Enterprise digital information security monitoring system based on intelligent firewall

Abstract

The invention discloses an enterprise digital information security monitoring system based on an intelligent firewall, and relates to the technical field of network security, the enterprise digital information security monitoring system comprises a visual monitoring platform, the visual monitoring platform is in communication connection with a data acquisition module, an abnormal behavior identification module, a behavior classification management and control module, an intelligent firewall module and a reinforcement learning module, the modules are in electric signal connection; the data acquisition module is used for collecting and preprocessing monitoring data from each key node of an enterprise internal network. By combining a behavior analysis technology, utilizing an intelligent firewall to identify real security threats and cooperating with reinforcement learning to effectively distinguish normal behaviors from abnormal behaviors, compared with a traditional static configuration security monitoring system, the method can dynamically adjust protection rules, perform real-time updating according to new threat intelligence or attack modes, and improve the security monitoring efficiency. And the false alarm and missing alarm conditions are obviously reduced, the security protection accuracy is improved, and a more reliable security guarantee is provided for an enterprise network.

Description

Technical Field

[0001] The present invention relates to the technical field of network security, and in particular to an enterprise digital information security monitoring system based on an intelligent firewall. Background Art

[0002] With the continuous development of information technology, more and more enterprises have begun to rely on digital systems for business operations. The storage, processing, transmission, and sharing of information have become the core of daily business operations. However, as business development has led to an explosive growth in data volume, data storage and management has become increasingly difficult. Enterprises need to ensure the security, integrity, and availability of data during storage, transmission, and use.

[0003] For example, Chinese patent publication number: CN114706735A is an enterprise-based digital information security monitoring system, which includes an enterprise digital information security monitoring system constructed based on a hardware platform within the enterprise and corresponding network equipment. The enterprise digital information security monitoring system realizes real-time unified monitoring and integrated management among different network devices through data management.

[0004] In the existing technology, a digital information security monitoring system can be used to complete unified management planning for enterprise users, solving the problem of not being able to carry out unified management planning based on the enterprise's own situation and the general problem of early warning accuracy and effect. However, since the security monitoring system is often statically configured, the system's protection rules are difficult to dynamically adjust according to new threat intelligence or attack patterns, resulting in loopholes in security protection and false alarms and missed alarms. Therefore, how to identify real security threats through behavioral analysis combined with intelligent firewalls, and cooperate with reinforcement learning to effectively distinguish normal behavior from abnormal behavior and improve accuracy is the problem to be solved by the present invention. To this end, an enterprise digital information security monitoring system based on intelligent firewalls is proposed. Summary of the Invention

[0005] The purpose of the present invention is to provide an enterprise digital information security monitoring system based on an intelligent firewall to solve the problems raised in the above background technology.

[0006] In order to solve the above technical problems, the technical solution adopted by the present invention is:

[0007] An enterprise digital information security monitoring system based on an intelligent firewall includes a visual monitoring platform, wherein the visual monitoring platform is communicatively connected to a data acquisition module, an abnormal behavior recognition module, a behavior classification control module, an intelligent firewall module, and an enhanced learning module, wherein electrical signal connections are made between the modules;

[0008] The visual monitoring platform is used to display the analysis results of the security monitoring system to security managers in an intuitive and visual manner. When a security threat is detected, it promptly issues an alarm message to notify the security managers to handle it, helping them quickly understand the security status of the enterprise network and promptly discover and handle security incidents.

[0009] The data acquisition module is used to collect and pre-process monitoring data from various key nodes in the enterprise's internal network, including network traffic data, system log data, and terminal device status data, and extract and analyze behavioral features of the monitoring data's behavior patterns from the monitoring data and integrate them into a behavioral feature sequence list;

[0010] The abnormal behavior recognition module is used to combine the behavior feature sequence table and the pre-trained abnormal behavior recognition model to analyze each behavior feature of the monitoring data with its corresponding normal behavior feature baseline to determine whether there is an abnormality, so as to distinguish normal behavior from aggressive behavior;

[0011] The behavior classification control module is used to combine the identification results of abnormal behavior, comprehensively calculate the behavior trend coefficient, analyze the degree to which the behavior characteristics in the enterprise network deviate from the normal behavior characteristic baseline, and classify the abnormal behavior into risk categories;

[0012] The intelligent firewall module is used to adjust the security policy rules of the intelligent firewall according to the results of the abnormal behavior identification model and the behavior classification control module;

[0013] The enhanced learning module is used to connect to external threat intelligence sources and interact with the enterprise network environment. Based on the interception results of the intelligent firewall module and the feedback information of the system, it adjusts the policy parameters of the intelligent firewall module and optimizes the security policy rules, so that the protection effect of the firewall is continuously improved, thereby improving the response capability to unknown attacks.

[0014] A further improvement of the technical solution of the present invention is that the data acquisition module specifically includes:

[0015] Based on the enterprise's internal network architecture and monitoring needs, the scope of key nodes is clearly defined, including core switches, server clusters, and important terminal devices. Sensors, agents, or interfaces for accessing network devices deployed at key nodes of the enterprise network are used to collect multi-dimensional monitoring data in real time, including network traffic data, system log data, and terminal device status data.

[0016] Preprocess the collected monitoring data, including data cleaning and normalization operations;

[0017] The pre-processed monitoring data is integrated, and feature analysis is performed on the network traffic data, system log data and terminal device status data. Behavioral features used to analyze the behavioral patterns of the monitoring data are extracted, namely traffic behavior features, system behavior features and device behavior features. For network traffic data, traffic behavior features including packet transmission rate, average packet size and traffic burst peak are extracted. For system log data, system behavior features including the number of user logins per unit time, error log frequency and system operation command frequency are extracted. For terminal device status data, device behavior features including device CPU usage peak, memory usage change rate and device online time ratio are extracted. All behavioral features are arranged in chronological order to form a comprehensive behavioral feature sequence list.

[0018] A further improvement of the technical solution of the present invention is that the abnormal behavior recognition module specifically includes:

[0019] Load a pre-trained abnormal behavior recognition model, and set a normal behavior feature baseline for each behavior feature based on historical normal monitoring data. Then, import the behavior feature sequence list into the abnormal behavior recognition model. A large amount of historical monitoring data with labeled normal and abnormal behavior features is obtained from the enterprise database and integrated into a comprehensive data set. Based on the normal historical monitoring data accumulated by the enterprise, a corresponding normal behavior feature baseline is determined for each behavior feature. The data set is divided into a training set and a test set. A deep learning algorithm based on a generative adversarial network model is used as the model infrastructure to build an abnormal behavior recognition model. The training set is used to train the generative adversarial network, the extracted behavior features are used as model input, and whether the behavior feature is abnormal is used as the model output. The model is evaluated using the test set, and the abnormal behavior recognition model is finally obtained.

