A network automation management system based on dynamic network security

Abstract

The application relates to the field of data processing, and discloses a network automatic management system based on dynamic network security, which comprises a behavior characteristic fingerprint acquisition module, a security threat identification identification module, a security policy instruction generation module, a protection verification result acquisition module and a deployment target node module. The original communication characteristic set is matched with a preset behavior characteristic library in real time to obtain a behavior characteristic fingerprint. The behavior characteristic fingerprint is subjected to abnormal communication identification to obtain a security threat identification. The strategy constraint of the security threat identification is extracted, and a security policy instruction of the communication network is generated based on the strategy constraint. The communication network is synchronously adjusted, and the feedback data of the synchronously adjusted communication network is compared with an expected security threshold to obtain a protection verification result. When the protection verification result is passed, the protection verification result is deployed to a target node of the communication network. The application can improve the efficiency of network automatic management.

Description

Technical Field

[0001] This invention relates to the field of data processing technology, and in particular to a network automation management system based on dynamic network security. Background Technology

[0002] In current network security management technologies, the extraction and matching of communication features lack a systematic approach. Analysis often focuses on single-dimensional features, failing to comprehensively integrate protocol-layer and traffic pattern characteristics, and neglecting to normalize the matching results of different features. Consequently, a comprehensive behavioral fingerprint cannot be formed. This results in an incomplete characterization of complex network communication behaviors, making it difficult to accurately identify abnormal patterns hidden within normal communication. Consequently, early warning capabilities for security threats are insufficient, and security response lags behind the occurrence of threats, failing to promptly prevent the spread of potential risks.

[0003] Meanwhile, existing technologies lack dynamic adjustment mechanisms for the generation and deployment of security policies. The scope of policy constraints is not clearly defined, failing to accurately delineate the constraint domain based on network topology. Furthermore, the policy execution process lacks dynamic consideration of real-time network status and resource conditions, and there are no effective verification and optimization steps. This results in security policies remaining fixed after generation, making it difficult to adapt to real-time changes in network conditions. When network load fluctuates or the situation level increases, policy execution deviations or suboptimal protection effects are prone to occur, failing to provide continuous and reliable security for the network and struggling to cope with dynamically changing network security environments. Summary of the Invention

[0004] This invention provides a network automation management system based on dynamic network security, the main purpose of which is to solve the problem of low efficiency in network automation management.

[0005] To achieve the above objectives, the present invention provides a network automation management system based on dynamic network security, characterized in that the system includes a behavioral feature fingerprint acquisition module, a security threat identification module, a security policy instruction generation module, a protection verification result acquisition module, and a target node deployment module, wherein:

[0006] The behavioral feature fingerprint acquisition module is used to match the original communication feature set with the preset behavioral feature library in real time, and use the matching result as the behavioral feature fingerprint of the communication network.

[0007] A security threat identification module is used to identify abnormal communication from the behavioral feature fingerprint to obtain a security threat identifier for the communication network.

[0008] A security policy instruction generation module is used to extract the policy constraints of the security threat identifier and generate security policy instructions for the communication network based on the policy constraints.

[0009] The protection verification result acquisition module is used to synchronously adjust the communication network based on the security policy instructions, and compare the feedback data of the synchronously adjusted communication network with the expected security threshold to obtain the protection verification result of the communication network.

[0010] The target node deployment module is used to deploy the protection verification result to the target node of the communication network when the protection verification result is passed.

[0011] In a preferred embodiment, when the behavioral feature fingerprint acquisition module performs real-time matching of the original communication feature set with a preset behavioral feature library and uses the matching result as the behavioral feature fingerprint of the communication network, it is specifically used for:

[0012] The original communication feature set is compared with the protocol layer feature library to obtain the protocol feature matching degree of the communication network.

[0013] The protocol feature matching degree is matched with the traffic pattern feature library to obtain the traffic behavior matching degree of the communication network.

[0014] The protocol feature matching degree and the traffic behavior matching degree are normalized to obtain the behavioral feature fingerprint of the communication network.

[0015] In a preferred embodiment, when the security threat identification module performs abnormal communication identification on the behavioral feature fingerprint to obtain the security threat identifier of the communication network, it is specifically used for:

[0016] The behavioral feature fingerprint is compared with the historical threat feature database to obtain the primary threat identifier of the communication network.

[0017] Based on the primary threat identifier, feature mapping is performed on the real-time communication link to obtain the link threat fingerprint of the real-time communication link;

[0018] The primary threat identifier and the link threat fingerprint are aggregated to obtain the security threat identifier of the communication network.

[0019] In a preferred embodiment, when the security policy instruction generation module executes the policy constraints for extracting the security threat identifier and generates security policy instructions for the communication network based on the policy constraints, it is specifically used for:

[0020] The core constraint elements are mapped to the network topology to obtain the constraint scope of the communication network;

[0021] The core constraint elements and the constraint scope are encapsulated to obtain the policy constraints of the communication network;

[0022] Based on the policy constraints, the communication network is transformed into a rule-based system to obtain the security policy instructions for the communication network.

[0023] In a preferred embodiment, when the security policy instruction generation module executes the generation of security policy instructions for the communication network based on the policy constraints, it is specifically used for:

[0024] Based on the aforementioned policy constraints, weights are allocated to network resource states, and policy priority coefficients are calculated. The formula for calculating the policy priority coefficients is as follows: In the formula, This is the strategy priority coefficient. For the first Class resource weighting factor For real-time timestamps, For real-time resource load, As the baseline load, For policy constraint categories, Maximum value To constrain the total number of categories;

[0025] The adjustment instructions in the policy library are dynamically selected based on the policy priority coefficient to obtain the initial policy instructions for the communication network.

[0026] Based on the network's full compliance, the initial policy instructions are adjusted for compliance to obtain the security policy instructions for the communication network.

[0027] In a preferred embodiment, when the protection verification result acquisition module executes the synchronous adjustment of the communication network based on the security policy instruction, it is specifically used for:

[0028] The security policy instructions call the syntax rule library, and the boundary protection devices in the syntax rule library are reconstructed into executable adaptation instructions according to the device-specific syntax.

[0029] The routing table of the core routing node is updated based on the adaptation instructions to obtain the routing health baseline of the communication network.

[0030] The adaptation command and the routing health baseline are jointly verified to obtain the network synchronization status of the communication network.

[0031] In a preferred embodiment, when the protection verification result acquisition module performs and compares the feedback data of the synchronized and adjusted communication network with the expected security threshold to obtain the protection verification result of the communication network, it is specifically used for:

[0032] Based on the network synchronization status, the traffic along the entire path is collected, and the traffic is aggregated into a real-time security indicator set for the communication network.

