Security policy recommendation method and device, electronic equipment and storage medium

Abstract

The invention provides a security policy recommendation method and device, electronic equipment and a storage medium, and belongs to the technical field of operating system security, and the method comprises the following steps: obtaining context sensing information of SELinux; constructing a subject domain feature matrix and an object type feature matrix based on the context sensing information; the subject domain feature matrix comprises permission similarity between any two subjects, and the object type feature matrix comprises permission similarity between any two objects; clustering subjects with similar permissions according to the subject domain feature matrix to obtain a first recommendation rule; clustering objects with similar permissions according to the object type feature matrix to obtain a second recommendation rule; and intersecting the first recommendation rule with the second recommendation rule to obtain a recommended security policy. According to the method, the SELinux security policy can be effectively recommended based on the context-aware information, and the method is suitable for a new type without policy rules.

Description

Technical Field

[0001] The present invention relates to the field of operating system security technology, and in particular to a security policy recommendation method, device, electronic device and storage medium. Background Art

[0002] Security-Enhanced Linux (SELinux) is an effective kernel security enforcement module designed to enhance the security of Linux systems. It provides powerful and flexible resources and operational mechanisms. SELinux is implemented based on security labels, which define each user, application, process, and file in the system. It controls the interactions between entities through security policies to implement least privilege and prevent unauthorized access.

[0003] Currently, existing technologies have problems of over-authorization or under-authorization when recommending SELinux security policies. Existing security policy recommendation methods have low accuracy and are unable to recommend new types of security policies without policy rules, resulting in poor recommendation effectiveness. Summary of the Invention

[0004] The present invention provides a security policy recommendation method, device, electronic device and storage medium, which are used to solve the technical problems of low accuracy and poor effectiveness of SELinux security policy recommendation in the prior art.

[0005] The present invention provides a security policy recommendation method, comprising: Get SELinux context-aware information; Constructing a subject domain feature matrix and an object type feature matrix based on the context perception information; the subject domain feature matrix includes the authority similarity between any two subjects, and the object type feature matrix includes the authority similarity between any two objects; Clustering subjects with similar permissions according to the subject domain feature matrix to obtain a first recommendation rule; Clustering objects with similar permissions according to the object type feature matrix to obtain a second recommendation rule; The first recommended rule is intersected with the second recommended rule to obtain a recommended security policy.

[0006] According to a security policy recommendation method provided by the present invention, the context-aware information includes policy information, file location information, audit log information and attribute information; The constructing of a subject domain feature matrix and an object type feature matrix based on the context perception information includes: Extracting features from the context-aware information to obtain policy features, file location features, audit log features, and attribute features; Constructing the subject domain feature matrix and the object type feature matrix according to the strategy features; updating the subject domain feature matrix and the object type feature matrix according to other features; The other features include at least one of the file location feature, the audit log feature and the attribute feature.

[0007] According to a security policy recommendation method provided by the present invention, the subject domain feature matrix and the object type feature matrix are constructed according to the policy features, including: Determining, based on the policy characteristics, a first permission value of each subject domain to each object and a second permission value of each object to each subject domain; Determine the authority similarity between any two subjects based on each of the first authority values to obtain the subject domain feature matrix; The authority similarity between any two objects is determined according to each of the second authority values to obtain the object type feature matrix.

[0008] According to a security policy recommendation method provided by the present invention, the updating of the subject domain feature matrix and the object type feature matrix according to other features includes: If the other features corresponding to two subjects or two objects are the same, the authority similarity corresponding to the two subjects or two objects in the subject domain feature matrix and the object type feature matrix is increased.

[0009] According to a security policy recommendation method provided by the present invention, clustering objects with similar permissions according to the object type feature matrix to obtain a second recommendation rule includes: Perform the first clustering of each object according to the object category to obtain the clustering results; Perform a second clustering on the objects with similar permissions in the clustering results according to the object type feature matrix to obtain the second recommendation rule.

[0010] According to a security policy recommendation method provided by the present invention, after intersecting the first recommendation rule and the second recommendation rule to obtain a recommended security policy, the method further includes: Repair the security policy according to preset anomaly detection rules; The anomaly detection rule includes at least one of constraint conflict, policy inconsistency, and imperfect authority.

