A method, device and medium for generating access control policies

Abstract

This invention discloses an access control policy generation method, device, and medium, relating to the field of computer technology. The method includes: acquiring raw data packets, identifying their corresponding protocols, and distributing them to appropriate parsers based on protocol type, enabling the parsers to parse the data and obtain standardized events; collecting multi-source raw logs from various nodes, parsing and extracting log metadata, combining the metadata with the corresponding log content for rule matching and structuring; collecting hardware health indicators and monitoring service response status, summarizing the data and performing comprehensive indicator analysis to filter and classify status events; and after cleaning, compression, and authentication, associating and fusing the cleaned and compressed data to generate access control policies. This approach constructs a three-dimensional cross-validation system for security events from the network, host, and application perspectives, reducing false positives and false negatives, providing a reliable basis for policy generation, improving policy generation efficiency, and enhancing the accuracy and efficiency of system security protection.

Description

Technical Field

[0001] This invention relates to the field of computer technology, and in particular to an access control policy generation method, device, and medium. Background Technology

[0002] With the advancement of digital transformation, traditional closed networks such as rail transit networks and industrial control networks are rapidly merging with information technology networks, leading to increasingly severe cybersecurity threats. Attacks targeting industrial control systems can cause serious physical damage and economic losses. Traditional security protection equipment typically consists of industrial firewalls and intrusion detection systems. These devices are mostly deployed at network boundaries or critical network segments, capturing network traffic and filtering it according to predefined rule bases. Traffic matching the rules is alerted or blocked, and these rules are mainly based on general network characteristics and a limited number of known attack signatures. However, these traditional security devices cannot deeply analyze the message content of the numerous industrial protocols in rail transit networks, making it difficult to distinguish between legitimate control commands and illegal malicious operations. In particular, they cannot identify attacks targeting the protocol's business logic layer, resulting in a large number of specific attacks going undetected. Furthermore, they may misjudge normal, complex industrial communications as threats. Summary of the Invention

[0003] The purpose of this invention is to provide an access control policy generation method, device, and medium that can reduce false alarms and missed alarms, provide a reliable basis for policy generation, improve policy generation efficiency, and enhance the accuracy and efficiency of system security protection.

[0004] To address the aforementioned technical problems, this invention provides an access control policy generation method, comprising: The process involves acquiring raw data packets, identifying the protocol corresponding to the raw data packets, and distributing the raw data packets to suitable parsers based on the protocol type. This allows the parsers to parse the data according to the corresponding protocol specifications, extract structured feature data, and convert it into standardized events. Collect raw logs from multiple sources at each node, parse and extract log metadata, and combine the metadata with the corresponding log content to perform rule matching processing, transforming unstructured logs into structured log data in a unified format; Collect hardware health indicators and monitor service response status. After summarizing the data, perform comprehensive indicator analysis and processing, and filter and classify status events from the processing results. The standardized events, structured log data, and status events are cleaned and compressed accordingly. After authentication, the cleaned and compressed data are correlated and merged to generate an access control policy.

[0005] To address the aforementioned technical problems, the present invention also provides an electronic device, comprising: Memory, used to store computer programs; A processor is used to implement the steps of the access control policy generation method described above when executing the computer program.

[0006] To address the aforementioned technical problems, the present invention also provides a computer-readable storage medium storing a computer program, which, when executed by a processor, implements the steps of the access control policy generation method described above.

[0007] As can be seen from the above technical solution, the access control policy generation method provided by the present invention includes: acquiring raw data packets, identifying the protocol corresponding to the raw data packets, distributing the raw data packets to an appropriate parser according to the protocol type, so that the parser can parse the data according to the corresponding protocol specifications, extract structured feature data and convert it into standardized events; collecting multi-source raw logs from each node, parsing and extracting log metadata, combining the metadata with the corresponding log content to perform rule matching processing, and converting unstructured logs into structured log data in a unified format; collecting hardware health indicators and monitoring service response status, summarizing the data and performing comprehensive indicator analysis processing, and filtering and classifying status events from the processing results; cleaning and compressing the standardized events, structured log data and status events, and after authentication, associating and fusing the cleaned and compressed data to generate an access control policy.

[0008] The beneficial effects of this invention are as follows: The access control policy generation method provided by this invention achieves end-to-end processing of three core data types—network traffic, system logs, and device status—by performing protocol identification and deep parsing of raw network data packets, collecting and structuring multi-source node logs, and monitoring and analyzing hardware and service status. After data cleaning, compression, security authentication, and correlation fusion, a precise access control policy is finally generated. This breaks down the "data silos" between network traffic, logs, and device status, allowing multi-source data to be efficiently fused through standardized processing and correlation analysis, providing comprehensive data support for security analysis. Furthermore, it constructs a cross-validation mechanism for security events from three dimensions: network, host (hardware and system logs), and application (service response status), significantly reducing false positives and false negatives caused by a single data source. In addition, the standardization and precise parsing of data throughout the entire process not only provides a reliable basis for access control policy generation but also lays the foundation for subsequent security risk assessment and event tracing. Ultimately, it constructs a closed-loop protection system covering data collection, processing, analysis, and policy implementation, solving the problem of low policy generation efficiency in traditional network security systems and improving the accuracy and efficiency of system security protection.

[0009] In addition, the present invention also provides a corresponding electronic device and computer-readable storage medium for the access control policy generation method, which have the same or corresponding technical features as the access control policy generation method mentioned above, and have the same effect. Attached Figure Description

[0010] To more clearly illustrate the embodiments of the present invention, the accompanying drawings used in the embodiments will be briefly introduced below. Obviously, the drawings described below are only some embodiments of the present invention. For those skilled in the art, other drawings can be obtained based on these drawings without creative effort.