[0033] The control plane of the communication network is compared based on the real-time security indicator set to obtain the policy execution deviation data of the control plane;

[0034] A security assessment is performed on the deviation data of the strategy execution to obtain the protection verification results of the communication network.

[0035] In a preferred embodiment, when the protection verification result acquisition module performs a security assessment on the policy execution deviation data to obtain the protection verification result of the communication network, it is specifically used for:

[0036] The dynamic security threshold is calculated based on the current network status level and policy priority coefficient, wherein the formula for calculating the dynamic security threshold is: In the formula, For dynamic security thresholds, As the baseline threshold, As a priority sensitive factor, This is the strategy priority coefficient. As the priority baseline value, This is the situation decay coefficient. The current network situation level, As the baseline situation level;

[0037] The security posture index of the communication network is obtained by weighting and aggregating the policy execution deviation data with the dynamic security threshold.

[0038] The protection verification results of the communication network are derived based on the security situation indicators.

[0039] In a preferred embodiment, when the deployment target node module performs the function of deploying the protection verification result to the target node of the communication network when the protection verification result is passed, it specifically performs the following:

[0040] Based on the protection verification results, the node deployment strategies in the strategy library are filtered to obtain the target deployment strategy for the communication network;

[0041] Based on the target deployment strategy, the target nodes are matched and compiled to obtain the node deployment instructions of the communication network;

[0042] The node deployment command is deployed to the target node of the communication network.

[0043] In a preferred embodiment, the deployment target node module, when performing protection verification, is specifically used for:

[0044] Based on the policy deployment status, the node traffic features are recaptured to obtain the node behavior feature set of the communication network;

[0045] The protection effectiveness is analyzed by analyzing the node behavior feature set to obtain the real-time protection effectiveness index of the communication network;

[0046] When the real-time protection effectiveness index continuously meets the expected protection characteristics, a node protection effectiveness confirmation signal for the communication network is obtained.

[0047] Compared with the prior art, the present invention has the following beneficial effects:

[0048] 1. The network automation management system based on dynamic network security described in this invention performs multi-dimensional matching and processing of original communication features through a behavioral feature fingerprint acquisition module to generate accurate behavioral feature fingerprints. Combined with a security threat identification module, it achieves comprehensive capture and aggregation of security threats. Then, a security policy instruction generation module generates policy instructions adapted to the network state. The protection verification result acquisition module performs dynamic evaluation, and finally, the target node deployment module completes the deployment of effective policies, forming a complete security management closed loop. This improves the consistency and accuracy of network security management and ensures that security measures can accurately act on key network links.

[0049] 2. The network automation management system based on dynamic network security described in this invention incorporates dynamic adjustment and coordination mechanisms in the operation of each module. It calculates dynamic security thresholds based on network status and policy priorities, performs weighted aggregation analysis on policy execution deviations, and continuously monitors protection effectiveness to confirm the policy's effectiveness. This enables security management to adapt to dynamic network changes in real time, enhancing the flexibility and timeliness of network security protection. At the same time, through standardized processing and compliance verification, it ensures the standardization and reliability of the management process, providing comprehensive and continuous security protection for communication networks. Attached Figure Description

[0050] Figure 1 A system architecture diagram of a network automation management system based on dynamic network security is provided in one embodiment of the present invention;

[0051] The realization of the objective, functional features and advantages of the present invention will be further explained in conjunction with the embodiments and with reference to the accompanying drawings. Detailed Implementation

[0052] To make the objectives, technical solutions, and advantages of the embodiments of the present invention clearer, the technical solutions of the embodiments of the present invention will be clearly and completely described below with reference to the accompanying drawings. Obviously, the described embodiments belong to some, but not all, embodiments of the present invention. Based on the embodiments of the present invention, all other embodiments obtained by those skilled in the art without creative effort are within the scope of protection of the present invention.

[0053] The terminology used in the embodiments of this invention is for the purpose of describing particular embodiments only and is not intended to limit the invention. The singular forms “said” and “the” as used in the embodiments of this invention and the appended claims are also intended to include the plural forms, and “multiple” generally includes at least two unless the context clearly indicates otherwise.

[0054] Depending on the context, the word "if" or "if" as used here can be interpreted as "when," "when," "in response to determination," or "in response to detection." Similarly, depending on the context, the phrase "if determination" or "if detection (of the stated condition or event)" can be interpreted as "when determination," "in response to determination," "when detection (of the stated condition or event)," or "in response to detection (of the stated condition or event)."

[0055] Furthermore, the timing of the steps in the following method embodiments is merely an example and not a strict limitation.

[0056] In practice, the server-side equipment deployed in a network automation management system based on dynamic network security may consist of one or more devices. This network automation management system based on dynamic network security can be implemented as: a business instance, a virtual machine, or hardware devices. For example, it can be implemented as a business instance deployed on one or more devices in a cloud node. Simply put, it can be understood as software deployed on a cloud node, providing a network automation management system based on dynamic network security to various user terminals. Alternatively, it can be implemented as a virtual machine deployed on one or more devices in a cloud node, with application software installed to manage various user terminals. Or, it can also be implemented as a server composed of numerous identical or different types of hardware devices, with one or more hardware devices configured to provide a network automation management system based on dynamic network security to various user terminals.

[0057] In terms of implementation, a network automation management system based on dynamic network security and the user terminal are mutually compatible. That is, if a network automation management system based on dynamic network security is implemented as an application installed on a cloud service platform, then the user terminal is implemented as a client that establishes a communication connection with the application; or if a network automation management system based on dynamic network security is implemented as a website, then the user terminal is implemented as a webpage; or if a network automation management system based on dynamic network security is implemented as a cloud service platform, then the user terminal is implemented as a mini-program in an instant messaging application.

[0058] like Figure 1 The diagram shown is a system architecture diagram of a network automation management system based on dynamic network security provided in an embodiment of the present invention.

[0059] The network automation management system 100 based on dynamic network security described in this invention can be set up in a cloud server. In terms of implementation, it can be used as one or more service devices, or as an application installed in the cloud (e.g., a mobile service operator's server, server cluster, etc.), or it can be developed as a website. Depending on the functions implemented, the network automation management system 100 based on dynamic network security may include a behavioral feature fingerprint acquisition module 101, a security threat identification module 102, a security policy instruction generation module 103, a protection verification result acquisition module 104, and a target node deployment module 105. The modules described in this invention can also be called units, referring to a series of computer program segments that can be executed by the processor of an electronic device and can perform a fixed function, stored in the memory of the electronic device.