[0011] The present invention also provides a security policy recommendation device, comprising: Acquisition module, used to obtain SELinux context awareness information; A construction module, configured to construct a subject domain feature matrix and an object type feature matrix based on the context perception information; the subject domain feature matrix includes the authority similarity between any two subjects, and the object type feature matrix includes the authority similarity between any two objects; a clustering module, configured to cluster subjects with similar permissions according to the subject domain feature matrix to obtain a first recommendation rule; and clustering objects with similar permissions according to the object type feature matrix to obtain a second recommendation rule; The recommendation module is configured to intersect the first recommendation rule with the second recommendation rule to obtain a recommended security policy.

[0012] The present invention also provides an electronic device, comprising a memory, a processor, and a computer program stored in the memory and executable on the processor, wherein when the processor executes the program, any of the above-described security policy recommendation methods is implemented.

[0013] The present invention also provides a non-transitory computer-readable storage medium having a computer program stored thereon, which implements any of the security policy recommendation methods described above when executed by a processor.

[0014] The present invention also provides a computer program product, comprising a computer program, wherein when the computer program is executed by a processor, the computer program implements any of the above-mentioned security policy recommendation methods.

[0015] The security policy recommendation method, device, electronic device and storage medium provided by the present invention construct a subject domain feature matrix and an object type feature matrix based on context perception information. The subject domain feature matrix includes the permission similarity between any two subjects, and the object type feature matrix includes the permission similarity between any two objects. By clustering domains according to the subject domain feature matrix and clustering object types according to the object type feature matrix, two recommendation rules can be obtained. The recommended security policy is obtained by intersecting the two recommendation rules. The SELinux security policy can be effectively recommended and is applicable to new types that do not have policy rules. BRIEF DESCRIPTION OF THE DRAWINGS

[0016] In order to more clearly illustrate the technical solutions in the present invention or the prior art, a brief introduction is given below to the drawings required for use in the embodiments or the description of the prior art. Obviously, the drawings described below are some embodiments of the present invention. For ordinary technicians in this field, other drawings can be obtained based on these drawings without paying any creative work.

[0017] Figure 1 This is one of the flow charts of the security policy recommendation method provided by the present invention.

[0018] Figure 2 It is a schematic diagram of the principles of step S3 and step S4 provided by the present invention.

[0019] Figure 3 It is a schematic diagram of the principle of step S2 provided by the present invention.

[0020] Figure 4 It is a flow chart of step S4 provided by the present invention.

[0021] Figure 5 It is a structural diagram of the security policy recommendation device provided by the present invention.

[0022] Figure 6 It is a structural schematic diagram of the electronic device provided by the present invention. DETAILED DESCRIPTION

[0023] To make the objectives, technical solutions, and advantages of the present invention more clear, the technical solutions of the present invention will be clearly and completely described below in conjunction with the accompanying drawings. Obviously, the embodiments described are only some of the embodiments of the present invention, not all of them. Based on the embodiments of the present invention, all other embodiments obtained by ordinary technicians in this field without making creative efforts shall fall within the scope of protection of the present invention.

[0024] It should be noted that, in the description of the present invention, the terms "comprise," "include," or any other variations thereof are intended to encompass non-exclusive inclusion, such that a process, method, article, or apparatus comprising a list of elements includes not only those elements but also other elements not explicitly listed, or elements inherent to such process, method, article, or apparatus. Without further limitation, the phrase "comprises a..." does not preclude the presence of additional identical elements in the process, method, article, or apparatus comprising the elements. Terms such as "upper" and "lower" indicate positions or relationships based on those shown in the accompanying drawings and are intended solely to facilitate the description of the present invention and simplify the description. They are not intended to indicate or imply that the devices or elements referred to must have a specific orientation, be constructed, or operate in a specific orientation, and are therefore not to be construed as limitations on the present invention. Unless otherwise expressly specified or limited, the terms "mounted," "connected," and "connected" should be broadly construed, for example, to mean fixed, removable, or integral; mechanical or electrical; direct or indirect through an intermediary; or internal communication between two elements. For those skilled in the art, the specific meanings of the above terms in the present invention can be understood according to specific circumstances.

[0025] The terms "first," "second," and so forth, used herein are used to distinguish similar objects, not to describe a specific order or precedence. It should be understood that such terms are interchangeable where appropriate, allowing embodiments of the present invention to be implemented in an order other than that illustrated or described herein. Furthermore, the terms "first," "second," and so forth generally distinguish objects of a single type, and do not limit the number of objects. For example, the first object may be one or more. Furthermore, "and / or" indicates at least one of the connected objects, and the character " / " generally indicates an "or" relationship between the connected objects.