[0011] Figure 1 A flowchart of an access control policy generation method provided in an embodiment of the present invention; Figure 2 This is a schematic diagram illustrating the process of converting raw data packets into standardized events, provided as an embodiment of the present invention. Figure 3 A schematic diagram of the protocol identification and distribution stage provided in an embodiment of the present invention; Figure 4 This is a schematic diagram of the internal workflow of each parser provided in an embodiment of the present invention; Figure 5 This is a flowchart illustrating the context association and semantic enhancement processing provided in an embodiment of the present invention; Figure 6 This is a schematic diagram of the data formatting and push processing provided in an embodiment of the present invention; Figure 7 This is a schematic diagram of the log data collection and preprocessing process provided in an embodiment of the present invention. Detailed Implementation

[0012] The technical solutions of the embodiments of the present invention will be clearly and completely described below with reference to the accompanying drawings. Obviously, the described embodiments are only some embodiments of the present invention, and not all embodiments. Based on the embodiments of the present invention, all other embodiments obtained by those of ordinary skill in the art without creative effort are within the protection scope of the present invention.

[0013] It should be noted that, in the description of this invention, the terms "comprising," "including," or any other variations thereof are intended to cover non-exclusive inclusion, such that a process, method, article, or apparatus that comprises a list of elements includes not only those elements but also other elements not expressly listed, or elements inherent to such a process, method, article, or apparatus. The terms "first," "second," etc., used in this invention are used to distinguish similar objects and are not used to describe a specific order or sequence.

[0014] To enable those skilled in the art to better understand the present invention, the present invention will be further described in detail below with reference to the accompanying drawings and specific embodiments.

[0015] The specific application environment architecture or specific hardware architecture on which the execution of the access control policy generation method depends is described here.

[0016] The embodiments of the present invention provide an access control policy generation method, and the method is described in detail in conjunction with the execution flow of the access control policy generation method. Figure 1 A flowchart of the access control policy generation method provided in the embodiments of the present invention is shown below. Figure 1 As shown, the method includes: S101. Obtain the original data packet, identify the protocol corresponding to the original data packet, and distribute the original data packet to the appropriate parser according to the protocol type, so that the parser can parse the data according to the corresponding protocol specification, extract structured feature data and convert it into standardized events.

[0017] It should be noted that step S101 is the network data processing stage, which enables the structuring and standardization of raw traffic. This invention first identifies the protocol type, ensuring the specificity of subsequent parsing. Different protocols (such as Modbus, TCP / IP, etc.) have significantly different formats and characteristics; adapting to the corresponding parser can accurately extract key information (such as function codes, IP addresses, ports, etc.), avoiding information omissions or misjudgments caused by general parsing. Finally, the data is transformed into standardized events, providing a unified benchmark for subsequent multi-source data association and fusion (such as matching with logs and device status data).

[0018] S102. Collect multi-source raw logs from each node, parse and extract log metadata, and combine the metadata with the corresponding log content to perform rule matching processing, transforming unstructured logs into structured log data in a unified format.

[0019] In implementation, step S102 is the process of standardizing log data, which can solve the heterogeneity problem of unstructured logs. This invention provides basic location information for log content by parsing and extracting metadata (such as timestamps, device identifiers, etc.); then, by combining the metadata with the log text through rule matching, it can accurately filter effective information (such as filtering redundant fields and identifying key event features), and transform scattered unstructured text (such as log format differences between different nodes) into structured data in a unified format. This processing not only eliminates the format barriers of log data, but also enables it to be correlated and analyzed with other data sources such as network traffic and device status.

[0020] S103. Collect hardware health indicators and monitor service response status. After summarizing the data, perform comprehensive indicator analysis and processing, and filter and classify status events from the processing results.

[0021] It is worth noting that step S103, system status perception and risk warning, can build a comprehensive status monitoring closed loop from hardware to the service layer. Collecting hardware health indicators (such as CPU load and device temperature) allows for real-time monitoring of the hardware's stability, while monitoring service response status (such as response latency and availability) directly reflects the operational quality at the business level. After aggregating the data and conducting comprehensive analysis, it is possible to establish causal relationships between hardware anomalies and service failures (such as hardware overload causing service delays) and to filter and categorize key status events (such as hardware warning events and service unavailability events) from massive amounts of data. This not only provides core evidence for subsequent multi-source data fusion regarding the system's operational status but also lays the foundation for early identification of potential risks and pinpointing the root causes of failures.

[0022] In addition, steps S101 to S103 can all be executed by the data acquisition layer, which is responsible for comprehensively collecting security element data from three dimensions: network, host (hardware and system logs), and application (service response status).

[0023] S104. Clean and compress standardized events, structured log data, and status events. After authentication, the cleaned and compressed data are correlated and merged to generate access control policies.

[0024] It should be noted that step S104 is the transformation step from multi-source data to the implementation of security policies. Essentially, it achieves precise protection through data governance and fusion, and can be executed by the data processing layer. Data cleaning filters out invalid information (such as redundant logs and outliers), and compression reduces storage and computational pressure, clearing away interference for subsequent fusion. The authentication process ensures the security of data transmission and processing, avoiding the risk of tampering or leakage. Based on this, the association and fusion of three types of standardized data (standardized events in the traffic dimension, structured data in the log dimension, and status events in the status dimension) breaks the limitations of a single data source (such as matching log anomalies with device status anomalies using traffic events). The resulting access control policies are more comprehensive and targeted, truly realizing the implementation from decentralized monitoring to coordinated protection, and improving the accuracy and execution efficiency of security policies.

[0025] The access control policy generation method provided in this embodiment of the invention achieves end-to-end processing of three core data types—network traffic, system logs, and device status—by performing protocol identification and deep parsing of raw network data packets, collecting and structuring multi-source node logs, and monitoring and analyzing hardware and service status. After data cleaning, compression, security authentication, and correlation fusion, a precise access control policy is finally generated. This breaks down the "data silos" between network traffic, logs, and device status, allowing multi-source data to be efficiently fused through standardized processing and correlation analysis, providing comprehensive data support for security analysis. Furthermore, it constructs a cross-validation mechanism for security events from three dimensions: network, host, and application, significantly reducing false positives and false negatives caused by a single data source. In addition, the standardization and precise parsing of data throughout the process not only provides a reliable basis for access control policy generation but also lays the foundation for subsequent security risk assessment and event tracing. Ultimately, it constructs a closed-loop protection system covering data collection, processing, analysis, and policy implementation, solving the problem of low policy generation efficiency in traditional network security systems and improving the accuracy and efficiency of system security protection.

