A method, apparatus, and medium for selecting security strategies based on LSTM terminal adaptive optimization.

Abstract

This invention discloses a security strategy selection method, apparatus, and medium based on LSTM-based terminal adaptive optimization. By combining threat type, occurrence probability, system vulnerability level, system security level, and time through LSTM, it identifies and analyzes attack intent, ultimately generating the most probable attack path. A security strategy model is then selected based on the attack loss, corresponding costs, and security level requirements of the nodes involved in the attack path. Therefore, this invention, based on the prediction of attack intent, uses the most probable attack path to measure terminal access security risk, enabling rapid adaptation to dynamic changes in terminal risk and system security requirements. Furthermore, this invention considers resource dynamism, establishing a terminal access security strategy model with the lowest terminal risk defense cost while considering load imbalance constraints, thus improving the practicality of the model's adaptive update and optimization of security strategies.

Description

Technical Field

[0001] This invention relates to the field of network security technology, and in particular to a security policy selection method, apparatus and medium based on LSTM terminal adaptive optimization. Background Technology

[0002] Due to the complexity and instability of existing edge network environments, traditional security protection capabilities are insufficient to meet the needs of secure terminal access. While some researchers conduct real-time assessments of system security risks based on the types and probabilities of threats faced by terminals and the system's security level, and select security strategies accordingly, this approach is a reactive, post-incident security strategy response, failing to dynamically adapt to the changing demands of terminal risks and system security requirements, and thus hindering the continuous optimization of system security strategies. Therefore, a security strategy selection method that can rapidly adapt to the dynamic changes in terminal risks and system security needs is urgently needed. Summary of the Invention

[0003] This invention provides a security strategy selection method, device, and medium based on LSTM terminal adaptive optimization to solve the technical problem that existing technologies cannot dynamically adapt to terminal risks and system security requirements, and can quickly adapt to the dynamic changes in terminal risks and system security requirements.

[0004] To achieve the above objectives, in a first aspect, embodiments of the present invention provide a security policy selection method based on LSTM terminal adaptive optimization, comprising:

[0005] By combining the influencing factors of security risks with time through LSTM, the system can identify and analyze attack intentions to generate the most likely attack path. The influencing factors include threat type, probability of threat occurrence, vulnerability level, and system security level.

[0006] Risk assessments are conducted on the attack paths, and security strategy models are selected based on system security level requirements to adapt to dynamic changes in terminal risks and system security needs.

[0007] As an improvement to the above solution, the step of combining the influencing factors of security risks with time through LSTM to form the identification and analysis of attack intent, in order to generate the most likely attack path, specifically includes:

[0008] By combining the influencing factors of security risks with time through LSTM, expressions for the threat type, probability of threat occurrence, and vulnerability level of the terminal are obtained, thereby obtaining the security risk status of the terminal;

[0009] Based on the security risk of the terminal and the security level of the system, attack intentions are identified and analyzed to generate the most likely attack path;

[0010] The expression for the threat type is as follows:

[0011]

[0012] In the formula, This represents the threat vector faced by the i-th terminal at time tn; This indicates the first threat to the i-th terminal at time tn; This indicates the second threat to the i-th terminal at time tn; This represents the j-th threat to the i-th terminal at time tn; This represents the s-th threat to the i-th terminal at time tn;

[0013] The expression for the probability of the threat occurring is:

[0014]

[0015] In the formula, This represents the probability that the i-th terminal will be attacked by x at time tn; This represents the probability that the i-th terminal becomes an attack access point at time tn; vul k f represents the difficulty for the i-th terminal to launch an attack using the k-th vulnerability at time tn; m represents the number of vulnerabilities; f x This represents the quantized value of the frequency of system attack x at time tn;

[0016] The expression for the vulnerability level is:

[0017]

[0018] In the formula, This represents the vulnerability level vector faced by the i-th terminal at time tn; This indicates the confidentiality vulnerability of the i-th terminal; This represents the complete vulnerability of the i-th terminal at time tn; This indicates the availability and vulnerability of the i-th terminal at time tn;

[0019] The most likely attack path is represented as follows:

[0020]

[0021] In the formula, This represents the maximum possible attack path for the i-th terminal; This represents the probability value of the most likely attack path occurring at time tn for the i-th terminal.