[0060] In this embodiment of the invention, in a network automation management system based on dynamic network security, each of the above-mentioned modules can be implemented independently and can call other modules. Here, "calling" can be understood as a module connecting to multiple modules of another type and providing corresponding services to those connected modules. In the network automation management system based on dynamic network security provided by this embodiment of the invention, without modifying the program code, the applicability of the network automation management system architecture based on dynamic network security can be adjusted by adding modules and directly calling them, achieving cluster-based horizontal expansion to quickly and flexibly expand the network automation management system based on dynamic network security. In practical applications, the above-mentioned modules can be set in the same device or different devices, or they can be set in virtual devices, such as service instances in a cloud server.

[0061] The following describes, with reference to specific embodiments, each component and its specific workflow of a network automation management system based on dynamic network security:

[0062] The behavior feature fingerprint acquisition module 101 is used to match the original communication feature set with the preset behavior feature library in real time, and use the matching result as the behavior feature fingerprint of the communication network.

[0063] In this embodiment of the invention, when the behavioral feature fingerprint acquisition module performs real-time matching of the original communication feature set with a preset behavioral feature library and uses the matching result as the behavioral feature fingerprint of the communication network, it is specifically used for:

[0064] The original communication feature set is compared with the protocol layer feature library to obtain the protocol feature matching degree of the communication network.

[0065] The protocol feature matching degree is matched with the traffic pattern feature library to obtain the traffic behavior matching degree of the communication network.

[0066] The protocol feature matching degree and the traffic behavior matching degree are normalized to obtain the behavioral feature fingerprint of the communication network.

[0067] Specifically, each feature in the original communication feature set is compared one by one with the feature entries in the protocol layer feature library. The number of matching features found in the protocol layer feature library for each original communication feature is recorded. The proportion of this number to the total number of features in the original communication feature set is calculated, and this proportion is used as the protocol feature matching degree of the communication network.

[0068] Furthermore, the obtained protocol feature matching degree is compared with each traffic pattern trajectory in the traffic pattern feature library. The change trend of the protocol feature matching degree in different time windows is analyzed and the similarity with each trajectory in the traffic pattern feature library is analyzed. The traffic pattern trajectory with the most similar change trend of the protocol feature matching degree is recorded, and the matching degree corresponding to the trajectory is used as the traffic behavior matching degree of the communication network.

[0069] Furthermore, the protocol feature matching degree and traffic behavior matching degree are divided by their respective maximum values ​​to obtain normalized protocol feature matching degree values ​​and traffic behavior matching degree values. These two normalized values ​​are then weighted and summed according to preset weights, and the result is the behavioral feature fingerprint of the communication network.

[0070] In summary, by comparing the original communication feature set with the protocol layer feature library to obtain the protocol feature matching degree, it is possible to accurately identify the usage of various protocols in the communication network, including protocol type, version and transmission rules, etc., and promptly detect non-compliant or unauthorized protocols. This provides accurate protocol layer security basis for network automated management, ensures the compliance of network communication at the protocol level, reduces the possibility of security threats caused by protocol vulnerabilities from the basic level, and improves the underlying protection capabilities of network security.

[0071] In summary, by matching protocol feature matching degree with traffic pattern feature library to obtain traffic behavior matching degree, we can deeply track the dynamic change trajectory of network traffic and analyze the distribution pattern and abnormal fluctuation of traffic at different times and paths.

[0072] In summary, normalizing the matching degree of protocol features and the matching degree of traffic behavior to obtain behavioral feature fingerprints can unify matching degree data of different dimensions and magnitudes under the same measurement standard, eliminate the impact of data differences on subsequent processing, and make behavioral feature fingerprints standardized and comparable. This provides consistent and accurate basic data for subsequent modules such as security threat identification and policy generation in network automation management, ensures the effectiveness and consistency of data transmission between modules, and improves the automation efficiency and accuracy of the entire network security management process.

[0073] The security threat identification module 102 is used to perform abnormal communication identification on the behavioral feature fingerprint to obtain the security threat identification of the communication network.

[0074] In this embodiment of the invention, when the security threat identification module performs abnormal communication identification on the behavioral feature fingerprint to obtain the security threat identification of the communication network, it is specifically used for:

[0075] The behavioral feature fingerprint is compared with the historical threat feature database to obtain the primary threat identifier of the communication network.

[0076] Based on the primary threat identifier, feature mapping is performed on the real-time communication link to obtain the link threat fingerprint of the real-time communication link;

[0077] The primary threat identifier and the link threat fingerprint are aggregated to obtain the security threat identifier of the communication network.

[0078] Specifically, the behavioral feature fingerprint is compared with each threat feature in the historical threat feature database. For each feature dimension in the behavioral feature fingerprint, it is compared with the corresponding dimension of each threat feature in the historical threat feature database to calculate the degree of similarity between the two. The similarity of all dimensions is summarized to obtain the overall similarity between the behavioral feature fingerprint and each historical threat feature. The threat feature with the highest similarity is identified and the pre-configured identifier of the threat feature in the historical threat feature database is determined as the primary threat identifier of the communication network.

[0079] Furthermore, based on the primary threat identifier, all features related to the primary threat identifier are extracted from the real-time communication link. According to the threat type associated with the primary threat identifier, the range of features to be extracted from the real-time communication link is determined. The data stream in the real-time communication link is parsed to extract all features that conform to the range. The extracted features are mapped to a preset feature space according to a preset mapping rule. This mapping rule specifies how to convert the original features into a specific representation in the feature space. By executing this mapping rule, a link threat fingerprint of the real-time communication link is generated.

[0080] Furthermore, the primary threat identifier and the link threat fingerprint are aggregated. The feature vector corresponding to the primary threat identifier and the feature vector corresponding to the link threat fingerprint are concatenated end to end to form a composite feature vector with a higher dimension. The dimensionality of the concatenated composite feature vector is reduced. By analyzing the correlation between the dimensions in the composite feature vector, the key dimensions that are most distinguishable for security threat identification are retained, and redundant dimensions are removed. Finally, an identifier that can accurately characterize network security threats in communication networks is obtained.

[0081] In summary, comparing behavioral feature fingerprints with historical threat feature databases to obtain primary threat identifiers can quickly locate known security threat types that may exist in the current network by leveraging historical threat data. It can shorten the time for initial threat assessment by utilizing existing threat identification experience, provide early threat warning information for automated network management, enable the system to respond quickly to common threats, and improve the timeliness of threat identification.

[0082] In summary, by performing feature mapping on real-time communication links based on primary threat identifiers to obtain link threat fingerprints, it is possible to delve deeper into the specific features related to the threat in the real-time communication links for the initially identified threat direction.