[0026] It's important to note that in SELinux (Security-Enhanced Linux), labels, subjects, objects, types, and classes are key components of the core security model. In SELinux, all processes (subjects) and files / resources (objects) are assigned a security label that defines their security context. A subject is the entity initiating an operation, typically a process (such as a running application or service). A domain is the type of process (subject), representing the process's operating environment or security context. Objects are resources accessed by a subject, such as files, directories, ports, and devices. Classes are specific types of types, such as files, directories, and TCP sockets.

[0027] The following combination Figures 1-6 The present invention describes a security policy recommendation method, device, electronic device, and storage medium.

[0028] like Figure 1 As shown, the security policy recommendation method of the present invention includes steps S1-S5.

[0029] Step S1: Obtain SELinux context awareness information.

[0030] Step S2: constructing a subject domain feature matrix and an object type feature matrix based on context perception information; the subject domain feature matrix includes the authority similarity between any two subjects, and the object type feature matrix includes the authority similarity between any two objects.

[0031] The permission similarity represents the degree of similarity between the permissions of two samples (subjects or objects). For example, if the permission similarity between two samples is 100%, then the two samples have the same permissions. It is understood that two subjects with high permission similarity should have similar permissions, and two objects with high permission similarity should have similar permissions.

[0032] Step S3: clustering subjects with similar permissions according to the subject domain feature matrix to obtain a first recommendation rule.

[0033] For example, clustering can be performed using a K-means clustering algorithm.

[0034] Specifically, the clustering result of step S3 is as follows Figure 2 As shown, s is the subject, o_t is the type, o_c is the category, and p is the permission. The three subjects in the same small circle are of the same type. Subjects of the same type can be considered to have the same permissions. For example, if a subject has permission to access an object, then subjects of the same category should also have permission to access the same object. Clustering of subject domains yields the first recommended rule: s-o_t-o_c-p, which represents the permission p of subject s for the o_t type and the o_c category.

[0035] Step S4: clustering objects with similar permissions according to the object type feature matrix to obtain a second recommendation rule.

[0036] Specifically, the clustering result of step S4 is as follows Figure 2 As shown, the three types in the same small circle are the same object type. Objects of the same type can be considered to have the same permissions. For example, if a certain type of file has access permissions for a certain subject, then objects of the same type should also have access permissions for the same subject. Clustering of object types yields the first recommended rule: s-o_t-o_c-p, representing the permission p of subject s for the o_c type of type o_t.

[0037] Step S5: Intersect the first recommended rule with the second recommended rule to obtain a recommended security policy.

[0038] Specifically, considering that samples of the same class (subject or object) only have multiple identical permissions, rather than the same permission set, there will be a situation where a sample does not have the permissions possessed by most samples of the same class. In this case, the sample should be authorized. In order to complete the authorization, it is necessary to recommend missing rules. For example, among multiple domains, only domain s1 does not have read permissions, and other domains have read permissions, then domain s1 is granted read permissions. Similarly, if the object type lacks relevant rules, these rules are recommended in the same way. Theoretically, all samples of the same class cannot have exactly the same permission set, because SELinux implements the principle of least authorization. If the permissions of two types are exactly the same, it will cause permission confusion and create potential security vulnerabilities. In order to eliminate false positives, after clustering the domains and object types separately, the first recommended rule is intersected with the second recommended rule to obtain the recommended security policy, such as Figure 2 Rules Recommendation List.

[0039] As can be seen from the above, the present invention constructs a subject domain feature matrix and an object type feature matrix based on context-aware information. The subject domain feature matrix includes the permission similarity between any two subjects, and the object type feature matrix includes the permission similarity between any two objects. By clustering the domains according to the subject domain feature matrix and clustering the object types according to the object type feature matrix, two recommendation rules can be obtained. The recommended security policy is obtained by intersecting the two recommendation rules, which can effectively recommend SELinux security policies and is suitable for new types that have no policy rules.

[0040] In some embodiments, the context-aware information of the present invention may include policy information, file location information, audit log information, and attribute information; Step S2 may include: Perform feature extraction on context-aware information to obtain policy features, file location features, audit log features, and attribute features; Construct subject domain feature matrix and object type feature matrix according to strategy features; Update the subject domain feature matrix and the object type feature matrix according to other features; Among them, the other features include at least one of a file location feature, an audit log feature, and an attribute feature.