[0022] As an improvement to the above solution, the risk assessment of the attack path and the selection of a security strategy model based on the system security level requirements to adapt to the dynamic changes in terminal risks and system security needs specifically include:

[0023] A risk assessment is performed on the attack path to obtain the availability risk, integrity risk, and confidentiality risk of the terminal under attack, thereby obtaining the risk value of the terminal;

[0024] Calculate the terminal risk defense cost, and select a security strategy model based on the terminal risk defense cost and security level requirements to adapt to the dynamic changes in terminal risk and system security needs;

[0025] The availability risk of the i-th terminal at time tn is represented as follows:

[0026]

[0027] The integrity risk of the i-th terminal at time tn is represented as follows:

[0028]

[0029] The confidentiality risk of the i-th terminal at time tn is represented as follows:

[0030]

[0031] The risk value of the i-th terminal at time tn is expressed as:

[0032]

[0033] Wherein, V1, V2, and V3 represent the degree of impact of threats such as unauthorized physical access by devices, tampering with control information, and unauthorized network connections on the integrity of the i-th terminal at time tn, respectively; V4, V5, and V6 represent the degree of impact of threats such as unauthorized physical access by devices, tampering with control information, and unauthorized network connections on the confidentiality of the i-th terminal at time tn, respectively; and w1, w2, and w3 are the weights of the availability risk, integrity risk, and confidentiality risk, respectively.

[0034] As an improvement to the above solution, the calculation of the terminal risk defense cost, and the selection of a security strategy model based on the terminal risk defense cost and system security level requirements, to adapt to the dynamic changes in terminal risk and system security needs, specifically includes:

[0035] Based on the risk value of the aforementioned terminal, the risk defense cost for all terminals in the system is obtained as follows:

[0036]

[0037] Where N represents the number of terminals in the system; d i This indicates the security policy adopted by the i-th terminal;

[0038] A security strategy model is selected based on the risk defense costs of all terminals in the system and the requirements of the system security level, so as to adapt to the dynamic changes in terminal risks and system security requirements.

[0039] The security strategy model is as follows:

[0040]

[0041] Where μ≤σ is the constraint condition of the security strategy model, μ is the load imbalance degree of the system, σ is the setting value of the system, and 0≤σ≤20%.

[0042] Secondly, embodiments of the present invention provide a security policy selection device based on LSTM terminal adaptive optimization, comprising:

[0043] An attack path generation module is used to combine the influencing factors of security risks with time through LSTM to form the identification and analysis of attack intent, so as to generate the most likely attack path; wherein, the influencing factors include threat type, threat occurrence probability, vulnerability level and system security level;

[0044] The security policy selection module is used to assess the risks of the attack paths and select a security policy model based on the system security level requirements to adapt to the dynamic changes in terminal risks and system security needs.

[0045] As an improvement to the above solution, the attack path generation module is specifically used for:

[0046] By combining the influencing factors of security risks with time through LSTM, expressions for the threat type, probability of threat occurrence, and vulnerability level of the terminal are obtained, thereby obtaining the security risk status of the terminal;

[0047] Based on the security risk of the terminal and the security level of the system, attack intentions are identified and analyzed to generate the most likely attack path;

[0048] The expression for the threat type is as follows:

[0049]

[0050] In the formula, This represents the threat vector faced by the i-th terminal at time tn; This indicates the first threat to the i-th terminal at time tn; This indicates the second threat to the i-th terminal at time tn; This represents the j-th threat to the i-th terminal at time tn; This represents the s-th threat to the i-th terminal at time tn;

[0051] The expression for the probability of the threat occurring is:

[0052]

[0053] In the formula, This represents the probability that the i-th terminal will be attacked by x at time tn; This represents the probability that the i-th terminal becomes an attack access point at time tn; vul k f represents the difficulty for the i-th terminal to launch an attack using the k-th vulnerability at time tn; m represents the number of vulnerabilities; f x This represents the quantized value of the frequency of system attack x at time tn;

[0054] The expression for the vulnerability level is:

[0055]

[0056] In the formula, This represents the vulnerability level vector faced by the i-th terminal at time tn; This indicates the confidentiality vulnerability of the i-th terminal; This represents the complete vulnerability of the i-th terminal at time tn; This indicates the availability and vulnerability of the i-th terminal at time tn;

[0057] The most likely attack path is represented as follows:

[0058]

[0059] In the formula, This represents the maximum possible attack path for the i-th terminal; This represents the probability value of the most likely attack path occurring at time tn for the i-th terminal.