[0020] Each behavioral feature in the behavioral feature sequence list is analyzed, and each is compared with the corresponding normal behavioral feature baseline. The deviation value of each behavioral feature is calculated, and the abnormality judgment threshold of each deviation value is set to determine whether there is an abnormality.

[0021] After completing the comparative analysis of all behavioral features with the baseline of normal behavioral features, the abnormal behavior recognition model screens and organizes the behavioral features with deviations and outputs them to distinguish normal behavior from attack behavior.

[0022] A further improvement of the technical solution of the present invention is that: the behavior classification control module includes a behavior analysis unit and a behavior classification unit;

[0023] The behavior trend analysis unit is used to combine the behavior characteristics in the enterprise network with the identification results of abnormal behavior, calculate the behavior trend coefficient, and analyze the trend of abnormal behavior;

[0024] The behavior classification unit is used to combine the analysis results of abnormal behaviors and classify abnormal behaviors into different risk categories according to the behavior tendency coefficient.

[0025] A further improvement of the technical solution of the present invention is that the behavior trend analysis unit specifically includes:

[0026] Extract behavioral feature data covering network traffic, system operations, and terminal device status from the enterprise network, and simultaneously obtain the abnormal behavior identification results output by the abnormal behavior identification module. Match and integrate the two types of data based on the timestamp and device identification fields. Using a pre-set normal behavior feature baseline as the standard, determine the deviation between the actual value of each behavioral feature and the baseline value, thereby forming an analytical data set containing behavioral feature data, abnormal behavior identification results, and deviation values.

[0027] Based on the analysis data set, the traffic behavior characteristics, system behavior characteristics, and device behavior characteristics are combined with the deviation values of each behavior characteristic to calculate the traffic behavior trend index, system behavior trend index, and device behavior trend index respectively, and analyze the trend of each abnormal behavior;

[0028] Based on the calculated traffic behavior trend index, system behavior trend index, and device behavior trend index, a comprehensive analysis of abnormal behavior trends is conducted. According to the changes in each abnormal behavior, corresponding weights are assigned, and the weighted sum is calculated to obtain a comprehensive behavior trend coefficient. It is judged whether the abnormal behavior in the enterprise network is on an upward trend, downward trend, or remains stable.

[0029] A further improvement of the technical solution of the present invention is that the calculation process of the flow behavior trend index is:

[0030] For each traffic behavior feature in the analysis data set, the actual value is subtracted from the normal behavior feature baseline value of the corresponding traffic behavior feature to obtain the deviation value of the traffic behavior feature;

[0031] The absolute values of the deviation values of all traffic behavior characteristics are added together to calculate the sum of the absolute values of the traffic behavior characteristic deviation values, and the sum of the absolute values of the traffic behavior characteristic deviation values is divided by the product of the number of traffic behavior characteristics and the normal behavior characteristic baseline value of the traffic behavior characteristics to obtain the average relative deviation of the deviation values;

[0032] Calculate the logarithm of the average relative deviation of the deviation value plus 1 with base 2, and then multiply the average relative deviation of the deviation value by the obtained logarithm to obtain the traffic behavior trend index;

[0033] The calculation process of the system behavior trend index is:

[0034] For each system behavior feature in the analysis data set, the actual value is subtracted from the normal behavior feature baseline value of the corresponding system behavior feature to obtain the deviation value of the system behavior feature, and the square of the deviation value of the system behavior feature is calculated;

[0035] Adding the squares of the deviation values of all system behavior characteristics, and dividing the sum of the squares of the deviation values of all system behavior characteristics by the product of the number of system behavior characteristics and the squares of the normal behavior characteristic baseline values of the system behavior characteristics, to obtain an average relative deviation of the squares of the deviation values of the system behavior characteristics;

[0036] The cube root of the average relative deviation of the square of the deviation value of the system behavior characteristics is taken to obtain the system behavior trend index;

[0037] The calculation process of the device behavior trend index is as follows:

[0038] For each device behavior feature in the analysis data set, the actual value is subtracted from the normal behavior feature baseline value of the corresponding device behavior feature to obtain the deviation value of the device behavior feature;

[0039] Adding the absolute values of the deviation values of all device behavior features, and dividing the sum of the absolute values of the deviation values of all device behavior features by the product of the number of device behavior features and the normal behavior feature baseline value of the device behavior features, to obtain an average relative deviation of the deviation values of the device behavior features;

[0040] The exponential function value of the average relative deviation of the deviation values of the device behavior characteristics is calculated with the natural constant e as the base, and then the average relative deviation of the deviation values of the device behavior characteristics is multiplied by the obtained exponential function value to obtain the device behavior trend index.

[0041] A further improvement of the technical solution of the present invention is that the behavior classification unit specifically includes:

[0042] Based on the enterprise's security risk tolerance, network security needs, and historical security incident records, develop risk classification standards for abnormal behaviors, define different risk categories as low risk, medium risk, and high risk, and set corresponding classification thresholds for each risk category based on the behavioral trend coefficient;

[0043] Import the abnormal behaviors and their corresponding behavioral trend coefficients obtained through analysis into the behavioral classification unit. Classify the abnormal behaviors according to the pre-set risk classification standards, and compare the behavioral trend coefficients of the abnormal behaviors with the threshold ranges of each risk category to ensure accurate classification.

[0044] For abnormal behaviors after classification, record the information of abnormal behaviors and clarify the risk category to which they belong. The recorded information of abnormal behaviors includes the specific description of abnormal behaviors, behavior trend coefficients and corresponding classification results. Establish an audit mechanism to conduct random audits on classification results. According to the company's security strategy and actual situation, judge whether the classification is reasonable. If classification errors are found, feedback and adjustments will be made to continuously optimize the risk classification standards and classification processes to improve the quality and practicality of behavior classification.