[0083] In summary, aggregating primary threat identifiers and link threat fingerprints to obtain security threat identifiers integrates preliminary threat assessments with specific characteristic information at the link level. By combining the information from both, a comprehensive and accurate threat description is formed, which includes both the threat type and its specific manifestation in the communication link. This enables the network automated management system to obtain a complete threat profile, ensuring that the security policy instructions subsequently generated accurately correspond to the nature and location of the threat, thereby improving the accuracy and effectiveness of network security protection.

[0084] The security policy instruction generation module 103 is used to extract the policy constraints of the security threat identifier and generate the security policy instruction of the communication network based on the policy constraints.

[0085] In this embodiment of the invention, when the security policy instruction generation module executes the policy constraints for extracting the security threat identifier and generates the security policy instructions for the communication network based on the policy constraints, it is specifically used for:

[0086] The core constraint elements are mapped to the network topology to obtain the constraint scope of the communication network;

[0087] The core constraint elements and the constraint scope are encapsulated to obtain the policy constraints of the communication network;

[0088] Based on the policy constraints, the communication network is transformed into a rule-based system to obtain the security policy instructions for the communication network.

[0089] When the security policy instruction generation module executes the generation of security policy instructions for the communication network based on the policy constraints, it is specifically used for:

[0090] Based on the aforementioned policy constraints, weights are allocated to network resource states, and policy priority coefficients are calculated. The formula for calculating the policy priority coefficients is as follows: In the formula, This is the strategy priority coefficient. For the first Class constraint values, For the first Class resource weighting factor For real-time timestamps, For real-time resource load, As the baseline load, For policy constraint categories, Maximum value To constrain the total number of categories;

[0091] The adjustment instructions in the policy library are dynamically selected based on the policy priority coefficient to obtain the initial policy instructions for the communication network.

[0092] Based on the network's full compliance, the initial policy instructions are adjusted for compliance to obtain the security policy instructions for the communication network.

[0093] Specifically, the core constraint elements are mapped to the network topology. For each core constraint element, its specific location and associated nodes in the network topology are determined. The connection relationship between the element and each device and link in the network topology is analyzed. The constraint conditions of the element are transformed into restrictions on specific devices or links in the network topology, thereby obtaining the constraint scope of the communication network.

[0094] Furthermore, the core constraint elements and constraint scopes are encapsulated, the specific requirements of the core constraint elements are associated with the corresponding constraint scopes, the effectiveness and restrictions of each constraint element within the constraint scope are clarified, and these associations and effectiveness rules are integrated into a complete policy unit to obtain the policy constraints of the communication network.

[0095] Furthermore, the communication network is transformed into rules based on policy constraints. According to the constraint elements and scope specified in the policy constraints, they are transformed into specific rules that can be executed by the communication network devices. Corresponding adjustments are made to aspects such as flow control, access permissions, and data transmission paths in the network to ensure that the policy constraints can be effectively executed in the actual communication network and to obtain the security policy instructions of the communication network.

[0096] Specifically, the network resource status is weighted based on policy constraints, and the policy priority coefficient is calculated. For each network resource involved in the policy constraints, a corresponding weight value is assigned according to its importance in the network, current load, and sensitivity to security threats. The specific requirements of the policy constraints are combined with the weights of each network resource to determine the execution priority of each policy constraint on different network resources. The policy priority coefficient is calculated by comprehensively considering the priority relationship between all network resources and policy constraints.

[0097] Furthermore, the adjustment instructions in the policy library are dynamically selected based on the policy priority coefficient to obtain the initial policy instructions for the communication network. The calculated policy priority coefficient is compared with the triggering conditions of each adjustment instruction in the policy library to filter out all adjustment instructions whose triggering conditions match the policy priority coefficient. The filtered adjustment instructions are sorted according to their corresponding policy priority coefficients, and adjustment instructions with higher priority coefficients are selected first. The selected adjustment instructions are combined to form the initial policy instructions for the communication network.

[0098] Furthermore, based on full network compliance, the initial policy directives are adjusted for compliance to obtain the security policy directives for the communication network. The initial policy directives are then comprehensively reviewed to check whether they comply with network security compliance standards, including but not limited to data protection regulations, industry security requirements, and internal security policies. For any parts of the initial policy directives that do not meet compliance standards, corresponding modifications and adjustments are made to ensure that the adjusted policy directives meet the requirements of full network compliance. The policy directives that have undergone compliance adjustments are then determined as the security policy directives for the communication network.

[0099] Specifically, The calculation requires first determining the product of each constraint value and its corresponding resource weight factor. The numerator is obtained by summing the products of all categories. The real-time resource load is compared to the baseline load, and the larger value is used as the denominator. The numerator is then divided by the denominator to obtain the strategy priority coefficient.

[0100] Furthermore, constraint values ​​are pre-set by the system, reflecting the importance of different constraint categories. Resource weighting factors are determined based on resource type and usage requirements, reflecting the relative importance of resources. Real-time resource load is obtained through system monitoring, reflecting the current resource usage status. The baseline load is a reference value set by the system, representing the load level during normal operation.

[0101] Furthermore, when the real-time resource load is less than the baseline load, the denominator is fixed at the baseline load, and the larger the numerator, the larger the priority coefficient. When the real-time resource load is greater than the baseline load, the denominator is the real-time resource load; in this case, with the numerator unchanged, the larger the real-time resource load, the smaller the priority coefficient. When the constraint value or resource weight factor increases, the numerator increases, and the priority coefficient increases accordingly. When the real-time resource load increases, if it exceeds the baseline load, the priority coefficient decreases.

[0102] In summary, mapping core constraint elements to the network topology to obtain the constraint scope clarifies the specific scope of security policy constraints in the network, accurately locates the devices, links, and nodes that require security control, avoids resource waste or control blind spots caused by the indiscriminate application of policy constraints in the network, and enables network automated management systems to focus on key areas when formulating security policies, thereby improving the pertinence and effectiveness of policy constraints.

[0103] In summary, encapsulating core constraint elements and constraint scopes to obtain policy constraints can integrate scattered constraint requirements and specific scopes into a unified and complete policy unit. It clarifies the effective rules and execution standards of each constraint element within its corresponding scope, ensuring that the policy constraint content is clear and logically coherent. This provides a structured basis for the subsequent generation of security policy instructions, reduces policy generation errors caused by chaotic constraint information, and ensures the smoothness of the network automated management process.

[0104] In summary, security policy instructions are obtained by performing rule-based transformation on communication networks based on policy constraints, which can transform abstract policy constraints into specific operational rules that network devices can directly execute.