[0060] As an improvement to the above solution, the security policy selection module is specifically used for:

[0061] A risk assessment is performed on the attack path to obtain the availability risk, integrity risk, and confidentiality risk of the terminal under attack, thereby obtaining the risk value of the terminal;

[0062] Calculate the terminal risk defense cost, and select a security strategy model based on the terminal risk defense cost and security level requirements to adapt to the dynamic changes in terminal risk and system security needs;

[0063] The availability risk of the i-th terminal at time tn is represented as follows:

[0064]

[0065] The integrity risk of the i-th terminal at time tn is represented as follows:

[0066]

[0067] The confidentiality risk of the i-th terminal at time tn is represented as follows:

[0068]

[0069] The risk value of the i-th terminal at time tn is expressed as:

[0070]

[0071] Wherein, V1, V2, and V3 represent the degree of impact of threats such as unauthorized physical access by devices, tampering with control information, and unauthorized network connections on the integrity of the i-th terminal at time tn, respectively; V4, V5, and V6 represent the degree of impact of threats such as unauthorized physical access by devices, tampering with control information, and unauthorized network connections on the confidentiality of the i-th terminal at time tn, respectively; and w1, w2, and w3 are the weights of the availability risk, integrity risk, and confidentiality risk, respectively.

[0072] As an improvement to the above solution, the calculation of the terminal risk defense cost, and the selection of a security strategy model based on the terminal risk defense cost and system security level requirements, to adapt to the dynamic changes in terminal risk and system security needs, specifically includes:

[0073] Based on the risk value of the aforementioned terminal, the risk defense cost for all terminals in the system is obtained as follows:

[0074]

[0075] Where N represents the number of terminals in the system; d i This indicates the security policy adopted by the i-th terminal;

[0076] A security strategy model is selected based on the risk defense costs of all terminals in the system and the requirements of the system security level, so as to adapt to the dynamic changes in terminal risks and system security requirements.

[0077] The security strategy model is as follows:

[0078]

[0079] Where μ≤σ is the constraint condition of the security strategy model, μ is the load imbalance degree of the system, σ is the setting value of the system, and 0≤σ≤20%.

[0080] Thirdly, the present invention provides a security policy selection device based on LSTM terminal adaptive optimization, including a processor, a memory, and a computer program stored in the memory and configured to be executed by the processor. When the processor executes the computer program, it implements the above-mentioned security policy selection method based on LSTM terminal adaptive optimization.

[0081] Furthermore, embodiments of the present invention also provide a computer-readable storage medium, the computer-readable storage medium including a stored computer program, wherein, when the computer program is executed, it controls the device where the computer-readable storage medium is located to execute the above-described security policy selection method based on LSTM terminal adaptive optimization.

[0082] Compared with existing technologies, the present invention discloses a security strategy selection method, apparatus, and medium based on LSTM terminal adaptive optimization. By combining threat type, probability of occurrence, system vulnerability level, system security level, and time through LSTM, it identifies and analyzes attack intent, ultimately generating the most probable attack path. Based on the attack loss, corresponding costs, and security level requirements of the nodes involved in the attack path, a security strategy model is selected. Therefore, the present invention, based on the prediction of attack intent, uses the most probable attack path to measure terminal access security risk, enabling rapid adaptation to dynamic changes in terminal risk and system security requirements. Furthermore, the present invention considers resource dynamism, establishing a terminal access security strategy model with the lowest terminal risk defense cost while considering load imbalance constraints, thus improving the practicality of the model's adaptive updating and optimization of security strategies. Attached Figure Description

[0083] Figure 1 This is a flowchart illustrating a security policy selection method based on LSTM terminal adaptive optimization provided in an embodiment of the present invention.