[0026] Furthermore, in a specific implementation, in the access control policy generation method provided in the embodiments of the present invention, step S101 acquires the original data packet, identifies the protocol corresponding to the original data packet, and distributes the original data packet to the appropriate parser according to the protocol type, so that the parser can parse the data according to the corresponding protocol specification, extract structured feature data and convert it into standardized events. Specifically, this may include: capturing the original data packet flowing through the firewall and switching node at the network interface card level; identifying the protocol corresponding to the original data packet based on port and deep packet inspection methods, distributing the original data packet to the appropriate parser according to the identified protocol type; using the parser to parse the received data packet according to the standard specification of the corresponding protocol, extracting key message feature fields, and converting the extracted key message feature fields into structured feature data; assembling the structured feature data into standardized events of a set format and sending them to the data processing layer.

[0027] Figure 2 This is a flowchart illustrating the process of converting raw data packets into standardized events, as provided in an embodiment of the present invention. In implementation, such as... Figure 2As shown, this invention can capture all raw data packets flowing through firewalls and core switching nodes in real time using a network interface card (NIC) level traffic capture method, employing network packet capture libraries such as libpcap or WinPcap, ensuring no traffic is missed. Subsequently, the built-in powerful protocol recognition engine comes into play, capable of recognizing not only conventional network protocols (such as TCP / IP) but also accurately identifying train network-specific protocols and various general (non-industrial) and industrial protocols (such as Modbus, IEC 104 / IEC 60870-5-104, FINS, BACnet, DNP3, OPC, S7, TRDP, etc.) based on port and deep packet inspection (DPI) methods. Next, a dedicated parser is provided for each protocol, performing byte-by-byte deep parsing according to its RFC or industry standard specifications to extract key message feature fields. For example, for Modbus TCP, the parser identifies the transport layer protocol (TCP / UDP), destination port (e.g., port 502), transaction identifier, protocol identifier, length, unit identifier (slave ID), function code (e.g., read coil, write register), starting address, and read length / data value. It can monitor the range of written data values ​​(minimum and maximum values) and perform validity checks on slave IDs (minimum and maximum values). For IEC 104, it parses the start byte (APDU) length, control field (frame format), type identifier (function code), transmission reason, common address, data body address, and value field of information elements, and supports setting ranges for addresses and value fields and providing out-of-bounds alarms. For FINS, it parses header information, including source / destination network number, node number, unit number, command code, data space type (CIO, DM area, etc.), start address, and end address, enabling fine-grained read / write monitoring of OMRON PLCs. For other protocols, such as BACnet, it parses APDU types and service selectors; TRDP, it parses ComID and data length; and S7, it parses ROSCTR types, function group codes, function codes, and data area pointers. For common protocols such as HTTP / FTP / TELNET, it not only parses the IP 5-tuple but also deeply parses application layer content, such as URLs, HTTP methods, FTP / TELNET commands, and accounts, comprehensively covering both IT and OT environments. Finally, the parsed structured feature data is assembled into a standardized event format (such as JSON or Protocol Buffers) and sent to the data processing layer. Table 1 below details the system's parsing capabilities for various protocols.

[0028] Table 1. System's ability to parse various protocols

[0029] The output of this module provides the most core and granular data foundation for subsequent security analysis, behavior modeling, real-time alerts, and finally one-click policy generation.

[0030] Furthermore, in specific implementation, in the above steps, the protocol corresponding to the original data packet is identified based on port and deep packet inspection. According to the identified protocol type, the original data packet is distributed to the appropriate parser. Specifically, this may include: parsing the Ethernet frame header of the original data packet to determine the upper-layer protocol type; distributing the remaining data in the original data packet (excluding the Ethernet frame header) to the corresponding network layer parser based on the upper-layer protocol type; using the network layer parser to parse network layer and transport layer information to obtain network address and port information; making a preliminary determination of the application layer protocol type based on the network address and port information, using the target port or source port; based on the determination result, performing feature value matching on the set identifier or fixed string of the data payload using deep packet inspection to identify the protocol; and after successful identification, distributing the payload portion of the current data to the corresponding application layer protocol parser.

[0031] Figure 3 This is a flowchart illustrating the protocol identification and distribution phase provided in an embodiment of the present invention. In implementation, as... Figure 3 As shown, the protocol identification and distribution phase process is as follows: Taking the complete Ethernet frame raw data packet delivered by the upstream traffic capture module as input, the Ethernet frame header is first parsed to obtain the upper-layer protocol type (such as IPv4, IPv6, ARP, etc.), and the data packet is distributed to the corresponding network layer parser; after completing the network layer and transport layer parsing (such as parsing the IP address and port), a multi-mode matching strategy is used to identify the application layer protocol, including port matching based on the target port / source port (such as TCP / 502 corresponding to Modbus TCP), feature value matching by checking the specific "magic number" or fixed string of the payload (such as TRDP identified by Ethernet type 0x8888, BACnet identified by the 0x81 identifier), and dynamic session tracking for complex stateful protocols (such as FTP, SIP) by maintaining the session table for dynamic identification; if the identification is successful, the data packet payload is distributed to the corresponding dedicated application layer protocol parser, and if the identification fails, it is handed over to the default general parser or directly discarded.

[0032] Furthermore, in specific implementation, in the above steps, the parser is used to parse the received data packets according to the standard specifications of the corresponding protocol, extract key message feature fields, and convert the extracted key message feature fields into structured feature data. Specifically, this may include: using an application layer protocol parser to perform length verification and integrity checks on the received payload data; if the check fails, invalid messages are discarded and recorded; if the check passes, layered parsing and frame parsing are performed, and the protocol type is determined based on the parsed content to distinguish different protocol types; for layered protocols, the headers of each layer are stripped sequentially to obtain application layer data units; for protocols with framing mechanisms, the data units are segmented according to the length field to obtain application layer data units; after obtaining the application layer data units, key message feature fields are extracted; logical verification and context association are performed on the key message feature fields; if the verification fails, the data is marked as an abnormal message and the corresponding abnormal event is output; if the verification passes, the key message feature fields are assembled into structured feature data.