[0105] In summary, by assigning weights to network resource states based on policy constraints and calculating policy priority coefficients, and by assigning corresponding resource weight factors to different types of constraint values, and combining the maximum values ​​of real-time resource load and baseline load for calculation, the determination of policy priority can fully reflect the actual state of network resources. This ensures that constraints with a greater impact on network security receive higher priority, avoids irrelevant or secondary constraints from consuming too many resources, and enables the network automated management system to prioritize critical security needs when handling multiple policy constraints, thereby improving the rationality of resource allocation and the efficiency of policy execution.

[0106] In summary, the initial policy instructions are obtained by dynamically selecting adjustment instructions from the policy library based on the policy priority coefficient. The adjustment instructions that best match the current network security needs can be selected from the policy library according to the policy priority coefficient. The instructions and priorities can be accurately matched without manual selection, avoiding policy lag or mismatch problems caused by static instruction selection. This allows the network automation management system to quickly call appropriate adjustment instructions and improve the adaptability of the initial policy instructions to the real-time security posture.

[0107] In summary, security policy instructions are obtained by adjusting the initial policy instructions based on full network compliance. By checking whether the initial policy instructions comply with data protection regulations, industry security standards, and internal security policies, and modifying and improving any non-compliant parts, the final generated security policy instructions are ensured to meet both network security protection needs and various compliance requirements. This avoids legal risks or management loopholes caused by policy violations, enabling automated network management to ensure security while also taking compliance into account, thereby improving the standardization and reliability of overall management.

[0108] The protection verification result acquisition module 104 is used to synchronously adjust the communication network based on the security policy instructions, and compare the feedback data of the synchronously adjusted communication network with the expected security threshold to obtain the protection verification result of the communication network.

[0109] In this embodiment of the invention, when the protection verification result acquisition module executes the synchronous adjustment of the communication network based on the security policy instruction, it is specifically used for:

[0110] The security policy instructions call the syntax rule library, and the boundary protection devices in the syntax rule library are reconstructed into executable adaptation instructions according to the device-specific syntax.

[0111] The routing table of the core routing node is updated based on the adaptation instructions to obtain the routing health baseline of the communication network.

[0112] The adaptation command and the routing health baseline are jointly verified to obtain the network synchronization status of the communication network.

[0113] When the protection verification result acquisition module performs and compares the feedback data of the synchronized and adjusted communication network with the expected security threshold to obtain the protection verification result of the communication network, it is specifically used for:

[0114] Based on the network synchronization status, the traffic along the entire path is collected, and the traffic is aggregated into a real-time security indicator set for the communication network.

[0115] The control plane of the communication network is compared based on the real-time security indicator set to obtain the policy execution deviation data of the control plane;

[0116] A security assessment is performed on the deviation data of the strategy execution to obtain the protection verification results of the communication network.

[0117] When the protection verification result acquisition module performs a security assessment on the policy execution deviation data to obtain the protection verification result of the communication network, it is specifically used for:

[0118] The dynamic security threshold is calculated based on the current network status level and policy priority coefficient, wherein the formula for calculating the dynamic security threshold is: In the formula, For dynamic security thresholds, As the baseline threshold, As a priority sensitive factor, This is the strategy priority coefficient. As the priority baseline value, This is the situation decay coefficient. The current network situation level, As the baseline situation level;

[0119] The security posture index of the communication network is obtained by weighting and aggregating the policy execution deviation data with the dynamic security threshold.

[0120] The protection verification results of the communication network are derived based on the security situation indicators.

[0121] Specifically, the syntax rule library is invoked based on security policy instructions, and the boundary protection devices in the syntax rule library are reconstructed into executable adaptation instructions according to the device-specific syntax. According to the specific requirements of the security policy instructions, the syntax rules related to the boundary protection devices are extracted from the syntax rule library. For each boundary protection device, its device type, model and configuration requirements are analyzed to determine its exclusive syntax format. The extracted syntax rules are converted and reconstructed according to the device-specific syntax to generate executable adaptation instructions for each boundary protection device.

[0122] Furthermore, the routing tables of the core routing nodes are updated based on the adaptation instructions to obtain the routing health baseline of the communication network. The generated adaptation instructions are applied to the core routing nodes and sent to each core routing node through the network management protocol. After receiving the adaptation instructions, the core routing nodes parse the instruction content and update their own routing tables accordingly. After completing the routing table update, a comprehensive check is performed on the operating status of the core routing nodes, and various performance indicators and operating parameters after the routing table update are collected. These indicators and parameters are integrated and analyzed to form the routing health baseline of the communication network.

[0123] Furthermore, the adaptation instructions and the routing health baseline are jointly verified to obtain the network synchronization status of the communication network. The expected execution effect of the adaptation instructions is compared with the routing health baseline to check whether the updated routing table meets the requirements of the adaptation instructions. The various indicators in the routing health baseline are analyzed to see if they are within the normal range. The impact of the adaptation instructions on the communication network is assessed to see if it meets expectations. Through the joint analysis of the adaptation instructions and the routing health baseline, it is determined whether the devices and links in the communication network have achieved synchronous adjustment, and finally the network synchronization status of the communication network is obtained.

[0124] Specifically, traffic along the entire path is collected based on network synchronization status, and the traffic is aggregated into a real-time security indicator set for the communication network. The network path for which traffic needs to be collected is determined based on the network synchronization status, and traffic collectors are deployed at key nodes of each path. All data packets on the path are captured in real time by the traffic collectors. The captured data packets are parsed and analyzed to extract security-related information, including traffic size, transmission rate, number of connections, protocol type, etc. The extracted security information is organized and summarized according to preset classification rules to form a real-time security indicator set for the communication network.

[0125] Furthermore, the control plane of the communication network is compared based on the real-time security indicator set to obtain the policy execution deviation data of the control plane. Each indicator in the real-time security indicator set is compared with the pre-configured security policy in the control plane to check whether the actual traffic situation meets the policy requirements. For each comparison result, the difference between the actual indicator and the expected value of the policy is calculated. All difference data are collected and organized to form the policy execution deviation data of the control plane.

[0126] Furthermore, a security assessment is conducted on the policy execution deviation data to obtain the protection verification results of the communication network. A comprehensive analysis of the policy execution deviation data is performed to assess the impact of each deviation on the security of the communication network. The deviations are classified and prioritized according to their impact. For high-priority deviations, their causes and potential security risks are further analyzed. Combining the security requirements and risk tolerance of the communication network, the overall protection effect is comprehensively evaluated, and the protection verification results of the communication network are finally obtained.