[0045] A further improvement of the technical solution of the present invention is that the expression of the behavior tendency coefficient is:

[0046] C index =w1·T flow +w2·T sys +w3·T dev ;

[0047] Where C index is the behavioral tendency coefficient, T flow is the traffic behavior trend index, w1 is the weight of the traffic behavior trend index, T sys is the system behavior trend index, w2 is the weight of the system behavior trend index, T dev is the device behavior trend index, w3 is the weight of the device behavior trend index;

[0048] The risk categories are set in one-to-one correspondence with the classification thresholds. The specific correspondence is as follows:

[0049] The threshold for the low-risk category is: 0≤C index <C L ;

[0050] The threshold for dividing the medium risk category is: C L ≤C index <C H ;

[0051] The threshold for the high-risk category is: C index ≥C H ;

[0052] Among them, C index is the behavioral tendency coefficient, C L is the upper threshold of the low-risk category and the lower threshold of the medium-risk category, C H is the upper threshold for the medium risk category and the lower threshold for the high risk category.

[0053] A further improvement of the technical solution of the present invention is that the intelligent firewall module specifically includes:

[0054] The intelligent firewall module receives the output of the abnormal behavior identification model and the behavior classification and control module, and dynamically adjusts the existing security policy rules. For behaviors identified as abnormal and belonging to the high-risk category, it generates corresponding blocking rules. At the same time, for abnormal behaviors in the low-risk or medium-risk categories, it adopts traffic rate restriction or adds additional monitoring measures instead of direct blocking.

[0055] When network traffic passes through the firewall, it performs real-time inspections based on the adjusted security policy rules. If it finds that the traffic matches the identified abnormal behavior characteristics or violates the new security policy rules, it immediately takes interception measures to prevent the suspicious traffic from entering the enterprise's internal network. For normal traffic, the firewall allows it to pass smoothly, ensuring that the normal business of the enterprise is not affected.

[0056] The intelligent firewall module continuously monitors new threat intelligence and attack patterns, obtaining the latest attack signature information from external threat intelligence sources. Once a new threat is discovered, the firewall automatically updates security policy rules to respond to evolving network attack methods. After updating security policy rules, it reanalyzes traffic that has passed initial filtering to detect potential attack behaviors hidden in normal traffic, further enhancing the ability to defend against network attacks.

[0057] After completing the interception of attack traffic, the intelligent firewall will re-check the remaining network traffic to ensure that it is normal business traffic. For network traffic that complies with normal business rules and security policy rules, the firewall will allow it to pass smoothly to ensure the normal communication and business operation of the enterprise network. At the same time, it will record attack events and interception situations in real time to provide detailed log information for security management personnel.

[0058] A further improvement of the technical solution of the present invention is that the reinforcement learning module specifically includes:

[0059] The enhanced learning module connects to external threat intelligence sources and establishes a stable connection to obtain the latest network threat information in real time, including new attack methods, malware characteristics, vulnerability exploitation methods, etc. At the same time, it collects the interception results of the intelligent firewall module in the enterprise network environment and the feedback information of the system as the basis for the enhanced learning module to adjust its strategy;

[0060] Based on the collected threat intelligence and feedback information, the reinforcement learning module uses a reinforcement learning algorithm to adjust the security policy rules of the intelligent firewall module. The interception success rate under the current security policy rules is used as a reward signal. When the interception is successful, a positive reward is given, and when the interception fails, a negative penalty is given. The total reward value is calculated, and through trial and error learning, the optimal security policy rule parameters are analyzed to determine the updated security policy rule parameters, thereby improving the ability to identify and intercept known and unknown attacks.

[0061] After the policy parameters of the security policy rules are adjusted, the reinforcement learning module applies the new security policy rules to the intelligent firewall module and continuously monitors its protection effect. It regularly evaluates the actual effect of the adjusted security policy rules, compares the interception success rate indicators before and after the adjustment, and further optimizes the policy rules based on the evaluation results to form a closed loop of continuous improvement.

[0062] Due to the adoption of the above technical solution, the present invention has the following technical advancements compared to the prior art:

[0063] 1. The present invention provides an enterprise digital information security monitoring system based on an intelligent firewall. By combining behavioral analysis technology, the intelligent firewall is used to identify real security threats, and reinforcement learning is used to effectively distinguish normal behavior from abnormal behavior. Compared with traditional statically configured security monitoring systems, the system can dynamically adjust protection rules and perform real-time updates based on new threat intelligence or attack patterns, significantly reducing false positives and missed positives, improving the accuracy of security protection, and providing more reliable security protection for enterprise networks.

[0064] 2. The present invention provides an enterprise digital information security monitoring system based on an intelligent firewall. Through the built-in behavior classification and control module, it can combine the identification results of abnormal behavior, comprehensively calculate the behavior trend coefficient, analyze the degree to which the behavior characteristics in the enterprise network deviate from the normal behavior characteristic baseline, and classify the abnormal behavior into risk categories, so that the enterprise can clearly understand the current security risks it faces, take targeted control measures, effectively reduce potential security threats, and enhance the enterprise's risk management capabilities.

[0065] 3. The present invention provides an enterprise digital information security monitoring system based on an intelligent firewall. The intelligent firewall module can adjust security policy rules in real time according to the results of the abnormal behavior recognition model and the behavior classification control module, filter and intercept monitoring data. At the same time, the system continuously pays attention to new threat intelligence and attack patterns, and automatically updates firewall policies to ensure that the enterprise network can resist various network attacks in real time, which can significantly reduce security vulnerabilities and reduce the risk of security threats to the enterprise. BRIEF DESCRIPTION OF THE DRAWINGS

[0066] In order to more clearly illustrate the embodiments of the present application or the technical solutions in the prior art, the following briefly introduces the drawings required for use in the embodiments. Obviously, the drawings described below are only some embodiments described in the present invention. For ordinary technicians in this field, other drawings can also be obtained based on these drawings.

[0067] Figure 1 Schematic diagram of the system function modules of the present invention;

[0068] Figure 2 Schematic diagram of the workflow of the behavior analysis unit of the present invention. DETAILED DESCRIPTION

[0069] To make the objectives, technical solutions, and advantages of the embodiments of the present invention more clear, the technical solutions in the embodiments of the present invention will be clearly and completely described below in conjunction with the accompanying drawings of the embodiments of the present invention. Obviously, the described embodiments are only part of the embodiments of the present invention, not all of the embodiments. All other embodiments obtained by ordinary technicians in this field based on the embodiments of the present invention without making any creative efforts shall fall within the scope of protection of the present invention.