[0033] Figure 4 This is a schematic diagram illustrating the internal workflow of each parser provided in an embodiment of the present invention. In implementation, as... Figure 4 As shown, the internal workflow of each parser can be broken down into the following steps: First, the input protocol payload undergoes length and integrity checks, i.e., the message length is checked to see if it conforms to the minimum length declared in the protocol header, and CRC, checksum, and other fields are verified. If the checks fail, invalid or incomplete messages are discarded. After the checks pass, layered / framing parsing is performed. For protocols with explicit layers (such as Modbus TCP), the headers of each layer are stripped in sequence. For protocols with framing mechanisms (such as IEC 104 APCI), complete application layer protocol data units (APDUs) are segmented according to the length field. Next, structured field extraction is performed. According to the protocol's RFC or standard document definition, the message is parsed byte by byte or bit by bit in an offset manner, converting binary values ​​into meaningful fields to complete the semanticization process. Afterward, logical verification and context association are carried out, including the verification of function codes (Unsigned... Value range validation is performed on bytes, type identifiers, etc., to check whether they are within the legal range of the protocol. Context association is also performed on stateful protocols (such as the request-response sequence of DNP3) to match the current message with previous messages to understand the operation semantics. If the validation passes, structured data is generated and standardized events are output. If the validation fails, it is marked as an abnormal message and an abnormal event is output.

[0034] Figure 5 This is a schematic diagram illustrating the context association and semantic enhancement processing provided in an embodiment of the present invention. In implementation, as... Figure 5As shown, in the context association and semantic enhancement stage, the system first receives standardized events from multiple parsers, determines whether the protocol requires session reassembly, and if so, performs session tracking and reassembly, outputting a complete application-layer session; otherwise, it directly proceeds to behavior inference. Subsequently, application behavior inference is performed, parsing application-layer semantics, matching the behavior rule base, and generating standardized behavior descriptions. Finally, metadata enrichment is performed, associating underlying metadata (such as 5-tuples, packet capture timestamps, device information, etc.), combining the parsed application-layer information to form a complete context view, and outputting the final triggered security event. Session reassembly can obtain the complete semantics of application-layer sessions transmitted across multiple packets. Application behavior inference can infer specific application behaviors based on parsed fields, such as inferring "force write coil 0 to ON" from function codes, addresses, and data value combinations, and inferring "send lock command" from HTTP methods, URLs, and request bodies. Metadata enrichment provides comprehensive context support for security event analysis, combining the parsed application-layer information with underlying information (5-tuples, packet capture timestamps, packet size, device information, etc.) to form a complete context view.

[0035] Figure 6 This is a schematic diagram illustrating the data formatting and push processing provided in an embodiment of the present invention. In implementation, as... Figure 6 As shown, in the data formatting and push stage, the system first assembles all the final parsed key fields, metadata, and inferred application behaviors into a structured data object; then, it performs serialization processing on this object, choosing between the easy-to-read and debuggable JSON format or the high-performance, small-size Protocol Buffers binary format (suitable for high-performance production environments); finally, through an efficient event bus (such as Kafka) or message queue, the serialized event messages are pushed to the downstream data storage and analysis module in real time for use in scenarios such as real-time detection, rule generation, and storage.

[0036] Furthermore, in specific implementation, in the access control policy generation method provided in the embodiments of the present invention, step S102 collects multi-source raw logs from each node, parses and extracts log metadata, and performs rule matching processing by combining the metadata with the corresponding log content to convert unstructured logs into structured log data in a unified format. Specifically, this may include: acquiring the raw log streams of each node using at least two collection methods; parsing each log message in the raw log stream to obtain the metadata of the log message; matching the metadata of the log message and the corresponding log content with the set matching conditions of the built-in rule base, and executing the corresponding processing action after successful matching; sequentially performing operations such as discarding redundant logs, extracting key fields and structuring them, adding additional information, and unifying field naming to convert unstructured log text into structured key-value pair data; converting the structured key-value pair data into a unified data exchange format to obtain structured log data and sending it to the data processing layer.

[0037] Figure 7 This is a schematic diagram of the log data collection and preprocessing process provided in an embodiment of the present invention. In implementation, as... Figure 7 As shown, in the log data collection and preprocessing stage, the system adopts a multi-source collection approach. It connects to and collects log data from various nodes, including servers, industrial control computers, and network devices, through the deployment of lightweight agents or tools such as Syslog and SSH. This includes kernel logs, system event logs, and application logs, ensuring the comprehensiveness of log sources. The system then moves to the filtering and formatting stage. A configurable log processing rule chain is designed, which can be built based on regular expressions, Grok patterns, or YAML configurations. This chain can remove redundant information, such as directly filtering debug logs and duplicate logs; it can extract key fields, accurately capturing key information such as timestamps, log levels, source IPs, users, event types, and process IDs; and it can unify the data format, transforming unstructured log text into structured key-value pair data, improving subsequent analysis efficiency.

[0038] The log processing workflow can be divided into three stages. Stage one is multi-source collection, which supports various flexible collection methods to adapt to the environmental differences and resource constraints of different nodes in the train's onboard network, thereby connecting to and collecting various logs from each node. Table 2 below shows the implementation mechanism, use cases, and advantages and disadvantages of different collection methods.