[0084] Figure 2 This is a schematic diagram of a security policy selection device based on LSTM terminal adaptive optimization provided in an embodiment of the present invention. Detailed Implementation

[0085] The technical solutions of the embodiments of the present invention will be clearly and completely described below with reference to the accompanying drawings. Obviously, the described embodiments are only some embodiments of the present invention, and not all embodiments. Based on the embodiments of the present invention, all other embodiments obtained by those skilled in the art without creative effort are within the scope of protection of the present invention.

[0086] It should be noted that the terms "comprising" and "specific" in this invention, and any variations thereof, are intended to cover non-exclusive inclusion. For example, a process, method, system, product, or device that includes a series of steps or units is not necessarily limited to those steps or units that are explicitly listed, but may include other steps or units that are not explicitly listed or that are inherent to such process, method, product, or device.

[0087] Please see Figure 1 , Figure 1 This is a flowchart illustrating a security policy selection method based on LSTM terminal adaptive optimization provided by an embodiment of the present invention. The security policy selection method based on LSTM terminal adaptive optimization includes steps S11 to S12:

[0088] S11: By combining the influencing factors of security risks with time through LSTM, an attack intent identification and analysis is formed to generate the most likely attack path; wherein, the influencing factors include threat type, threat occurrence probability, vulnerability level, and system security level;

[0089] S12: Conduct a risk assessment of the attack path and select a security strategy model based on the system security level requirements to adapt to the dynamic changes in terminal risks and system security needs.

[0090] As a preferred embodiment, the step of combining the influencing factors of security risks with time through LSTM to form the identification and analysis of attack intent, in order to generate the most likely attack path, specifically includes:

[0091] By combining the influencing factors of security risks with time through LSTM, expressions for the threat type, probability of threat occurrence, and vulnerability level of the terminal are obtained, thereby obtaining the security risk status of the terminal;

[0092] Based on the security risk of the terminal and the security level of the system, attack intentions are identified and analyzed to generate the most likely attack path;

[0093] The expression for the threat type is as follows:

[0094]

[0095] In the formula, This represents the threat vector faced by the i-th terminal at time tn; This indicates the first threat to the i-th terminal at time tn; This indicates the second threat to the i-th terminal at time tn; This represents the j-th threat to the i-th terminal at time tn; This represents the s-th threat to the i-th terminal at time tn;

[0096] The expression for the probability of the threat occurring is:

[0097]

[0098] In the formula, This represents the probability that the i-th terminal will be attacked by x at time tn; This represents the probability that the i-th terminal becomes an attack access point at time tn; vul k f represents the difficulty for the i-th terminal to launch an attack using the k-th vulnerability at time tn; m represents the number of vulnerabilities; f x This represents the quantized value of the frequency of system attack x at time tn;

[0099] The expression for the vulnerability level is:

[0100]

[0101] In the formula, This represents the vulnerability level vector faced by the i-th terminal at time tn; This indicates the confidentiality vulnerability of the i-th terminal; This represents the complete vulnerability of the i-th terminal at time tn; This indicates the availability and vulnerability of the i-th terminal at time tn;

[0102] The most likely attack path is represented as follows:

[0103]

[0104] In the formula, This represents the maximum possible attack path for the i-th terminal; This represents the probability value of the most likely attack path occurring at time tn for the i-th terminal.

[0105] As a preferred embodiment, the risk assessment of the attack path and the selection of a security strategy model based on system security level requirements to adapt to dynamic changes in terminal risks and system security needs specifically include:

[0106] A risk assessment is performed on the attack path to obtain the availability risk, integrity risk, and confidentiality risk of the terminal under attack, thereby obtaining the risk value of the terminal;

[0107] Calculate the terminal risk defense cost, and select a security strategy model based on the terminal risk defense cost and security level requirements to adapt to the dynamic changes in terminal risk and system security needs;

[0108] The availability risk of the i-th terminal at time tn is represented as follows:

[0109]

[0110] The integrity risk of the i-th terminal at time tn is represented as follows:

[0111]

[0112] The confidentiality risk of the i-th terminal at time tn is represented as follows:

[0113]

[0114] The risk value of the i-th terminal at time tn is expressed as:

[0115]

[0116] Wherein, V1, V2, and V3 represent the degree of impact of threats such as unauthorized physical access by devices, tampering with control information, and unauthorized network connections on the integrity of the i-th terminal at time tn, respectively; V4, V5, and V6 represent the degree of impact of threats such as unauthorized physical access by devices, tampering with control information, and unauthorized network connections on the confidentiality of the i-th terminal at time tn, respectively; and w1, w2, and w3 are the weights of the availability risk, integrity risk, and confidentiality risk, respectively.