[0070] Example 1, as Figure 1 、 Figure 2 As shown, the present invention provides an enterprise digital information security monitoring system based on an intelligent firewall, including a visual monitoring platform, which is communicatively connected to a data acquisition module, an abnormal behavior recognition module, a behavior classification and control module, an intelligent firewall module, and an enhanced learning module, wherein the modules are electrically connected;

[0071] The visual monitoring platform is used to display the analysis results of the security monitoring system to security managers in an intuitive and visual manner. When a security threat is detected, it promptly issues an alarm message to notify security managers to handle it. This helps security managers quickly understand the security status of the enterprise network and promptly discover and handle security incidents.

[0072] The data acquisition module is used to collect and pre-process monitoring data from various key nodes in the enterprise's internal network, including network traffic data, system log data and terminal device status data, and extract and analyze the behavioral characteristics of the monitoring data's behavior patterns from the monitoring data, and integrate them into a behavioral feature sequence table. According to the enterprise's internal network architecture and monitoring needs, the scope of key nodes is clarified, including core switches, server clusters and important terminal devices, etc., and through sensors, agents or interfaces for accessing network devices deployed at various key nodes in the enterprise network, multi-dimensional monitoring data including network traffic data, system log data and terminal device status data are collected in real time. Among them, network sniffing technology is used to capture network traffic data, including the source / destination IP, end point, etc. of the data packet. The system collects system log data including user login, system operation, software installation and uninstallation, system error and abnormality from the operating system log components of the server and terminal equipment, and obtains terminal equipment status data, including equipment startup / shutdown time, hardware resource usage, software running status, etc. The collected monitoring data is pre-processed, including data cleaning and normalization operations. For network traffic data, invalid, obviously erroneous or non-standard format data packets are removed, and data with abnormal packet length and protocol field that does not conform to the specification are discarded. For system log data, duplicate log records are deleted, and information missing problems caused by incorrect record formats are corrected. For terminal equipment status data, In addition to the unreasonable data generated by equipment failure or collection errors, all types of data are normalized, and data in different formats are converted into a unified standard format. The pre-processed monitoring data are integrated, and feature analysis is performed on network traffic data, system log data and terminal device status data. Behavioral features used to analyze the behavior patterns of monitoring data are extracted, which are traffic behavior features, system behavior features and device behavior features. For network traffic data, traffic behavior features including packet transmission rate, average packet size and traffic burst peak are extracted. For system log data, system behavior features including the number of user logins per unit time, error log frequency and system operation command frequency are extracted. For terminal device status data, features including device C are extracted. The device behavior characteristics of PU usage peak, memory usage change rate and device online time ratio are arranged in chronological order to form a comprehensive behavior feature sequence table. Among them, the packet transmission rate reflects the speed of data transmission in the network and reflects the network's ability to process data within a certain period of time. The average packet size reflects the type and characteristics of data transmitted in the network. Different types of network applications will generate packets of different sizes. By analyzing the changes in the average packet size, the applications running in the network can be identified. The traffic burst peak indicates the maximum value of network traffic in a short period of time, reflecting the network's carrying capacity under extreme conditions. The number of user logins per unit time reflects the user activity and access frequency of the system.By counting the number of user logins per unit time, we can understand how users use the system. The error log frequency reflects the frequency of errors during system operation. The system operation command frequency reflects the user's operation activity and operation mode. Different operation commands correspond to different system functions. By counting the operation command frequency, we can understand how users use system functions. The peak CPU usage rate of the terminal device reflects the maximum CPU load during operation. The memory usage change rate reflects the memory usage and change trend of the terminal device. The proportion of device online time reflects the availability and stability of the terminal device in the network. By counting the proportion of device online time, we can understand the device's operating status and network connection status.

[0073] The abnormal behavior recognition module is used to combine the behavior feature sequence table and the pre-trained abnormal behavior recognition model to analyze the behavior features of the monitoring data and their corresponding normal behavior feature baselines, determine whether there are abnormalities, and distinguish normal behavior from attack behavior. It loads the pre-trained abnormal behavior recognition model and sets the normal behavior feature baseline for each behavior feature based on the historical normal monitoring data. Then, the behavior feature sequence table is imported into the abnormal behavior recognition model. A large amount of historical monitoring data with labeled normal and abnormal behavior features is obtained from the enterprise database and integrated into a comprehensive data set. Based on the normal historical monitoring data accumulated by the enterprise, the corresponding normal behavior feature baseline is determined for each behavior feature. The data set is divided into a training set and a test set. The deep learning algorithm of the generative adversarial network model is used as the model infrastructure to build an abnormal behavior recognition model. The training set is used to train the generative adversarial network. The extracted behavioral features are used as model input, and whether the behavioral features are abnormal is used as model output. The model is evaluated using the test set, and finally an abnormal behavior recognition model is obtained. Specifically, a large amount of historical monitoring data with labeled normal and abnormal behavior features is obtained from the enterprise database, covering various normal business operations and known attack behavior samples to ensure data diversity and representativeness. The collected data is integrated into a comprehensive data set, and the data is cleaned to remove noise and outliers to ensure data quality. In the integrated data set, the data is labeled to clarify whether each data sample is normal behavior or Abnormal behavior, the integrated data set is divided into a training set and a test set in proportion. The training set is used to train the model, and the test set is used to evaluate the performance of the model. A deep learning algorithm based on the generative adversarial network (GAN) is used as the basic architecture of the model. GAN consists of two parts: the generator and the discriminator. The generator is used to generate data, and the discriminator is used to distinguish the generated data from the real data. Through the adversarial training of the two, the model's ability to generate and judge data is improved. A GAN architecture suitable for abnormal behavior recognition is designed, and the parameters such as the number of network layers, the number of nodes, and the activation function are determined. The input layer receives the extracted behavioral features, and the output layer outputs the judgment result of whether the behavioral features are abnormal. The data in the training set are used to train the generator and the discriminator. By alternating training, the generator and the discriminator are trained. Generator and discriminator, continuously optimize the performance of the model. During the training process, according to the training effect of the model, adjust the hyperparameters such as learning rate and batch size. At the same time, monitor the loss function of the generator and discriminator to ensure the stability of the model training. Apply the trained abnormal behavior recognition model to the test set to evaluate the performance of the model. The evaluation indicators include accuracy, recall rate, precision and F1 score. According to the evaluation results, analyze the advantages and disadvantages of the model. At the same time, compare different evaluation indicators, weigh the relationship between the performance of the model and the actual application requirements, and optimize and adjust the model to achieve the best abnormal behavior recognition effect. Take each behavioral feature in the behavioral feature sequence table as the analysis object, and compare and analyze it with the corresponding normal behavior feature baseline one by one.Calculate the deviation value of each behavioral feature and set the abnormality judgment threshold for each deviation value to determine whether there is an abnormality. After completing the comparative analysis of all behavioral features with the normal behavioral feature baseline, the abnormal behavior recognition model screens and organizes the behavioral features with deviations and outputs them to distinguish normal behavior from attack behavior.