[0041] Policy information defines all access requests in the system. It is represented as a five-tuple: allow or deny, subject, object, object category, and operation permission. By analyzing policy information, we can discover the relationships between policy access requests and, based on existing policy rules, analyze and optimize them.

[0042] Among them, the audit log records illegal operations, including the subject information, object information, operation permissions, object type, etc. of the illegal operations. The audit log can be used to audit and track illegal operations. The audit log is an important basis for policy customization and optimization, which can ensure the normal operation of software and applications and prevent anomalies caused by insufficient permissions.

[0043] Regarding file locations, SELinux defines file security labels based on the file path. A file path has only one label and cannot be defined repeatedly. If a label is defined repeatedly, a policy conflict error message will be displayed. If a file or directory under a path does not have a label defined, it inherits the label of the parent directory. Furthermore, when authorizing operations on a file, permissions for the directory containing the file must be granted. Only when the pre-requisite permissions are met will the operation succeed; if the pre-requisite permissions for the directory containing the file are missing, the operation will fail.

[0044] For attribute information, in the policy rule definition, the policy rule definition is based on the type, but the number of types is large and the definition is cumbersome. In order to simplify the policy definition, attribute information is introduced. Usually, the security labels belonging to the same attribute information have some similar permissions.

[0045] By updating the subject domain feature matrix and the object type feature matrix through other features, the permission similarity between subjects and objects can be made more accurate, which is conducive to improving the accuracy of security policy recommendations.

[0046] In some embodiments, constructing a subject domain feature matrix and an object type feature matrix based on the policy features may further include: Determine, based on the policy characteristics, a first permission value of each subject domain to each object and a second permission value of each object to each subject domain; Determine the authority similarity between any two subjects based on each first authority value, and obtain a subject domain feature matrix; The authority similarity between any two objects is determined according to each second authority value to obtain an object type feature matrix.

[0047] Specifically, such as Figure 3As shown in Figure 1, SELinux Policy is a policy feature, through which the permission relationship between each subject and each object can be obtained. If a subject S1 has access rights to an object o_t-o_c-p, the first permission value of subject S1 to the object o_t-o_c-p is 1; if subject S1 does not have access rights to an object o_t-o_c-p, the first permission value of subject S1 to the object o_t-o_c-p is 0. After determining the permission relationship between each subject and each object, the permission similarity (similarity) between the two subjects can be calculated based on all the first permission values corresponding to the two subjects. R For example, if all first permission values for two entities are identical, the permission similarity between the two entities is 100%. If two entities have 100 first permission values, and 80 of them are identical, the permission similarity between the two entities is 80%. After obtaining the permission similarity for each pair of entities, we can build a subject domain feature matrix. The rows of the subject domain feature matrix are S1, S2, S3, S4, etc., and the columns are S1, S2, S3, S4, etc.

[0048] Similarly, if a type o_t1 within a category o_c1 has access permission for a subject S, then the second permission value of category o_c1 minus type o_t1 for subject S is 1. If a type o_t1 within a category o_c1 does not have access permission for subject S, then the second permission value of category o_c1 minus type o_t1 for subject S is 0. After obtaining the permission similarity for each pair of categories, object types can be established. The rows of object types are O1, O2, O3, O4, ..., and the columns are O1, O2, O3, O4, ....

[0049] The policy features can be used to determine the authority values between various subjects and objects, and the authority similarity can be calculated based on the authority values.

[0050] In some embodiments, updating the subject domain feature matrix and the object type feature matrix according to other features may further include: If other features corresponding to two subjects or two objects are the same, the authority similarity corresponding to the two subjects or two objects in the subject domain feature matrix and the object type feature matrix is increased.

[0051] Specifically, such as Figure 3 As shown, if other features include file location features (File Location), for example, two objects o_t-o_c have the same directory (same directory), then their file location similarity sim F If it is 1, the similarity of the permissions of the two objects in the object type feature matrix can be increased; otherwise, FIf it is 0, the similarity of permissions corresponding to the two objects can be reduced.