[0117] As a preferred embodiment, the calculation of the terminal risk defense cost, and the selection of a security strategy model based on the terminal risk defense cost and system security level requirements to adapt to dynamic changes in terminal risk and system security needs, specifically includes:

[0118] Based on the risk value of the aforementioned terminal, the risk defense cost for all terminals in the system is obtained as follows:

[0119]

[0120] Where N represents the number of terminals in the system; d i This indicates the security policy adopted by the i-th terminal;

[0121] A security strategy model is selected based on the risk defense costs of all terminals in the system and the requirements of the system security level, so as to adapt to the dynamic changes in terminal risks and system security requirements.

[0122] The security strategy model is as follows:

[0123]

[0124] Where μ≤σ is the constraint condition of the security strategy model, μ is the load imbalance degree of the system, σ is the setting value of the system, and 0≤σ≤20%.

[0125] It should be noted that LSTM (Long Short-Term Memory) for terminal access security policy selection aims to maximize security performance while minimizing terminal risk defense costs. It also considers the dynamic changes in system resources and introduces load imbalance to build the terminal access security policy model, improving the practicality of the model's adaptive updating and optimization of security policies. For terminal risks, the security policy adopted by each terminal in the system is D, where D = [d1, d2, ..., d...]. i Therefore, the risk defense cost for all terminals in the system is...

[0126]

[0127] Where N represents the number of terminals in the system; d i This indicates the security policy adopted by the i-th terminal.

[0128] Since server resources are in a dynamic state, when adopting a defense strategy, it is necessary to consider the limitations of server resource utilization and load balancing. Therefore, this invention needs to consider load balancing constraints to achieve terminal security protection.

[0129] Assume the set of servers accessed by the terminal is A, l represents the number of available servers in the server set, and the set of server resources (CPU, memory, bandwidth, etc.) is B, B = {pm} ir |0≤r≤m}, where r represents the type of server resource.

[0130] Since the edge network is a dynamically changing resource network, let's assume that the resources allocated at the current moment are... The total amount of resources is Then the average utilization rate of server i on resource r is:

[0131]

[0132] Therefore, the average resource utilization rate of the entire system can be expressed as:

[0133]

[0134] Based on the average resource utilization of physical servers, the load imbalance μ of the entire system is determined as follows:

[0135]

[0136] Where M represents the total number of different types of server resources.

[0137] Based on the above description, the security strategy model is as follows:

[0138]

[0139] Where μ≤σ is the constraint condition of the security strategy model, and σ is a system setting value, which is set according to expert experience and is usually between [0-20%].

[0140] This invention, based on the spatiotemporal characteristics of associated threat influencing factors, predicts the probability of event occurrence for each time series, thereby predicting the most likely attack path. With minimizing defense costs as the objective function, it considers the dynamic changes in system resources and introduces load imbalance, using load balancing as a constraint to achieve a terminal adaptive optimization strategy, which is practical.

[0141] Figure 2 This is a schematic diagram of a security policy selection device based on LSTM terminal adaptive optimization provided in an embodiment of the present invention. The security policy selection device based on LSTM terminal adaptive optimization includes:

[0142] The attack path generation module 21 is used to combine the influencing factors of security risks with time through LSTM to form the identification and analysis of attack intent, so as to generate the most likely attack path; wherein, the influencing factors include threat type, threat occurrence probability, vulnerability level and system security level;

[0143] The security policy selection module 22 is used to conduct risk assessments on the attack paths and select a security policy model based on the system security level requirements to adapt to the dynamic changes in terminal risks and system security needs.