[0074] The behavior classification control module is used to combine the results of abnormal behavior identification, comprehensively calculate the behavior trend coefficient, analyze the degree to which behavioral characteristics in the enterprise network deviate from the normal behavior baseline, and classify abnormal behaviors into risk categories. The behavior classification control module includes a behavior analysis unit and a behavior classification unit;

[0075] Among them, the behavior trend analysis unit is used to combine the behavior characteristics in the enterprise network with the identification results of abnormal behavior, calculate the behavior trend coefficient, analyze the trend of abnormal behavior, extract the behavior characteristic data covering network traffic, system operation and terminal device status in the enterprise network, and obtain the abnormal behavior identification results output by the abnormal behavior identification module. The two types of data are matched and integrated according to the timestamp and device identification fields, and the deviation value between the actual value and the baseline value of each behavior characteristic is determined based on the pre-set normal behavior characteristic baseline, thereby forming an analysis data set containing behavior characteristic data, abnormal behavior identification results and deviation values. Based on the analysis data set, the traffic behavior characteristics, system behavior characteristics and device behavior characteristics therein are combined with the deviation values of each behavior characteristic to calculate the traffic behavior trend index, system behavior trend index and device behavior trend index respectively, and analyze the different Based on the calculated traffic behavior trend index, system behavior trend index, and device behavior trend index, the trend of abnormal behavior is comprehensively analyzed. According to the changes in each abnormal behavior, corresponding weights are assigned and the weighted sum is calculated to obtain a comprehensive behavior trend coefficient. It is judged whether the abnormal behavior in the enterprise network is showing an upward trend, a downward trend, or remains stable. Among them, if the value of the behavior trend coefficient continues to increase in multiple consecutive time windows, it indicates that the abnormal behavior is on an upward trend and security monitoring and response measures need to be strengthened. If the value of the behavior trend coefficient continues to decrease in multiple consecutive time windows, it indicates that the abnormal behavior is on a downward trend and the frequency of security monitoring can be appropriately reduced, but vigilance is still required. If the value of the behavior trend coefficient remains relatively stable in multiple consecutive time windows, it indicates that the abnormal behavior remains stable and can be monitored and managed according to conventional security policies.

[0076] In addition, the calculation process of the traffic behavior trend index is:

[0077] For each actual value of the traffic behavior feature in the analysis data set, subtract the normal behavior feature baseline value of the corresponding traffic behavior feature to obtain the deviation value of the traffic behavior feature, add the absolute values of the deviation values of all traffic behavior features, calculate the sum of the absolute values of the traffic behavior feature deviation values, and divide the sum of the absolute values of the traffic behavior feature deviation values by the product of the number of traffic behavior features and the normal behavior feature baseline value of the traffic behavior feature to obtain the average relative deviation of the deviation values. With base 2, calculate the logarithm of the average relative deviation of the deviation values plus 1, and then multiply the average relative deviation of the deviation values by the obtained logarithm value to obtain the traffic behavior trend index;

[0078] The expression of traffic behavior trend index is:

[0079]

[0080] Where, T flow is the traffic behavior trend index, x t is the actual value of the t-th traffic behavior feature, x base is the normal baseline value of the traffic behavior feature, N is the number of traffic behavior features, and when the deviation between the actual value of the traffic behavior feature and the baseline value is greater, the value of the traffic behavior trend index is also greater, indicating that the degree of abnormality of the traffic behavior is higher;

[0081] The calculation process of the system behavior trend index is:

[0082] For each actual value of the system behavior feature in the analysis data set, subtract the normal behavior feature baseline value of the corresponding system behavior feature to obtain the deviation value of the system behavior feature, calculate the square of the deviation value of the system behavior feature, add the square of the deviation values of all system behavior features, and divide the sum of the square of the deviation values of all system behavior features by the product of the number of system behavior features and the square of the normal behavior feature baseline value of the system behavior feature to obtain the average relative deviation of the square of the deviation value of the system behavior feature. Take the cube root of the average relative deviation of the square of the deviation value of the system behavior feature to obtain the system behavior trend index;

[0083] The expression of system behavior trend index is:

[0084]

[0085] Where, T sys is the system behavior trend index, y j is the actual value of the jth system behavior characteristic, y base is the normal baseline value of the system behavior characteristic, M is the number of system behavior characteristics, when the deviation between the actual value of the system behavior characteristic and the baseline value is larger, the value of the system behavior trend index is also larger, indicating that the abnormality of the system behavior is higher;

[0086] The calculation process of the device behavior trend index is as follows:

[0087] For each device behavior feature in the analysis data set, subtract the normal behavior feature baseline value of the corresponding device behavior feature from the actual value to obtain the deviation value of the device behavior feature. Add the absolute values of the deviation values of all device behavior features, and divide the sum of the absolute values of the deviation values of all device behavior features by the product of the number of device behavior features and the normal behavior feature baseline value of the device behavior features to obtain the average relative deviation of the deviation values of the device behavior features. Calculate the exponential function value of the average relative deviation of the deviation values of the device behavior features with the natural constant e as the base, and then multiply the average relative deviation of the deviation values of the device behavior features by the obtained exponential function value to obtain the device behavior trend index.