[0039] Table 2 Different data collection methods

[0040] Phase two is filtering and formatting (Processing & Transformation), the core of log processing. Its goal is to transform the messy raw text logs into semantically rich structured data, typically achieved through configurable rule chains or pipelines. Specifically, it first receives log streams from various collection methods, parsing the metadata of each log message, such as the receiving timestamp, source host IP, logging facility, and severity level. Then, it matches the log message's metadata and raw content against conditions in the system's built-in rule base. Rules consist of a match condition and a processing action; a single log may match multiple rules sequentially, and upon successful matching, the corresponding processing action is executed. Key actions can include: Dropping, which involves directly discarding rules matching debug logs or irrelevant heartbeat logs, greatly reducing downstream data processing; Field extraction and structuring (Grok), the most crucial action, using Grok patterns (a high-level regular expression) to extract key fields from unstructured log text; Field enrichment, which adds additional information to the logs, such as adding corresponding device names and device roles (e.g., gateway, brake controller) based on the source IP address; and Normalization, which maps the extracted fields to a unified name, for example, mapping src_ip, clientIP, and source_address to source_ip. Table 3 shows an example table of Grok pattern extraction. The table uses common logs as examples to demonstrate how to extract structured fields from raw text.

[0041] Table 3. Examples of Grok Pattern Extraction

[0042] Phase three is the output. After cleaning, enriching, and structuring, the log events are converted into a unified JSON format and then pushed to the downstream unified data model module and correlation analysis engine through efficient data transmission channels (such as Kafka, RabbitMQ, etc.). They are then integrated and analyzed with network traffic and status monitoring data to ultimately achieve a comprehensive security situation assessment.

[0043] Furthermore, in specific implementation, in the access control policy generation method provided in the embodiments of the present invention, step S103 collects hardware health indicators and monitors service response status, summarizes the data and performs comprehensive indicator analysis processing, and filters and classifies status events from the processing results. Specifically, it may include: calling the operating system interface or out-of-band management protocol to periodically collect the hardware health indicators of the node; when the service process is in the running state, monitoring and measuring the service response time, and judging whether the service is delayed or unavailable based on the measured response time; summarizing the collected hardware health indicators and the judgment results of the service status into target data; performing threshold comparison, trend analysis and state machine judgment processing on the target data; wherein, setting early warning and danger thresholds for each indicator in the target data, generating corresponding warnings or serious events; calculating short-term trends for the time-series indicator data in the target data to obtain prediction results; using a state machine model to judge the process or service status; classifying the processed data into status indicators and status events; storing the status indicators in the database in time-series data format; and pushing status events to the data processing layer through a message queue.

[0044] During implementation, in the system status monitoring stage, hardware status is collected periodically by calling the operating system interface through a proxy or by using out-of-band management protocols. Specifically, key data such as CPU utilization, memory usage, disk I / O, network bandwidth, and temperature are collected to monitor the stability of the hardware operating platform in real time.

[0045] Software runtime status monitoring can be carried out from two dimensions: one is process survival check, which continuously monitors whether critical service processes such as modbusd and apache are running normally by means of heartbeat detection or querying process list, to ensure that core business processes are not interrupted; the other is service response time monitoring, which measures service response time in real time by actively sending probe requests (such as TCP SYN packets, ICMP Echo) to the service listening port, or by simulating application layer handshakes (such as HTTP GET requests), to determine whether there is a delay or unavailability of the service, and to detect software runtime abnormalities in a timely manner.

[0046] The system status data processing flow can be divided into three stages. Stage one is data acquisition, where the acquisition layer actively obtains node health indicator data through various methods. Table 4 below shows the list corresponding to hardware status acquisition. Table 5 below shows the list corresponding to software operation status monitoring.

[0047] Table 4 Hardware Status Acquisition

[0048] Table 5 Software Operation Status Monitoring

[0049] Phase Two is Data Processing & State Determination. The raw collected data needs to be processed to transform it into stateful semantics, which includes three aspects: First, Threshold Comparison, setting warning and critical thresholds for each indicator. For example, a critical event is generated when CPU utilization is >90% for 1 minute; a warning event is generated when memory utilization is >80%. Second, Trend Analysis, performing short-term trend calculations on time-series indicator data to predict potential problems. For example, if disk space utilization has increased by an average of 1% over the past hour, it can predict that the disk will be full within 24 hours and issue an early warning. Third, State Machine Determination, using a state machine model to avoid thrashing for process or service states. For example, a system is judged as "down" only after two consecutive failed detections and as "recovered" only after two consecutive successful detections.

[0050] Phase three is the output. The processed status data is transformed into two types of information output: one is status metrics, where all numerical metrics (such as CPU utilization of 75.5%) are converted into time-series data formats (such as Prometheus format or JSON) and stored in a time-series database for long-term trend display and capacity planning. An example of the format is: node_cpu_usage {host="gateway-1", core="0"} 75.5; the other is status events. Any status change (such as process crash, service response timeout) or threshold alarm will generate a structured status event, which is pushed to downstream modules through a message queue. An example of the event format (JSON) includes timestamp, event type, severity, source, host information, and details.

[0051] {

[0052] "timestamp": "2023-10-27T08:45:12.123Z", "event_type": "service_response_timeout", "severity": "critical", "source": "system_metrics_agent", "host_ip": "192.168.1.10", "host_name": "brake-controller-01", "details": { "check_type": "application_probe", "target_service": "Modbus Server", "target_port": 502, "probe_command": "ReadHoldingRegisters(0, 10)", "response_time_ms": null, "expected_value_range": "0-100", "measured_value": null, "reason": "Connection timed out after 3000ms" } } This module's output, when correlated with network traffic and system logs, can accurately pinpoint problems. For example, when three events occur simultaneously—a sudden surge in network traffic, a large number of errors in the system logs, and 100% CPU utilization—the correlation analysis engine can determine that the node is highly likely to be under denial-of-service attack and generate a high-risk security event.

[0053] Furthermore, in a specific implementation, in the access control policy generation method provided in the embodiments of the present invention, step S104 cleans and compresses standardized events, structured log data, and status events accordingly. After authentication, the cleaned and compressed data are associated and fused to generate an access control policy. Specifically, this may include: after receiving standardized events, structured log data, and status events at the data processing layer, cleaning the standardized events, structured log data, and status events according to predefined rules, filtering out invalid data, and compressing high-frequency time-series data using a downsampling algorithm; transmitting the cleaned and compressed data to the central analysis server using an encrypted transmission channel, and performing two-way identity authentication using a digital certificate; after authentication, mapping the cleaned and compressed data to a standardized data model, and generating an access control policy by associating and fusing key fields.