[0144] In a preferred embodiment, the attack path generation module 21 is specifically used for:

[0145] By combining the influencing factors of security risks with time through LSTM, expressions for the threat type, probability of threat occurrence, and vulnerability level of the terminal are obtained, thereby obtaining the security risk status of the terminal;

[0146] Based on the security risk of the terminal and the security level of the system, attack intentions are identified and analyzed to generate the most likely attack path;

[0147] The expression for the threat type is as follows:

[0148]

[0149] In the formula, This represents the threat vector faced by the i-th terminal at time tn; This indicates the first threat to the i-th terminal at time tn; This indicates the second threat to the i-th terminal at time tn; This represents the j-th threat to the i-th terminal at time tn; This represents the s-th threat to the i-th terminal at time tn;

[0150] The expression for the probability of the threat occurring is:

[0151]

[0152] In the formula, This represents the probability that the i-th terminal will be attacked by x at time tn; This represents the probability that the i-th terminal becomes an attack access point at time tn; vul k f represents the difficulty for the i-th terminal to launch an attack using the k-th vulnerability at time tn; m represents the number of vulnerabilities; f x This represents the quantized value of the frequency of system attack x at time tn;

[0153] The expression for the vulnerability level is:

[0154]

[0155] In the formula, This represents the vulnerability level vector faced by the i-th terminal at time tn; This indicates the confidentiality vulnerability of the i-th terminal; This represents the complete vulnerability of the i-th terminal at time tn; This indicates the availability and vulnerability of the i-th terminal at time tn;

[0156] The most likely attack path is represented as follows:

[0157]

[0158] In the formula, This represents the maximum possible attack path for the i-th terminal; This represents the probability value of the most likely attack path occurring at time tn for the i-th terminal.

[0159] In a preferred embodiment, the security policy selection module 22 is specifically used for:

[0160] A risk assessment is performed on the attack path to obtain the availability risk, integrity risk, and confidentiality risk of the terminal under attack, thereby obtaining the risk value of the terminal;

[0161] Calculate the terminal risk defense cost, and select a security strategy model based on the terminal risk defense cost and security level requirements to adapt to the dynamic changes in terminal risk and system security needs;

[0162] The availability risk of the i-th terminal at time tn is represented as follows:

[0163]

[0164] The integrity risk of the i-th terminal at time tn is represented as follows:

[0165]

[0166] The confidentiality risk of the i-th terminal at time tn is represented as follows:

[0167]

[0168] The risk value of the i-th terminal at time tn is expressed as:

[0169]

[0170] Wherein, V1, V2, and V3 represent the degree of impact of threats such as unauthorized physical access by devices, tampering with control information, and unauthorized network connections on the integrity of the i-th terminal at time tn, respectively; V4, V5, and V6 represent the degree of impact of threats such as unauthorized physical access by devices, tampering with control information, and unauthorized network connections on the confidentiality of the i-th terminal at time tn, respectively; and w1, w2, and w3 are the weights of the availability risk, integrity risk, and confidentiality risk, respectively.

[0171] The security policy selection device based on LSTM terminal adaptive optimization provided in this embodiment of the invention can realize all the processes of the security policy selection method based on LSTM terminal adaptive optimization in the above embodiments. The functions and technical effects of each module in the device are the same as those of the security policy selection method based on LSTM terminal adaptive optimization in the above embodiments, and will not be repeated here.

[0172] This invention provides an LSTM-based terminal adaptive optimization security policy selection device, comprising a processor, a memory, and a computer program stored in the memory and executable on the processor. When the processor executes the computer program, it implements the steps described in the LSTM-based terminal adaptive optimization security policy selection method embodiment. Alternatively, when the processor executes the computer program, it implements the functions of each module described in the LSTM-based terminal adaptive optimization security policy selection device embodiment.

[0173] For example, the computer program may be divided into one or more modules, which are stored in the memory and executed by the processor to complete the present invention. The one or more modules may be a series of computer program instruction segments capable of performing a specific function, which describe the execution process of the computer program in the device.

[0174] The processor can be a central processing unit, or other general-purpose processors, digital signal processors, application-specific integrated circuits (ASICs), field-programmable gate arrays (FPGAs), or other programmable logic devices, discrete gate or transistor logic devices, discrete hardware components, etc. The general-purpose processor can be a microprocessor or any conventional processor. The processor is the control center of the device, connecting various parts of the entire device via various interfaces and lines.