[0088] The expression of device behavior trend index is:

[0089]

[0090] Where, T dev is the device behavior trend index, z k is the actual value of the kth device behavior characteristic, z base is the normal baseline value of the device behavior feature, K is the number of device behavior features, and when the deviation between the actual value of the device behavior feature and the baseline value is greater, the value of the device behavior trend index is also greater, indicating that the degree of abnormality of the device behavior is higher;

[0091] The behavior classification unit is used to combine the analysis results of abnormal behaviors and classify abnormal behaviors into different risk categories according to the behavior trend coefficient. According to the enterprise's tolerance for security risks, network security needs and recorded historical security events, risk classification standards for abnormal behaviors are formulated, and different risk categories are defined, namely low-risk category, medium-risk category and high-risk category. In combination with the behavior trend coefficient, corresponding classification thresholds are set for each risk category. Among them, the low-risk category refers to abnormal behaviors that have little impact on the normal operation of the enterprise and can be tolerated within a certain range. The medium-risk category refers to behaviors that cause certain interference to the enterprise's business but will not cause significant losses. The high-risk category refers to behaviors that will pose a serious threat to the enterprise's core business, data security, etc. The abnormal behaviors obtained through analysis and their corresponding behavioral trend coefficients are imported into the behavioral classification unit. The abnormal behaviors are classified according to the pre-set risk classification standards. The behavioral trend coefficients of the abnormal behaviors are compared with the threshold ranges of each risk category to ensure accurate classification. For the classified abnormal behaviors, the information of the abnormal behaviors is recorded and the risk category to which they belong is clarified. The recorded abnormal behavior information includes a specific description of the abnormal behavior, the behavioral trend coefficient and the corresponding classification results. An audit mechanism is established to conduct random checks on the classification results. The rationality of the classification is judged based on the company's security strategy and actual situation. If classification errors are found, feedback is provided and adjustments are made. The risk classification standards and classification processes are continuously optimized to improve the quality and practicality of behavior classification.

[0092] In addition, the expression of the behavioral tendency coefficient is:

[0093] C index =w1·T flow +w2·T sys +w3·T dev ;

[0094] Where C index is the behavioral tendency coefficient, T flow is the traffic behavior trend index, w1 is the weight of the traffic behavior trend index, T sys is the system behavior trend index, w2 is the weight of the system behavior trend index, T dev is the device behavior trend index, w3 is the weight of the device behavior trend index. The larger the value of the behavior trend coefficient, the more serious the abnormal behavior in the enterprise network, and the more security measures need to be taken.

[0095] Multiple risk categories are set in a one-to-one correspondence with multiple classification thresholds. The specific correspondence is as follows:

[0096] The threshold for low-risk classification is: 0≤C index <C L ;

[0097] The threshold for the medium risk category is: C L ≤C index <C H ;

[0098] The threshold for high-risk classification is: C index ≥C H ;

[0099] Among them, C index is the behavioral tendency coefficient, C L is the upper threshold of the low-risk category and the lower threshold of the medium-risk category, C H The upper threshold for the medium risk category and the lower threshold for the high risk category;

[0100] The intelligent firewall module is used to adjust the security policy rules of the intelligent firewall based on the results of the abnormal behavior identification model and the behavior classification control module, filter and intercept monitoring data in real time, and automatically update the firewall policy based on new threat intelligence and attack patterns to block the entry of attack traffic while allowing normal traffic to pass. This provides real-time security protection, effectively resists various network attacks, reduces security vulnerabilities, and reduces the risk of security threats to the enterprise.

[0101] The enhanced learning module is used to connect to external threat intelligence sources and interact with the enterprise network environment. Based on the interception results of the intelligent firewall module and the feedback information from the system, it adjusts the policy parameters of the intelligent firewall module and optimizes the security policy rules to continuously improve the protection effect of the firewall, thereby improving the response capability to unknown attacks.

[0102] Example 2, as Figure 1 、 Figure 2 As shown, based on Example 1, the present invention provides a technical solution: preferably, the intelligent firewall module specifically includes:

[0103] The intelligent firewall module receives the output results of the abnormal behavior identification model and the behavior classification and control module, and dynamically adjusts the existing security policy rules. For behaviors that are identified as abnormal and belong to high-risk categories, such as certain specific malicious IP addresses, ports that frequently launch attacks, or characteristic traffic of malware, corresponding blocking rules are generated, such as prohibiting access to specific IPs, closing high-risk ports, etc. At the same time, for abnormal behaviors in low-risk or medium-risk categories, traffic rate restrictions or additional monitoring measures are taken instead of direct blocking, so as to ensure that potential threats are effectively controlled without affecting normal business. When network traffic passes through the firewall, the firewall performs real-time inspections on the network traffic according to the adjusted security policy rules. If it is found that the traffic meets the identified abnormal behavior characteristics or violates the new security policy rules, interception measures are immediately taken to prevent suspicious traffic from entering the enterprise internal network. For normal traffic, the firewall allows it to pass smoothly to ensure that the normal business of the enterprise is not affected. The intelligent firewall module continuously pays attention to new threat intelligence and attack patterns, and obtains the latest attack feature information from external threat intelligence sources. Once a new threat is discovered, the firewall automatically updates the security policy rules to cope with the ever-changing network attack methods. After updating the security policy rules, the traffic that has passed the initial filtering is re-analyzed to detect potential attack behaviors hidden in normal traffic, further enhancing the ability to resist network attacks. After completing the interception of attack traffic, the intelligent firewall re-checks the remaining network traffic to ensure that it is normal business traffic. For network traffic that complies with normal business rules and security policy rules, the firewall allows it to pass smoothly to ensure the normal communication and business operation of the enterprise network. At the same time, it records attack events and interception situations in real time, providing detailed log information for security management personnel;

[0104] The reinforcement learning module specifically includes:

[0105] The reinforcement learning module connects to external threat intelligence sources and establishes a stable connection to obtain the latest network threat information in real time, including new attack methods, malware characteristics, and vulnerability exploitation methods. At the same time, it collects the interception results and system feedback information of the intelligent firewall module in the enterprise network environment as the basis for the reinforcement learning module to adjust its policies. Based on the collected threat intelligence and feedback information, the reinforcement learning module uses the reinforcement learning algorithm to adjust the security policy rules of the intelligent firewall module. The interception success rate under the current security policy rules is used as a reward signal. When the interception is successful, a positive reward is given, and when the interception fails, a negative penalty is given. The total reward value is calculated, and through trial and error learning, the optimal security policy rule parameters are analyzed to determine the updated security policy rule parameters, thereby improving the identification and interception capabilities of known and unknown attacks. After the policy parameters of the security policy rules are adjusted, the reinforcement learning module applies the new security policy rules to the intelligent firewall module and continuously monitors its protection effect. The actual effect of the adjusted security policy rules is regularly evaluated, and the interception success rate indicators before and after the adjustment are compared. Based on the evaluation results, the policy rules are further optimized to form a closed loop of continuous improvement.

[0106] The calculation expression of the total reward value is:

[0107]

[0108] In the formula, R is the total reward value, I i is the interception result of the i-th attack, success is 1, failure is 0, R i is the interception success rate of the i-th attack, and n is the total number of attack events. When both the number of successful interceptions and the interception success rate are high, the total reward value will increase, indicating that the current security policy rules are good. Conversely, when the number of failed interceptions is high, the total reward value will decrease, indicating that the security policy rules need to be adjusted.