[0052] If other features include audit log features (Audit Log), for example, two subjects s frequently access an object o_t-o_c-p at the same time (same time), then their log similarity sim L If it is 1, the authority similarity of the two subjects in the subject domain feature matrix can be increased; otherwise, L If it is 0, the similarity of the permissions corresponding to the two subjects can be reduced.

[0053] If other features include attribute features (Attribute), for example, two subjects s have the same attribute (sameattribute), then their attribute similarity sim A If it is 1, the authority similarity of the two subjects in the subject domain feature matrix can be increased; otherwise, A If it is 0, the similarity of the permissions corresponding to the two subjects can be reduced.

[0054] The permission similarity can be increased or decreased according to whether other features are the same, thereby improving the accuracy of the permission similarity.

[0055] Considering that object clustering is more complicated, specifically, if two objects have the same object type but are included in different object categories, they will have different permissions, which will result in a huge number of samples for object clustering. In order to reduce the computational complexity of object clustering, in some embodiments, such as Figure 4 As shown, step S4 may further include: Step S41, performing a first clustering of each object according to the object category to obtain a clustering result; Step S42 : performing a second clustering on objects with similar permissions in the clustering results according to the object type feature matrix to obtain a second recommendation rule.

[0056] like Figure 2 As shown, the six types o_t corresponding to each category o_c belong to the same class, and the clustering result includes these six types o_t belonging to the same class. After a second clustering of objects with the same permissions in the clustering result, three of the six types o_t belong to one class, and the remaining three belong to another class. The second recommended rule is derived based on the results of the second clustering.

[0057] The computational complexity of object clustering can be reduced by performing clustering twice, which is beneficial to improving the efficiency of security policy recommendation.

[0058] In the present invention, considering that there are a lot of security policy rule data, which may lead to anomalies in the policy, it is necessary to perform security policy rule anomaly detection. To this end, in some embodiments, after step S5, the security policy recommendation may also include: Repair security policies based on preset anomaly detection rules; The anomaly detection rule includes at least one of constraint conflict, policy inconsistency, and permission incompleteness.

[0059] Among them, constraint conflict means that the formulation of policy rules must meet the constraint rules for authorization to be successful. Otherwise, even if the permission is granted in the rule, authorization will still fail. Specifically, only types in the attribute group have the defined operation permissions. If they are not in the attribute group, the operation fails.

[0060] Among them, policy inconsistency means that in the policy definition process, in addition to considering the operation permissions of the object itself, the operation permissions of the parent directory of the object also need to be considered. Only when the pre-operation permissions of the directory are met can the authorization operation on the object be successful.

[0061] Incomplete permissions refer to the fact that the permissions defined in the policy rules have dependencies. For example, a file read operation requires not only read permissions but also obtain and open permissions. If the pre-dependent permissions are not met, the operation will fail.

[0062] Repairing security policies according to preset anomaly detection rules can further improve the accuracy of security policies.

[0063] like Figure 5 As shown, the security policy recommendation device provided by the present invention includes: Acquisition module, used to obtain SELinux context awareness information; A construction module is used to construct a subject domain feature matrix and an object type feature matrix based on context perception information; the subject domain feature matrix includes the authority similarity between any two subjects, and the object type feature matrix includes the authority similarity between any two objects; A clustering module is used to cluster subjects with similar permissions according to the subject domain feature matrix to obtain the first recommendation rule; and clustering objects with similar permissions according to the object type feature matrix to obtain the second recommendation rule; The recommendation module is used to intersect the first recommendation rule with the second recommendation rule to obtain a recommended security policy.

[0064] It should be noted that the security policy recommendation device provided by the present invention can execute the security policy recommendation method of any of the above embodiments during specific operation, which will not be described in detail in this embodiment.

[0065] Furthermore, the context-aware information may include policy information, file location information, audit log information, and attribute information; Building blocks can be used specifically for: Perform feature extraction on context-aware information to obtain policy features, file location features, audit log features, and attribute features; Construct subject domain feature matrix and object type feature matrix according to strategy features; Update the subject domain feature matrix and the object type feature matrix according to other features; Among them, the other features include at least one of a file location feature, an audit log feature, and an attribute feature.

[0066] Furthermore, building blocks can be used to: Determine, based on the policy characteristics, a first permission value of each subject domain to each object and a second permission value of each object to each subject domain; Determine the authority similarity between any two subjects based on each first authority value, and obtain a subject domain feature matrix; The authority similarity between any two objects is determined according to each second authority value to obtain an object type feature matrix.