[0127] Specifically, a dynamic security threshold is calculated based on the current network situation level and policy priority coefficient. According to the pre-set network situation assessment standard, the current network situation level is determined and mapped to the corresponding security threshold adjustment range. At the same time, the previously calculated policy priority coefficient is obtained, and its influence weight on the security threshold is determined according to the magnitude of the policy priority coefficient. Combining the adjustment range corresponding to the network situation level and the influence weight of the policy priority coefficient, the basic security threshold is adjusted accordingly to obtain the dynamic security threshold.

[0128] Furthermore, the policy execution deviation data and dynamic security thresholds are weighted and aggregated to obtain the security posture index of the communication network. For each deviation in the policy execution deviation data, the importance of the corresponding security policy is analyzed, and a corresponding weight is assigned to each deviation. Each deviation value is compared with the dynamic security threshold to calculate the degree of deviation of each deviation. The degree of deviation of each deviation is weighted and summed according to the assigned weights. The result of the weighted summation is normalized to obtain the security posture index of the communication network.

[0129] Furthermore, based on the security situation indicators, the protection verification results of the communication network are derived. The security situation indicators are compared with the pre-set protection effect evaluation standards. The current protection status level of the communication network is determined according to the comparison results. The distribution and changing trend of various deviations in the security situation indicators are analyzed. The evolution of the security risks of the communication network is assessed. Combining the protection status level and the evolution of security risks, the protection verification results of the communication network are comprehensively judged to determine whether the protection measures are effective and whether further adjustments to the security strategy are needed.

[0130] Specifically, the baseline threshold is a fixed threshold pre-set based on historical security operation data of the communication network and industry security standards; the priority sensitivity factor is a fixed value pre-determined based on the importance of policy priority to the security threshold by analyzing the historical policy execution effects; the policy priority coefficient is the result obtained after weighting the network resource status based on policy constraints; the priority baseline value is a standard value pre-set based on a large amount of historical normal policy priority data to measure the level of the policy priority coefficient; the situational decay coefficient is a fixed value pre-set based on the degree of decay of the network situational level to the security threshold by analyzing the correlation between historical network situational changes and security threshold adjustments; the current network situational level is the level determined by real-time assessment of the current network traffic, load, threat situation, etc.; and the baseline situational level is a standard level pre-set based on historical normal network situational data to measure the level of the current network situation.

[0131] Furthermore, the significance of this formula is that, based on the baseline threshold, the baseline threshold is positively adjusted by combining the comparison results of the policy priority coefficient and the priority baseline value, and the baseline threshold is negatively adjusted by combining the comparison results of the current network situation level and the baseline situation level, so as to finally obtain a dynamic security threshold that can adapt to the current policy importance and network situation.

[0132] Furthermore, when the policy priority coefficient is higher than the priority benchmark value and increases, the dynamic security threshold rises, and the higher the priority sensitivity factor, the more significant the rise; when the policy priority coefficient is lower than the priority benchmark value and decreases, the dynamic security threshold falls, and the higher the priority sensitivity factor, the more significant the fall; when the current network situation level is higher than the benchmark situation level and increases, the dynamic security threshold falls, and the higher the situation attenuation coefficient, the more significant the fall; when the current network situation level is lower than the benchmark situation level and decreases, the dynamic security threshold rises, and the higher the situation attenuation coefficient, the more significant the rise; when the policy priority coefficient is equal to the priority benchmark value and the current network situation level is equal to the benchmark situation level, the dynamic security threshold is equal to the benchmark threshold.

[0133] In summary, by using a security policy instruction call syntax rule library and reconstructing border protection devices into executable adaptation instructions according to device-specific syntax, it is possible to ensure that security policy instructions match the operating syntax of different types and models of border protection devices. This avoids the problem of devices being unable to execute policy instructions due to syntax incompatibility, allowing each border protection device to accurately understand and execute the corresponding security policy. This provides device-level execution assurance for network automation management and improves the efficiency of policy instructions being implemented on the device side.

[0134] In summary, by collecting traffic along the entire path based on network synchronization status and aggregating it into a real-time security indicator set, the traffic characteristics of each path in the communication network can be comprehensively captured. This includes key information such as the source node, destination node, transmission rate, and data volume of data transmission, ensuring that the real-time security indicator set fully reflects the real-time operating status of the network. This provides comprehensive and accurate basic data for automated network management, avoids omissions in security assessments due to incomplete traffic collection, and improves the coverage of security monitoring.

[0135] In summary, by comparing the control plane of the communication network with the real-time security indicator set to obtain policy execution deviation data, the actual network control state can be compared with the expected state required by the security policy instructions, and deviations in the control plane during policy execution can be accurately identified.

[0136] In summary, security assessments of policy execution deviation data yield protection verification results. By combining the severity, scope of impact, and potential risks of the deviation data, it is possible to determine whether the actual protection effect of security policy instructions in the communication network has met expectations, and to ascertain the effectiveness of current protection measures. This provides a basis for decision-making in the network automated management system. If the verification results fail, further policy adjustments can be triggered to ensure that the network is always in an effective security protection state, thereby improving the closed-loop control capability of network security management.

[0137] In summary, updating the routing tables of core routing nodes based on adaptation instructions yields the routing health baseline of the communication network. Updating the routing tables optimizes the packet forwarding paths of core routing nodes, ensuring that data transmission follows the routes specified by the security policy. Simultaneously, collecting node operation metrics after the routing table update forms a health baseline, providing a clear reference standard for subsequent verification. This enables the network automation management system to monitor the secure operation status of core routing nodes in real time, ensuring the stability and security of network data transmission.

[0138] In summary, by co-verifying the adaptation instructions and the routing health baseline, the network synchronization status of the communication network can be obtained. By comparing the expected execution effect of the adaptation instructions with the actual indicators of the routing health baseline, it can be confirmed whether each device and node has achieved synchronization adjustment according to the security policy instructions, and timely detection of non-synchronization or synchronization anomalies can be achieved. This allows the network automation management system to accurately grasp the consistency of policy execution across the entire network, ensuring that security policies are uniformly and effectively implemented throughout the network, and improving the overall integrity and coordination of network security management.

[0139] In summary, calculating dynamic security thresholds based on the current network status level and policy priority coefficients allows the security thresholds to be dynamically adjusted according to the actual network state. When the network status level or policy priority coefficients change, the thresholds will change accordingly, avoiding judgment biases caused by fixed thresholds when the network state fluctuates. This ensures that the thresholds always match the real-time security needs of the network, providing a realistic judgment standard for automated network management and improving the accuracy of security assessments.