[0109] The updated security policy rule parameter expression is:

[0110]

[0111] Where θ new is the updated security policy rule parameter, θ old is the current security policy rule parameter, α is the learning rate, which determines the step size of parameter update, baseline is the baseline of the reward value, which is the historical average reward value, The gradient of the security policy rule with respect to the parameter θ. When the total reward value is higher than the baseline, the parameter update direction is consistent with the gradient direction, and the security policy rule parameters are adjusted in a more optimal direction. When the total reward value is lower than the baseline, the parameter update direction is opposite to the gradient direction, and the security policy rule parameters are adjusted in a more conservative direction. Through continuous iterative updates, the optimal security policy rule parameters are eventually found, improving the ability to identify and intercept known and unknown attacks.

[0112] The above description is merely a specific embodiment of the present application, but the scope of protection of the present application is not limited thereto. Any changes or substitutions that can be easily conceived by a person skilled in the art within the technical scope disclosed in this application should be included in the scope of protection of this application. Therefore, the scope of protection of this application should be based on the scope of protection of the claims.

Claims

1. An enterprise digital information security monitoring system based on an intelligent firewall, including a visual monitoring platform, is characterized by: The visual monitoring platform is communicatively connected to a data acquisition module, an abnormal behavior identification module, a behavior classification and control module, an intelligent firewall module, and an enhanced learning module, wherein electrical signals are connected between the modules; The data acquisition module is used to collect and pre-process monitoring data from various key nodes in the enterprise internal network, and extract and analyze the behavioral features of the behavioral patterns of the monitoring data from the monitoring data and integrate them into a behavioral feature sequence list; The abnormal behavior recognition module is used to combine the behavior feature sequence table and the pre-trained abnormal behavior recognition model to analyze each behavior feature of the monitoring data and its corresponding normal behavior feature baseline to determine whether there is an abnormality; The behavior classification control module is used to combine the identification results of abnormal behavior, comprehensively calculate the behavior trend coefficient, analyze the degree to which the behavior characteristics in the enterprise network deviate from the normal behavior characteristic baseline, and classify the abnormal behavior into risk categories; The intelligent firewall module is used to adjust the security policy rules of the intelligent firewall according to the results of the abnormal behavior identification model and the behavior classification control module; The enhanced learning module is used to connect to external threat intelligence sources, interact with the enterprise network environment, adjust the policy parameters of the intelligent firewall module, and optimize security policy rules.

2. The enterprise digital information security monitoring system based on the intelligent firewall according to claim 1 is characterized by: The data acquisition module specifically includes: Based on the enterprise's internal network architecture and monitoring needs, the scope of key nodes is clearly defined. Sensors, agents, or interfaces for accessing network devices deployed at key nodes of the enterprise network are used to collect multi-dimensional monitoring data in real time, including network traffic data, system log data, and terminal device status data. Preprocess the collected monitoring data, including data cleaning and normalization operations; The pre-processed monitoring data is integrated, and feature analysis is performed on the network traffic data, system log data and terminal device status data. Behavioral features used to analyze the behavioral patterns of the monitoring data are extracted, namely traffic behavior features, system behavior features and device behavior features. For network traffic data, traffic behavior features including packet transmission rate, average packet size and traffic burst peak are extracted. For system log data, system behavior features including the number of user logins per unit time, error log frequency and system operation command frequency are extracted. For terminal device status data, device behavior features including device CPU usage peak, memory usage change rate and device online time ratio are extracted. All behavioral features are arranged in chronological order to form a comprehensive behavioral feature sequence list.

3. The enterprise digital information security monitoring system based on the intelligent firewall according to claim 2 is characterized by: The abnormal behavior identification module specifically includes: Load the pre-trained abnormal behavior recognition model and set a normal behavior feature baseline for each behavior feature based on historical normal monitoring data, and then import the behavior feature sequence list into the abnormal behavior recognition model; Each behavioral feature in the behavioral feature sequence list is analyzed, and each is compared with the corresponding normal behavioral feature baseline. The deviation value of each behavioral feature is calculated, and the abnormality judgment threshold of each deviation value is set to determine whether there is an abnormality. After completing the comparative analysis of all behavioral features with the baseline of normal behavioral features, the abnormal behavior recognition model screens and organizes the behavioral features with deviations and outputs them to distinguish normal behavior from attack behavior.

4. The enterprise digital information security monitoring system based on the intelligent firewall according to claim 3 is characterized by: The behavior classification control module includes a behavior analysis unit and a behavior classification unit; The behavior trend analysis unit is used to combine the behavior characteristics in the enterprise network with the identification results of abnormal behavior, calculate the behavior trend coefficient, and analyze the trend of abnormal behavior; The behavior classification unit is used to combine the analysis results of abnormal behaviors and classify abnormal behaviors into different risk categories according to the behavior tendency coefficient.

5. The enterprise digital information security monitoring system based on the intelligent firewall according to claim 4 is characterized by: The behavior trend analysis unit specifically includes: Extract behavioral feature data covering network traffic, system operations, and terminal device status from the enterprise network, and simultaneously obtain the abnormal behavior identification results output by the abnormal behavior identification module. Match and integrate the two types of data based on the timestamp and device identification fields. Using a pre-set normal behavior feature baseline as the standard, determine the deviation between the actual value of each behavioral feature and the baseline value, thereby forming an analytical data set containing behavioral feature data, abnormal behavior identification results, and deviation values. Based on the analysis data set, the traffic behavior characteristics, system behavior characteristics, and device behavior characteristics are combined with the deviation values of each behavior characteristic to calculate the traffic behavior trend index, system behavior trend index, and device behavior trend index respectively, and analyze the trend of each abnormal behavior; Based on the calculated traffic behavior trend index, system behavior trend index, and device behavior trend index, a comprehensive analysis of abnormal behavior trends is conducted. According to the changes in each abnormal behavior, corresponding weights are assigned, and the weighted sum is calculated to obtain a comprehensive behavior trend coefficient. It is judged whether the abnormal behavior in the enterprise network is on an upward trend, downward trend, or remains stable.