[0067] Furthermore, building blocks can be used to: If other features corresponding to two subjects or two objects are the same, the authority similarity corresponding to the two subjects or two objects in the subject domain feature matrix and the object type feature matrix is increased.

[0068] Furthermore, the clustering module can be used to: Perform the first clustering of each object according to the object category to obtain the clustering results; The objects with similar permissions in the clustering results are clustered for the second time according to the object type feature matrix to obtain the second recommendation rule.

[0069] Furthermore, the security policy recommendation device may also include: Repair module, used to repair security policies according to preset anomaly detection rules; The anomaly detection rule includes at least one of constraint conflict, policy inconsistency, and permission incompleteness.

[0070] Figure 6This is a structural diagram of an electronic device provided by the present invention. As shown in FIG#, the electronic device may include: a processor, a communication interface, a memory, and a communication bus, wherein the processor, the communication interface, and the memory communicate with each other via the communication bus. The processor may call logic instructions in the memory to execute a security policy recommendation method, which includes: obtaining context-aware information of SELinux; constructing a subject domain feature matrix and an object type feature matrix based on the context-aware information; the subject domain feature matrix includes the permission similarity between any two subjects, and the object type feature matrix includes the permission similarity between any two objects; clustering subjects with the same permission according to the subject domain feature matrix to obtain a first recommendation rule; clustering objects with the same permission according to the object type feature matrix to obtain a second recommendation rule; and intersecting the first recommendation rule with the second recommendation rule to obtain a recommended security policy.

[0071] Furthermore, the logical instructions in the aforementioned memory can be implemented as software functional units and, when sold or used as independent products, can be stored in a computer-readable storage medium. Based on this understanding, the technical solution of the present invention, or the portion that contributes to the prior art, or a portion of the technical solution, can be embodied in the form of a software product. This computer software product is stored in a storage medium and includes several instructions for enabling a computer device (which can be a personal computer, server, or network device, etc.) to execute all or part of the steps of the methods described in various embodiments of the present invention. The aforementioned storage media include various media capable of storing program code, such as USB flash drives, mobile hard drives, read-only memories (ROMs), random access memories (RAMs), magnetic disks, or optical disks.

[0072] On the other hand, the present invention also provides a computer program product, which includes a computer program stored on a non-transitory computer-readable storage medium, and the computer program includes program instructions. When the program instructions are executed by a computer, the computer can execute the security policy recommendation method provided by the above-mentioned embodiments, the method including: obtaining context-aware information of SELinux; constructing a subject domain feature matrix and an object type feature matrix based on the context-aware information; the subject domain feature matrix includes the permission similarity between any two subjects, and the object type feature matrix includes the permission similarity between any two objects; clustering subjects with the same permissions according to the subject domain feature matrix to obtain a first recommendation rule; clustering objects with the same permissions according to the object type feature matrix to obtain a second recommendation rule; intersecting the first recommendation rule with the second recommendation rule to obtain a recommended security policy.

[0073] On the other hand, the present invention also provides a non-transitory computer-readable storage medium having a computer program stored thereon, which, when executed by a processor, is implemented to execute the security policy recommendation method provided in the above-mentioned embodiments, the method comprising: obtaining context-aware information of SELinux; constructing a subject domain feature matrix and an object type feature matrix based on the context-aware information; the subject domain feature matrix includes the permission similarity between any two subjects, and the object type feature matrix includes the permission similarity between any two objects; clustering subjects with the same permissions according to the subject domain feature matrix to obtain a first recommendation rule; clustering objects with the same permissions according to the object type feature matrix to obtain a second recommendation rule; and intersecting the first recommendation rule with the second recommendation rule to obtain a recommended security policy.

[0074] The device embodiments described above are merely illustrative. The units described as separate components may or may not be physically separate, and the components shown as units may or may not be physical units, i.e., they may be located in one location or distributed across multiple network units. Some or all of the modules may be selected based on actual needs to achieve the objectives of the present embodiment. Persons of ordinary skill in the art will be able to understand and implement the present invention without inventive effort.

[0075] Through the above description of the embodiments, those skilled in the art will clearly understand that each embodiment can be implemented using software plus a necessary general-purpose hardware platform, or of course, hardware. Based on this understanding, the essence of the above technical solution, or the portion that contributes to the prior art, can be embodied in the form of a software product. This computer software product can be stored in a computer-readable storage medium, such as ROM / RAM, a magnetic disk, or an optical disk, and includes a number of instructions for causing a computer device (such as a personal computer, server, or network device) to execute the methods described in each embodiment or certain portions of the embodiments.