[0140] In summary, a security posture index is obtained by weighting and aggregating policy execution deviation data with dynamic security thresholds. Appropriate weights can be assigned according to the degree of impact of different deviation data on network security. By comprehensively considering the actual impact of various deviations, scattered deviation information is integrated into an index that can comprehensively reflect the network security status. This avoids the one-sidedness of assessment caused by single deviation data, allowing the network automated management system to intuitively grasp the overall security posture through this index and improve the comprehensiveness of security assessment.

[0141] In summary, deriving protection verification results based on security posture indicators can transform abstract security posture indicators into explicit verification results, clearly determine whether the actual protection effect of security strategies has met expectations, provide direct decision-making basis for network automation management, enable the system to automatically complete the verification of protection effects without manual intervention, ensure timely detection of protection vulnerabilities and trigger subsequent adjustments, and improve the automated response efficiency and closed-loop control capability of network security management.

[0142] The deployment target node module 105 is used to deploy the protection verification result to the target node of the communication network when the protection verification result is passed.

[0143] In this embodiment of the invention, when the deployment target node module executes the function of deploying the protection verification result to the target node of the communication network when the protection verification result is passed, it is specifically used for:

[0144] Based on the protection verification results, the node deployment strategies in the strategy library are filtered to obtain the target deployment strategy for the communication network;

[0145] Based on the target deployment strategy, the target nodes are matched and compiled to obtain the node deployment instructions of the communication network;

[0146] The node deployment command is deployed to the target node of the communication network.

[0147] When performing protection verification, the deployment target node module is specifically used for:

[0148] Based on the policy deployment status, the node traffic features are recaptured to obtain the node behavior feature set of the communication network;

[0149] The protection effectiveness is analyzed by analyzing the node behavior feature set to obtain the real-time protection effectiveness index of the communication network;

[0150] When the real-time protection effectiveness index continuously meets the expected protection characteristics, a node protection effectiveness confirmation signal for the communication network is obtained.

[0151] Specifically, based on the protection verification results, all node deployment policies corresponding to the pass status are extracted from the policy library. The applicable scenarios and deployment conditions of these policies are checked, and policies that completely match the current communication network environment, target node type and protection verification results are selected. The selected policies are then determined as the target deployment policies for the communication network.

[0152] Furthermore, based on the deployment requirements specified in the target deployment strategy and the hardware parameters and operating system type of the target node, a corresponding compiler is selected to compile the target deployment strategy. During the compilation process, it is ensured that the strategy content is compatible with the running environment of the target node, and instructions that can be directly executed on the target node are generated. These instructions are then identified as the node deployment instructions for the communication network.

[0153] Furthermore, the node deployment command is sent to the target node through the management interface of the communication network. After receiving the command, the target node performs an integrity verification to confirm that the command has not been tampered with and conforms to its own execution format. After the verification is passed, the target node executes the corresponding deployment operation according to the command content, thus completing the deployment of the node deployment command on the target node of the communication network.

[0154] Specifically, based on the policy deployment status, node traffic features are recaptured to obtain a node behavior feature set of the communication network. The target nodes that need to be recaptured are determined according to the policy deployment status. A traffic collector is deployed at the network interface of each target node. The inbound and outbound traffic of the node is captured in real time through the traffic collector. The captured traffic is deeply analyzed, and all extracted feature information is sorted and classified to form a node behavior feature set of the communication network.

[0155] Furthermore, a protection effectiveness analysis is performed on the node behavior feature set to obtain the real-time protection effectiveness index of the communication network. Each feature in the node behavior feature set is compared with the expected protection features to analyze whether each feature meets the requirements of the security policy. The proportion of nodes that meet the expected protection features to the total number of nodes is calculated, and the occurrence rate and severity of abnormal traffic behavior are evaluated. Taking into account the feature matching degree, the node compliance ratio and the abnormal traffic situation, the real-time protection effectiveness index of the communication network is generated.

[0156] Furthermore, when the real-time protection effectiveness index continuously meets the expected protection characteristics, a node protection effectiveness confirmation signal for the communication network is obtained. A continuous monitoring period is set, and the real-time protection effectiveness index is continuously monitored within this period to check whether the real-time protection effectiveness index at each time point meets the requirements of the expected protection characteristics. If the real-time protection effectiveness index always meets the expected protection characteristics throughout the entire monitoring period, it is determined that the node protection measures have taken effect, and a node protection effectiveness confirmation signal for the communication network is generated.

[0157] In summary, by filtering node deployment strategies in the strategy library based on protection verification results, the target deployment strategy can be obtained. This allows for the precise selection of deployment strategies that match the current protection verification results, ensuring that the selected strategy conforms to the actual security status of the communication network and the characteristics of the target node. It avoids the use of mismatched strategies that could lead to ineffective deployment or introduce new security risks, providing a targeted deployment basis for automated network management and improving the accuracy of node deployment.

[0158] In summary, the target deployment strategy is matched and compiled to obtain node deployment instructions. Based on the specific parameters such as the target node's hardware configuration and operating system type, the target deployment strategy can be converted into an instruction format that the node can directly recognize and execute. This ensures that the instructions are fully compatible with the node's operating environment, avoids deployment failures due to incompatible instruction formats, and allows the network automation management system to successfully implement the strategy to the target node, improving the smoothness of the deployment process.

[0159] In summary, deploying node deployment commands to target nodes in a communication network enables security policies to take effect automatically on those nodes without manual intervention. This reduces errors and delays caused by human intervention, ensures that security measures are quickly applied to target nodes after the protection verification results are passed, and enables the communication network to obtain effective security protection in a timely manner. This improves the response speed and execution efficiency of network automation management and forms a complete security management closed loop.

[0160] In summary, by recapturing node traffic features based on policy deployment status, a node behavior feature set can be obtained. This set can accurately capture the traffic changes of target nodes after policy deployment, covering detailed features such as traffic transmission path, data interaction frequency, and data packet type. It fully records the behavior of nodes under the new policy, providing first-hand data on node status after policy deployment for network automated management. This ensures that node behavior monitoring is thorough and improves the comprehensiveness of protection verification.

[0161] In summary, by analyzing the protective effectiveness of node behavior feature sets, real-time protective effectiveness indicators can be obtained. This allows for a comparison between the actual behavioral characteristics of nodes and the expected protective effects of the strategy, thus quantitatively evaluating the actual protective effect of the strategy on nodes.

[0162] In summary, a node protection effectiveness confirmation signal is obtained when real-time protection performance indicators consistently meet the expected protection characteristics. This ensures the stability of protection effectiveness through continuous monitoring, avoids misjudgments caused by temporary compliance, and confirms protection effectiveness only when indicators consistently meet expectations. This provides a reliable basis for network automation management, ensures that policies truly play a role on target nodes, and provides a clear reference for subsequent network security status maintenance and policy optimization, thereby improving the closed-loop reliability of network security management.