[0054] In implementation, the data processing layer acts as the "highway and cleansing workshop" for data, ensuring that data flows to the analysis engine efficiently, securely, and in a standardized manner. The data processing layer may include a data cleansing and aggregation module, a secure transmission channel module, and a unified data model module.

[0055] In implementation, the data cleaning and aggregation module operates as follows: Predefined rules are applied to filter invalid data and discard data that is of no value to security analysis. This includes ARP broadcast packets, network protocol packets such as CDP / LLDP, heartbeat packets, and traffic with source or destination IP addresses that are multicast or broadcast addresses. Simultaneously, high-frequency time-series data, such as system status data, is compressed using a data downsampling algorithm (e.g., taking an average, maximum, and minimum value for every 10 data points). This significantly reduces data storage and computational pressure while preserving data trend characteristics.

[0056] The secure transmission channel module is implemented as follows: all communication between the acquisition end and the central analysis server is transmitted using TLS encryption (v1.2 and above recommended); two-way authentication is achieved through digital certificates to ensure the reliability (no data loss) and integrity (no data tampering) of data transmission. This mechanism is particularly suitable for ensuring data security in complex vehicle network environments.

[0057] The implementation mechanism of the unified data model module is as follows: A unified data fusion framework for security analysis is designed. This framework defines a standardized data model (e.g., a tag-based time-series data model) that maps multi-source data from three different sources—traffic, logs, and status—to a unified field namespace. For example, a Modbus traffic event, an error log containing an IP address, and a high CPU load event of the host with that IP address can be correlated and fused using key fields such as source IP and timestamp, providing a solid foundation for upper-layer correlation analysis. Furthermore, all collected data, after cleaning and parsing, is standardized into a unified security event format. Table 6 below shows the composition of a unified security event.

[0058] Table 6. Components of a Unified Security Incident

[0059] In practical applications of data fusion and correlation, assuming a suspicious operation occurs targeting the brake controller, three data sources will generate corresponding raw data: Network traffic shows that IP 192.168.1.100 sent a Modbus write coil command (function code = 5), address 0, to 192.168.1.10; system logs record that IP 192.168.1.100 failed to log in to host brake-controller-01 around the same time; and status monitoring shows that the CPU utilization of host 192.168.1.10 spiked to 98% during this period. This raw data from different dimensions, after being processed by the unified data model module, will be mapped into three unified events with a consistent format and interrelation.

[0060] Through the standardized processing described above, the correlation analysis engine can generate precise network traffic rule policies based on the correlations between three types of data: network traffic, system logs, and device status monitoring. For example, it can generate a rule to directly drop traffic from an external device with IP address 192.168.1.100, preventing that device from continuing to control terminal industrial equipment, thereby effectively preventing security risks caused by suspicious operations.

[0061] It should be noted that this invention can achieve byte-by-byte deep parsing of network traffic from the link layer to the application layer through a built-in powerful protocol identification engine (combining port and deep packet inspection methods) and dozens of dedicated parsers. Simultaneously, the log collection module converts unstructured log text into key-value pair format using configurable rule chains (such as Grok mode), while the status monitoring module converts hardware and software metrics into time-series data. These three types of heterogeneous data are ultimately mapped into a standardized, tag- and field-based namespace via a unified data model module. Entering the data processing layer, the above processes generate the finest-grained and highly structured security event data. For example, it can not only identify the presence of Modbus traffic but also precisely capture which entity, at what time, wrote what value to which coil address of which device. This fine-grained data becomes the foundation for all subsequent advanced analysis. More importantly, the unified data model allows data from different sources to have common association keys (such as asset identifiers, timestamps, and source IP addresses), creating a prerequisite for data correlation analysis. From a system-wide perspective, this addresses the pain point of "data silos" in security analysis, providing unprecedented possibilities for the efficient and accurate correlation and fusion of multi-source data. Based on this mechanism, the system can cross-validate security events from three dimensions: network, host, and application. This significantly reduces false positives and false negatives that may result from a single data source, thereby significantly improving the accuracy and reliability of security analysis.

[0062] Furthermore, this invention can proactively filter invalid data such as ARP broadcasts, and simultaneously downsample high-frequency indicator data, significantly reducing the pressure of invalid data on the backend system. The secure transmission channel uses TLS encryption to ensure the reliability and integrity of data transmission in complex network environments. All processed data is asynchronously pushed through high-efficiency event buses such as Kafka, ensuring efficient data flow. Together, these features construct an efficient, reliable, and secure data pipeline. This pipeline can quickly "reduce the load" (filter invalid data) and "standardize" (unify processing format) massive amounts of raw data, delivering the data to the analysis engine with extremely low latency, while ensuring data transmission security throughout the process, laying the architectural foundation for stable system operation. The entire process can support real-time processing of large-scale, high-speed data streams, fully meeting the needs of IT / OT networks, and is particularly suitable for real-time safety monitoring scenarios in dynamic environments such as trains. It effectively avoids delays in safety event response due to data processing bottlenecks, ensuring the real-time nature and effectiveness of safety monitoring.

[0063] Furthermore, in specific implementation, the access control policy generation method provided in the embodiments of the present invention may further include: controlling the visualization console to display various management and control data related to the access control policy, and updating the risk score, so as to view the execution result of the access control policy and the system security status through the interface; when an over-limit record or a record that needs to be adjusted occurs, a new access control policy is generated according to the record characteristics through a one-click rule generator, and pushed to the policy execution point after confirmation.

[0064] In implementation, the above steps can be performed by the application and response layer. The application and response layer can include a front-end display interface and a one-click rule generator. The front-end display interface can be implemented using a web-based visual console. It displays parsed network connection records, real-time logs, system status dashboards, security event lists, and risk scores. Users can view any parsed record in the front-end interface, which contains all extracted feature fields. The one-click rule generator works as follows: after selecting a record (normal or abnormal) in the front-end, the user clicks "Generate Corresponding Rule with One Click." The system automatically fills the record's features (such as protocol, IP, port, function code, address range, etc.) into a pre-set firewall rule template, generating a specific ACL (Access Control List) rule. After user confirmation, this rule can be pushed and deployed in real-time to firewalls or other policy enforcement points in the network via API calls (such as calling the firewall's REST API) or configured distribution protocols (such as NETCONF, SSH), immediately blocking attacks or allowing legitimate traffic.