6. The enterprise digital information security monitoring system based on the intelligent firewall according to claim 5 is characterized by: The calculation process of the traffic behavior trend index is as follows: For each traffic behavior feature in the analysis data set, the actual value is subtracted from the normal behavior feature baseline value of the corresponding traffic behavior feature to obtain the deviation value of the traffic behavior feature; The absolute values of the deviation values of all traffic behavior characteristics are added together to calculate the sum of the absolute values of the traffic behavior characteristic deviation values, and the sum of the absolute values of the traffic behavior characteristic deviation values is divided by the product of the number of traffic behavior characteristics and the normal behavior characteristic baseline value of the traffic behavior characteristics to obtain the average relative deviation of the deviation values; Calculate the logarithm of the average relative deviation of the deviation value plus 1 with base 2, and then multiply the average relative deviation of the deviation value by the obtained logarithm to obtain the traffic behavior trend index; The calculation process of the system behavior trend index is: For each system behavior feature in the analysis data set, the actual value is subtracted from the normal behavior feature baseline value of the corresponding system behavior feature to obtain the deviation value of the system behavior feature, and the square of the deviation value of the system behavior feature is calculated; Adding the squares of the deviation values of all system behavior characteristics, and dividing the sum of the squares of the deviation values of all system behavior characteristics by the product of the number of system behavior characteristics and the squares of the normal behavior characteristic baseline values of the system behavior characteristics, to obtain an average relative deviation of the squares of the deviation values of the system behavior characteristics; The cube root of the average relative deviation of the square of the deviation value of the system behavior characteristics is taken to obtain the system behavior trend index; The calculation process of the device behavior trend index is as follows: For each device behavior feature in the analysis data set, the actual value is subtracted from the normal behavior feature baseline value of the corresponding device behavior feature to obtain the deviation value of the device behavior feature; Adding the absolute values of the deviation values of all device behavior features, and dividing the sum of the absolute values of the deviation values of all device behavior features by the product of the number of device behavior features and the normal behavior feature baseline value of the device behavior features, to obtain an average relative deviation of the deviation values of the device behavior features; The exponential function value of the average relative deviation of the deviation values of the device behavior characteristics is calculated with the natural constant e as the base, and then the average relative deviation of the deviation values of the device behavior characteristics is multiplied by the obtained exponential function value to obtain the device behavior trend index.

7. The enterprise digital information security monitoring system based on the intelligent firewall according to claim 5 is characterized by: The behavior classification unit specifically includes: Based on the enterprise's security risk tolerance, network security needs, and historical security incident records, develop risk classification standards for abnormal behaviors, define different risk categories as low risk, medium risk, and high risk, and set corresponding classification thresholds for each risk category based on the behavioral trend coefficient; Import the abnormal behaviors and their corresponding behavioral trend coefficients obtained through analysis into the behavioral classification unit, classify the abnormal behaviors according to the pre-set risk classification standards, and compare the behavioral trend coefficients of the abnormal behaviors with the classification threshold ranges of each risk category; For the classified abnormal behaviors, the information of the abnormal behaviors is recorded to clarify the risk category to which they belong. The recorded abnormal behavior information includes a specific description of the abnormal behavior, a behavior tendency coefficient, and a corresponding classification result.

8. The enterprise digital information security monitoring system based on the intelligent firewall according to claim 7 is characterized by: The expression of the behavioral tendency coefficient is: C index =w1·T flow +w2·T sys +w3·T dev ; Where C index is the behavioral tendency coefficient, T flow is the traffic behavior trend index, w1 is the weight of the traffic behavior trend index, T sys is the system behavior trend index, w2 is the weight of the system behavior trend index, T dev is the device behavior trend index, w3 is the weight of the device behavior trend index; The risk categories are set in one-to-one correspondence with the classification thresholds. The specific correspondence is as follows: The threshold for the low-risk category is: 0≤C index <C L ; The threshold for dividing the medium risk category is: C L ≤C index <C H ; The threshold for the high-risk category is: C index ≥C H ; Among them, C index is the behavioral tendency coefficient, C L is the upper threshold of the low-risk category and the lower threshold of the medium-risk category, C H is the upper threshold for the medium risk category and the lower threshold for the high risk category.

9. The enterprise digital information security monitoring system based on the intelligent firewall according to claim 1 is characterized by: The intelligent firewall module specifically includes: The intelligent firewall module receives the output of the abnormal behavior identification model and the behavior classification and control module, and dynamically adjusts the existing security policy rules. For behaviors identified as abnormal and belonging to the high-risk category, it generates corresponding blocking rules. At the same time, for abnormal behaviors in the low-risk or medium-risk categories, it adopts traffic rate restriction or adds additional monitoring measures instead of direct blocking. When network traffic passes through the firewall, it will perform real-time inspections based on the adjusted security policy rules. If it finds that the traffic matches the identified abnormal behavior characteristics or violates the new security policy rules, it will immediately take interception measures. For normal traffic, the firewall will allow it to pass smoothly. Continuously monitor new threat intelligence and attack patterns, obtain the latest attack signature information from external threat intelligence sources, and automatically update security policy rules once a new threat is discovered. After updating security policy rules, reanalyze traffic that has passed preliminary filtering to detect potential attack behaviors hidden in normal traffic. After completing the interception of attack traffic, the intelligent firewall will re-check the remaining network traffic. For network traffic that complies with normal business rules and security policy rules, the firewall will allow it to pass smoothly. At the same time, it will record the attack events and interception status in real time.

10. The enterprise digital information security monitoring system based on the intelligent firewall according to claim 1 is characterized by: The reinforcement learning module specifically includes: The enhanced learning module connects to external threat intelligence sources and establishes a stable connection to obtain the latest network threat information in real time. At the same time, it collects the interception results of the intelligent firewall module in the enterprise network environment and the system feedback information as the basis for the enhanced learning module to adjust its strategy; Based on the collected threat intelligence and feedback information, the reinforcement learning module uses a reinforcement learning algorithm to adjust the security policy rules of the intelligent firewall module. The interception success rate under the current security policy rules is used as a reward signal. When the interception is successful, a positive reward is given, and when the interception fails, a negative penalty is given. The total reward value is calculated, and through trial and error learning, the optimal security policy rule parameters are analyzed to determine the updated security policy rule parameters. After the policy parameters of the security policy rules are adjusted, the reinforcement learning module applies the new security policy rules to the intelligent firewall module and continuously monitors its protection effect. It regularly evaluates the actual effect of the adjusted security policy rules, compares the interception success rate indicators before and after the adjustment, and further optimizes the policy rules based on the evaluation results.

Images