[0163] It will be apparent to those skilled in the art that the present invention is not limited to the details of the exemplary embodiments described above, and that the present invention can be implemented in other specific forms without departing from the spirit or essential characteristics of the present invention.

[0164] The embodiments of this application can acquire and process relevant data based on artificial intelligence technology. Artificial intelligence is the theory, method, technology, and application system that uses digital computers or machines controlled by digital computers to simulate, extend, and expand human intelligence, perceive the environment, acquire knowledge, and use that knowledge to obtain optimal results.

[0165] Finally, it should be noted that the above embodiments are only used to illustrate the technical solutions of the present invention and are not intended to limit it. Although the present invention has been described in detail with reference to preferred embodiments, those skilled in the art should understand that modifications or equivalent substitutions can be made to the technical solutions of the present invention without departing from the spirit and scope of the technical solutions of the present invention.

Claims

1. A network automation management system based on dynamic network security, characterized in that, The system includes a behavioral feature fingerprint acquisition module, a security threat identification module, a security policy instruction generation module, a protection verification result acquisition module, and a target node deployment module. in: The behavioral feature fingerprint acquisition module is used to match the original communication feature set with the preset behavioral feature library in real time, and use the matching result as the behavioral feature fingerprint of the communication network. A security threat identification module is used to identify abnormal communication from the behavioral feature fingerprint to obtain a security threat identifier for the communication network. A security policy instruction generation module is used to extract policy constraints from the security threat identifier and generate security policy instructions for the communication network based on the policy constraints, including: Based on the aforementioned policy constraints, weights are allocated to network resource states, and policy priority coefficients are calculated. The formula for calculating the policy priority coefficients is as follows: In the formula, This is the strategy priority coefficient. For the first Class constraint values, For the first Class resource weighting factor For real-time timestamps, For real-time resource load, As the baseline load, Policy constraint categories, Maximum value To constrain the total number of categories; The adjustment instructions in the policy library are dynamically selected based on the policy priority coefficient to obtain the initial policy instructions for the communication network. Based on the full compliance of the network, the initial policy instructions are adjusted for compliance to obtain the security policy instructions for the communication network; The protection verification result acquisition module is used to synchronously adjust the communication network based on the security policy instructions, and compare the feedback data of the synchronously adjusted communication network with the expected security threshold to obtain the protection verification result of the communication network, including: Based on the network synchronization status, the traffic along the entire path is collected, and the traffic is aggregated into a real-time security indicator set for the communication network. The control plane of the communication network is compared based on the real-time security indicator set to obtain the policy execution deviation data of the control plane; A security assessment is performed on the policy execution deviation data to obtain the protection verification results of the communication network, including: The dynamic security threshold is calculated based on the current network status level and policy priority coefficient, wherein the formula for calculating the dynamic security threshold is: In the formula, For dynamic security thresholds, As the baseline threshold, As a priority sensitive factor, This is the strategy priority coefficient. As the priority baseline value, This is the situation decay coefficient. The current network situation level, As the baseline situation level; The security posture index of the communication network is obtained by weighting and aggregating the policy execution deviation data with the dynamic security threshold. The protection verification results of the communication network are derived based on the security situation indicators. The target node deployment module is used to deploy the protection verification result to the target node of the communication network when the protection verification result is passed.

2. The network automation management system based on dynamic network security as described in claim 1, characterized in that, When the behavioral feature fingerprint acquisition module performs real-time matching of the original communication feature set with a preset behavioral feature library and uses the matching result as the behavioral feature fingerprint of the communication network, it is specifically used for: The original communication feature set is compared with the protocol layer feature library to obtain the protocol feature matching degree of the communication network. The protocol feature matching degree is matched with the traffic pattern feature library to obtain the traffic behavior matching degree of the communication network. The protocol feature matching degree and the traffic behavior matching degree are normalized to obtain the behavioral feature fingerprint of the communication network.

3. The network automation management system based on dynamic network security as described in claim 1, characterized in that, When the security threat identification module performs abnormal communication identification on the behavioral feature fingerprint to obtain the security threat identifier of the communication network, it is specifically used for: The behavioral feature fingerprint is compared with the historical threat feature database to obtain the primary threat identifier of the communication network. Based on the primary threat identifier, feature mapping is performed on the real-time communication link to obtain the link threat fingerprint of the real-time communication link; The primary threat identifier and the link threat fingerprint are aggregated to obtain the security threat identifier of the communication network.

4. A network automation management system based on dynamic network security as described in claim 1, characterized in that, When the security policy instruction generation module executes the policy constraints for extracting the security threat identifier and generates security policy instructions for the communication network based on the policy constraints, it is specifically used for: The core constraint elements are mapped to the network topology to obtain the constraint scope of the communication network; The core constraint elements and the constraint scope are encapsulated to obtain the policy constraints of the communication network; Based on the policy constraints, the communication network is transformed into a rule-based system to obtain the security policy instructions for the communication network.

5. A network automation management system based on dynamic network security as described in claim 1, characterized in that, When the protection verification result acquisition module executes the synchronous adjustment of the communication network based on the security policy instruction, it is specifically used for: The security policy instructions call the syntax rule library, and the boundary protection devices in the syntax rule library are reconstructed into executable adaptation instructions according to the device-specific syntax. The routing table of the core routing node is updated based on the adaptation instructions to obtain the routing health baseline of the communication network. The adaptation command and the routing health baseline are jointly verified to obtain the network synchronization status of the communication network.

6. A network automation management system based on dynamic network security as described in claim 1, characterized in that, When the deployment target node module executes the function of deploying the protection verification result to the target node of the communication network when the protection verification result is passed, it specifically performs the following: Based on the protection verification results, the node deployment strategies in the strategy library are filtered to obtain the target deployment strategy for the communication network; Based on the target deployment strategy, the target nodes are matched and compiled to obtain the node deployment instructions of the communication network; The node deployment command is deployed to the target node of the communication network.

7. A network automation management system based on dynamic network security as described in claim 1, characterized in that, When performing protection verification, the deployment target node module is specifically used for: Based on the policy deployment status, the node traffic features are recaptured to obtain the node behavior feature set of the communication network; The protection effectiveness is analyzed by analyzing the node behavior feature set to obtain the real-time protection effectiveness index of the communication network; When the real-time protection effectiveness index continuously meets the expected protection characteristics, a node protection effectiveness confirmation signal for the communication network is obtained.

Images