[0065] It should be noted that the correlation analysis engine of this invention relies on high-quality, correlateable data prepared in advance to execute complex correlation rules, such as multi-dimensional combination rules for login failures occurring in quick succession, abnormal function code writing operations, or sudden CPU spikes. Once a rule is hit, the system immediately generates a high-risk security event. Simultaneously, the front-end interface presents users with clear security insights, while the one-click rule generator automatically extracts feature fields from event records and populates them into pre-set firewall rule templates, simplifying the policy generation process. This process completely changes the traditional security event response model: transforming the originally manual, cumbersome, and error-prone response actions into automatic, fast, and accurate operations. Users do not need to deeply understand the details of the underlying protocols or master the configuration syntax of different firewalls; the system can directly convert security insights into executable security policies, significantly reducing the cost of manual intervention and the rate of operational errors. It successfully achieves closed-loop automation from security monitoring to security response, significantly shortening the average repair time from threat discovery to policy deployment, enabling immediate blocking of attack behavior, effectively curbing the spread of attacks, and truly transforming security data into actionable security value. This proactive response capability represents a fundamental leap forward from traditional passive security monitoring systems, significantly enhancing the system's security protection effectiveness.

[0066] Furthermore, in practical applications, this invention can outsource the machine learning analysis module to an independent cloud-based security brain. That is, the terminal is only responsible for data collection, protocol parsing, and rule execution, while complex model training and analysis are completed in the cloud. This also achieves the invention's objective, and is particularly suitable for resource-constrained edge environments.

[0067] From the above description of the embodiments, those skilled in the art can clearly understand that the methods according to the above embodiments can be implemented by software plus necessary general-purpose hardware platforms, and of course, they can also be implemented by hardware, but in many cases the former is a better implementation method.

[0068] Embodiments of the present invention also provide an access control policy generation apparatus. From the perspective of functional modules, this apparatus may include: The network traffic capture and protocol parsing module is used to acquire raw data packets, identify the protocol corresponding to the raw data packets, and distribute the raw data packets to the appropriate parser according to the protocol type, so that the parser can parse the data according to the corresponding protocol specifications, extract structured feature data and convert it into standardized events. The log collection module is used to collect raw logs from multiple sources on each node, parse and extract log metadata, and perform rule matching processing by combining the metadata with the corresponding log content to transform unstructured logs into structured log data in a unified format. The system status monitoring module is used to collect hardware health indicators and monitor service response status. After summarizing the data, it performs comprehensive indicator analysis and processing, and filters and classifies status events from the processing results. The data processing module is used to clean and compress standardized events, structured log data, and status events. After authentication, the cleaned and compressed data is correlated and merged to generate access control policies.

[0069] Since the embodiments of the access control policy generation apparatus and the access control policy generation method correspond to each other, the descriptions of the features in the embodiments corresponding to the access control policy generation apparatus can be found in the relevant descriptions of the embodiments corresponding to the access control policy generation method, and will not be repeated here. Furthermore, it has the same beneficial effects as the access control policy generation method mentioned above.

[0070] Furthermore, in specific implementations, the access control policy generation device provided in the embodiments of the present invention may further include: a front-end display module, used to control the visualization console to display various management and control data related to the access control policy and update the risk score, so as to view the execution result of the access control policy and the system security status through the interface; and a policy update module, used to generate a new access control policy based on the record characteristics through a one-click rule generator when an over-limit record or a record that needs to be adjusted occurs, and push it to the policy execution point after confirmation.

[0071] Embodiments of the present invention also provide an electronic device, including a memory and a processor, wherein the memory stores a computer program and the processor is configured to run the computer program to perform the steps in any of the above-described access control policy generation method embodiments.

[0072] Embodiments of the present invention also provide a computer-readable storage medium storing a computer program, wherein the computer program is configured to execute the steps in any of the above-described access control policy generation method embodiments when running.

[0073] In one exemplary embodiment, the aforementioned computer-readable storage medium may include, but is not limited to, various media capable of storing computer programs, such as a USB flash drive, read-only memory (ROM), random access memory (RAM), portable hard disk, magnetic disk, or optical disk.

[0074] Embodiments of the present invention also provide a computer program product, which includes a computer program that, when executed by a processor, implements the steps in any of the above-described access control policy generation method embodiments.

[0075] Embodiments of the present invention also provide another computer program product, including a non-volatile computer-readable storage medium storing a computer program, which, when executed by a processor, implements the steps in any of the above-described access control policy generation method embodiments.

[0076] Those skilled in the art will further recognize that the units and algorithm steps of the various examples described in conjunction with the embodiments disclosed herein can be implemented in electronic hardware, computer software, or a combination of both. To clearly illustrate the interchangeability of hardware and software, the components and steps of the various examples have been generally described in terms of functionality in the foregoing description. Whether these functions are implemented in hardware or software depends on the specific application and design constraints of the technical solution. Those skilled in the art can use different methods to implement the described functions for each specific application, but such implementations should not be considered beyond the scope of this invention.

[0077] The above provides a detailed description of the access control policy generation method, device, and medium provided by the present invention. Specific examples have been used to illustrate the principles and implementation methods of the present invention. The descriptions of the above embodiments are only intended to help understand the method and core ideas of the present invention. It should be noted that those skilled in the art can make various improvements and modifications to the present invention without departing from its principles, and these improvements and modifications also fall within the protection scope of the present invention.

