to set the detection period, analyze the network security management status during the detection period, and obtain the test execution judgment symbol CP-1 or CP-2 and the threat defense judgment symbol LP-1 or LP-2. If CP-2∩LP-2 is obtained, a management qualification signal is generated. In other cases, a management exception signal is generated, and the management qualification signal or the management exception signal is sent to the network security supervision end. When the network security supervision end receives the management exception signal, it will issue a corresponding warning.

7. The network security protection system based on firewall technology according to claim 6 is characterized in that: The network security management decision module is connected to the test execution tracing module and the threat defense detection module in communication. The test execution tracing module analyzes the test execution status of the firewall during the detection period, assigns a test execution judgment symbol CP-1 or CP-2 through the analysis, and sends the test execution judgment symbol CP-1 or CP-2 to the network security management decision module; The threat defense detection module analyzes the defense status against network threats during the detection period, assigns a threat defense judgment symbol LP-1 or LP-2 through analysis, and sends the threat defense judgment symbol LP-1 or LP-2 to the network security management decision module.

8. The network security protection system based on firewall technology according to claim 7 is characterized in that: The specific analysis process of the test execution traceability module is as follows: The interval between two adjacent test times for the firewall protection performance test during the detection period is obtained and marked as the test interval value, and the average of all the test interval values ​​during the detection period is calculated to obtain the test interval value; the test interval value is numerically compared with the preset test interval threshold, and the number of test interval values ​​exceeding the preset test interval threshold during the detection period is marked as the test interval value; and marking the maximum test interval value in the detection period as the test interval value, and obtaining the test execution traceability value by numerically calculating the test interval value, the test difference value and the test interval value. If the test execution traceability value exceeds the preset test execution traceability threshold, the test execution judgment symbol CP-1 is assigned; If the test execution traceability value does not exceed the preset test execution traceability threshold, a test execution judgment symbol CP-2 is assigned.

9. The network security protection system based on firewall technology according to claim 7 is characterized in that: The specific analysis process of the threat defense detection module is as follows: When the dynamic defense module dynamically adjusts the protection strategy of the firewall to deal with the existing network threats, if the corresponding network threats cannot be eliminated within the corresponding preset time, the corresponding network threats will be marked as eliminated threats; All the elimination threats within the detection period are obtained and classified, the number of the corresponding type of elimination threats within the detection period is collected and marked as the threat number check value, each type of elimination threat is set in advance to correspond to a set of preset threat impact values, and the product of the threat number check value of the corresponding type of elimination threat and the corresponding preset threat impact value is marked as the threat judgment value; The threat defense detection value is calculated by summing up the threat judgment values ​​of all types of anomaly elimination threats existing during the detection period. If the threat defense detection value exceeds the preset threat defense detection threshold, the threat defense judgment symbol LP-1 is assigned; if the threat defense detection value does not exceed the preset threat defense detection threshold, the threat defense judgment symbol LP-2 is assigned.

Images