[0076] Finally, it should be noted that the above embodiments are only used to illustrate the technical solutions of the present invention, rather than to limit it. Although the present invention has been described in detail with reference to the aforementioned embodiments, those skilled in the art should understand that they can still modify the technical solutions described in the aforementioned embodiments, or make equivalent replacements for some of the technical features therein. However, these modifications or replacements do not deviate the essence of the corresponding technical solutions from the spirit and scope of the technical solutions of the various embodiments of the present invention.

Claims

1. A security policy recommendation method, characterized in that: include: Get SELinux context-aware information; constructing a subject domain feature matrix and an object type feature matrix based on the context perception information; The subject domain feature matrix includes the authority similarity between any two subjects, and the object type feature matrix includes the authority similarity between any two objects; Clustering subjects with similar permissions according to the subject domain feature matrix to obtain a first recommendation rule; Clustering objects with similar permissions according to the object type feature matrix to obtain a second recommendation rule; The first recommended rule is intersected with the second recommended rule to obtain a recommended security policy.

2. The security policy recommendation method according to claim 1, characterized in that: The context-aware information includes policy information, file location information, audit log information, and attribute information; The constructing of a subject domain feature matrix and an object type feature matrix based on the context perception information includes: Extracting features from the context-aware information to obtain policy features, file location features, audit log features, and attribute features; Constructing the subject domain feature matrix and the object type feature matrix according to the strategy features; updating the subject domain feature matrix and the object type feature matrix according to other features; The other features include at least one of the file location feature, the audit log feature and the attribute feature.

3. The security policy recommendation method according to claim 2, characterized in that: The constructing of the subject domain feature matrix and the object type feature matrix according to the strategy feature includes: Determining, based on the policy characteristics, a first permission value of each subject domain to each object and a second permission value of each object to each subject domain; Determine the authority similarity between any two subjects based on each of the first authority values to obtain the subject domain feature matrix; The authority similarity between any two objects is determined according to each of the second authority values to obtain the object type feature matrix.

4. The security policy recommendation method according to claim 2, characterized in that: The updating of the subject domain feature matrix and the object type feature matrix according to other features includes: If the other features corresponding to two subjects or two objects are the same, the authority similarity corresponding to the two subjects or two objects in the subject domain feature matrix and the object type feature matrix is increased.

5. The security policy recommendation method according to claim 1, characterized in that: Clustering objects with similar permissions according to the object type feature matrix to obtain a second recommendation rule includes: Perform the first clustering of each object according to the object category to obtain the clustering results; The objects with similar permissions in the clustering results are clustered for the second time according to the object type feature matrix to obtain the second recommendation rule.

6. The security policy recommendation method according to claim 1, characterized in that: After intersecting the first recommended rule with the second recommended rule to obtain a recommended security policy, the method further includes: Repair the security policy according to preset anomaly detection rules; The anomaly detection rule includes at least one of constraint conflict, policy inconsistency, and imperfect authority.

7. A security policy recommendation device, characterized in that: include: Acquisition module, used to obtain SELinux context awareness information; A construction module, configured to construct a subject domain feature matrix and an object type feature matrix based on the context perception information; The subject domain feature matrix includes the authority similarity between any two subjects, and the object type feature matrix includes the authority similarity between any two objects; a clustering module, configured to cluster subjects with similar permissions according to the subject domain feature matrix to obtain a first recommendation rule; and clustering objects with similar permissions according to the object type feature matrix to obtain a second recommendation rule; The recommendation module is configured to intersect the first recommendation rule with the second recommendation rule to obtain a recommended security policy.

8. An electronic device comprising a memory, a processor, and a computer program stored in the memory and executable on the processor, wherein: When the processor executes the computer program, the security policy recommendation method according to any one of claims 1 to 6 is implemented.

9. A non-transitory computer-readable storage medium having a computer program stored thereon, characterized in that: When the computer program is executed by a processor, the security policy recommendation method according to any one of claims 1 to 6 is implemented.

10. A computer program product comprising a computer program, characterized in that When the computer program is executed by a processor, the security policy recommendation method according to any one of claims 1 to 6 is implemented.

Images