Claims

1. A method for generating access control policies, characterized in that, include: The process involves acquiring raw data packets, identifying the protocol corresponding to the raw data packets, and distributing the raw data packets to suitable parsers based on the protocol type. This allows the parsers to parse the data according to the corresponding protocol specifications, extract structured feature data, and convert it into standardized events. Collect raw logs from multiple sources at each node, parse and extract log metadata, and combine the metadata with the corresponding log content to perform rule matching processing, transforming unstructured logs into structured log data in a unified format; Collect hardware health indicators and monitor service response status. After summarizing the data, perform comprehensive indicator analysis and processing, and filter and classify status events from the processing results. The standardized events, structured log data, and status events are cleaned and compressed accordingly. After authentication, the cleaned and compressed data are correlated and merged to generate an access control policy.

2. The access control policy generation method according to claim 1, characterized in that, The process involves acquiring raw data packets, identifying the protocol corresponding to the raw data packets, and distributing the raw data packets to suitable parsers based on the protocol type. This allows the parsers to parse the data according to the corresponding protocol specifications, extract structured feature data, and convert it into standardized events, including: Capture raw data packets flowing through firewalls and switching nodes at the network interface card level; Based on port and deep packet inspection, the protocol corresponding to the original data packet is identified, and the original data packet is distributed to the appropriate parser according to the identified protocol type. The parser is used to parse the received data packets according to the standard specifications of the corresponding protocol, extract key message feature fields, and convert the extracted key message feature fields into structured feature data. The structured feature data is assembled into standardized events with a defined format and sent to the data processing layer.

3. The access control policy generation method according to claim 2, characterized in that, Based on port and deep packet inspection, the protocol corresponding to the original data packet is identified. According to the identified protocol type, the original data packet is distributed to an appropriate parser, including: Parse the Ethernet frame header of the original data packet to determine the upper-layer protocol type; According to the upper-layer protocol type, the remaining data in the original data packet after removing the Ethernet frame header is distributed to the corresponding network layer parser; The network layer resolver is used to parse network layer and transport layer information to obtain network address and port information; Based on network address and port information, the application layer protocol type can be initially determined by the target port or source port; Based on the judgment results, feature value matching is performed on the set identifier or fixed string of the data payload using the deep packet inspection method to identify the protocol; Once the identification is successful, the payload portion of the current data is distributed to the corresponding application layer protocol parser.

4. The access control policy generation method according to claim 3, characterized in that, The parser parses the received data packets according to the standard specifications of the corresponding protocol, extracts key message feature fields, and transforms the extracted key message feature fields into structured feature data, including: The application layer protocol parser is used to perform length verification and integrity checks on the received payload data; if the check fails, invalid packets are discarded and recorded; if the check passes, layered parsing and frame parsing are performed, and the protocol type is determined based on the parsed content to distinguish different protocol types. For layered protocols, the headers of each layer are stripped sequentially to obtain the application layer data unit; for protocols with framing mechanisms, the data is segmented according to the length field to obtain the application layer data unit. After obtaining the application layer data unit, extract the key message feature fields; Logical verification and context association are performed on the key message feature fields; after successful verification, the key message feature fields are assembled into structured feature data.

5. The access control policy generation method according to claim 1, characterized in that, Collect raw logs from multiple sources across nodes, parse and extract log metadata, and combine the metadata with the corresponding log content to perform rule-based matching processing, transforming unstructured logs into structured log data in a unified format, including: Use at least two collection methods to obtain the raw log stream of each node; Each log message in the original log stream is parsed to obtain the metadata of the log message; The metadata and corresponding log content of the log message are matched against the matching conditions set in the built-in rule base. If the match is successful, the corresponding processing action is executed. The process involves sequentially discarding redundant logs, extracting and structuring key fields, adding additional information, and standardizing field naming to transform unstructured log text into structured key-value pair data. The structured key-value pair data is converted into a unified data exchange format to obtain structured log data, which is then sent to the data processing layer.

6. The access control policy generation method according to claim 1, characterized in that, Collect hardware health indicators and monitor service response status. After summarizing the data, perform comprehensive indicator analysis and processing, and filter and classify status events from the processing results, including: Call the operating system interface or out-of-band management protocol to periodically collect the hardware health indicators of the nodes; When the service process is running, the service response time is monitored and measured, and the service is judged to be delayed or unavailable based on the measured response time. The collected hardware health indicators and service status assessment results are summarized into target data; The target data is processed by threshold comparison, trend analysis, and state machine judgment; wherein, warning and danger thresholds are set for each indicator in the target data, and corresponding warnings or serious events are generated; short-term trends are calculated for the time-series indicator data in the target data to obtain prediction results; and a state machine model is used to determine the process or service status. The processed data is classified into status indicators and status events; the status indicators are stored in the database in a time-series data format; and the status events are pushed to the data processing layer through a message queue.

7. The access control policy generation method according to claim 1, characterized in that, The standardized events, structured log data, and status events are cleaned and compressed accordingly. After authentication, the cleaned and compressed data are correlated and merged to generate an access control policy, including: After receiving the standardized events, the structured log data, and the status events at the data processing layer, the standardized events, the structured log data, and the status events are cleaned according to predefined rules to filter out invalid data, and a downsampling algorithm is used to compress the high-frequency time-series data. The cleaned and compressed data is transmitted to the central analysis server through an encrypted transmission channel, and two-way identity authentication is performed through digital certificates. After authentication, the cleaned and compressed data is mapped to a standardized data model, and access control policies are generated by associating and integrating key fields.

8. The access control policy generation method according to claim 1, characterized in that, Also includes: The control visualization console displays various management and control data related to the access control policy and updates the risk score, so that the execution results of the access control policy and the system security status can be viewed through the interface; When an over-limit record or a record that needs adjustment is found, a new access control policy is generated based on the record characteristics using a one-click rule generator, and then pushed to the policy execution point after confirmation.

9. An electronic device, characterized in that, include: Memory, used to store computer programs; A processor, configured to implement the steps of the access control policy generation method as described in any one of claims 1 to 8 when executing the computer program.

10. A computer-readable storage medium, characterized in that, The computer-readable storage medium stores a computer program that, when executed by a processor, implements the steps of the access control policy generation method as described in any one of claims 1 to 8.

Images