[0175] The memory can be used to store the computer programs and / or modules. The processor implements various functions of the device by running or executing the computer programs and / or modules stored in the memory, and by accessing data stored in the memory. The memory may mainly include a program storage area and a data storage area. The program storage area may store the operating system, at least one application program required for a function (such as sound playback function, image playback function, etc.), etc.; the data storage area may store data created based on the use of the mobile phone (such as audio data, phonebook, etc.). In addition, the memory may include high-speed random access memory, and may also include non-volatile memory, such as hard disk, RAM, plug-in hard disk, smart memory card, at least one disk storage device, flash memory device, or other volatile solid-state storage device.

[0176] It should be noted that the device embodiments described above are merely illustrative. The units described as separate components may or may not be physically separate, and the components shown as units may or may not be physical units; that is, they may be located in one place or distributed across multiple network units. Some or all of the modules can be selected to achieve the purpose of this embodiment according to actual needs. Furthermore, in the accompanying drawings of the device embodiments provided by this invention, the connection relationships between modules indicate that they have communication connections, which can be specifically implemented as one or more communication buses or signal lines. Those skilled in the art can understand and implement this without any creative effort.

[0177] This invention also provides a computer-readable storage medium, which includes a stored computer program, wherein the computer program, when running, controls the device where the computer-readable storage medium is located to execute the LSTM-based terminal adaptive optimization security policy selection method as described in the above embodiments.

[0178] In summary, the security policy selection method, apparatus, and medium based on LSTM terminal adaptive optimization disclosed in this invention combine threat type, occurrence probability, system vulnerability level, system security level, and time through LSTM to identify and analyze attack intent, ultimately generating the most probable attack path. A security policy model is then selected based on the attack loss, corresponding costs, and security level requirements of the nodes involved in the attack path. Therefore, this invention, based on the prediction of attack intent, uses the most probable attack path to measure terminal access security risk, enabling rapid adaptation to dynamic changes in terminal risk and system security requirements. Furthermore, this invention considers resource dynamism, establishing a terminal access security policy model with the lowest terminal risk defense cost while considering load imbalance constraints, thus improving the practicality of the model's adaptive updating and optimization of security policies.

[0179] The above description represents the preferred embodiments of the present invention. It should be noted that those skilled in the art can make various improvements and modifications without departing from the principles of the present invention, and these improvements and modifications are also considered to be within the scope of protection of the present invention.

Claims

1. A security policy selection method based on LSTM terminal adaptive optimization, characterized in that, include: By combining the influencing factors of security risks with time through LSTM, the system can identify and analyze attack intentions to generate the most likely attack path. The influencing factors include threat type, probability of threat occurrence, vulnerability level, and system security level. A risk assessment is performed on the attack paths, and a security strategy model is selected based on the system security level requirements to adapt to the dynamic changes in terminal risks and system security needs. Specifically, the method of combining security risk influencing factors and time through LSTM to identify and analyze attack intent in order to generate the most likely attack path includes: By combining the influencing factors of security risks with time through LSTM, expressions for the threat type, probability of threat occurrence, and vulnerability level of the terminal are obtained, thereby obtaining the security risk status of the terminal; Based on the security risk of the terminal and the security level of the system, attack intentions are identified and analyzed to generate the most likely attack path; The expression for the threat type is as follows: In the formula, This represents the threat vector faced by the i-th terminal at time tn; This indicates the first threat to the i-th terminal at time tn; This indicates the second threat to the i-th terminal at time tn; This represents the j-th threat to the i-th terminal at time tn; This represents the s-th threat to the i-th terminal at time tn; The expression for the probability of the threat occurring is: In the formula, This represents the probability that the i-th terminal will be attacked by x at time tn; This represents the probability that the i-th terminal becomes an attack access point at time tn; vul k f represents the difficulty for the i-th terminal to launch an attack using the k-th vulnerability at time tn; m represents the number of vulnerabilities; f x This represents the quantized value of the frequency of system attack x at time tn; The expression for the vulnerability level is: In the formula, This represents the vulnerability level vector faced by the i-th terminal at time tn; This indicates the confidentiality vulnerability of the i-th terminal; This represents the complete vulnerability of the i-th terminal at time tn; This indicates the availability and vulnerability of the i-th terminal at time tn; The most likely attack path is represented as follows: In the formula, This represents the maximum possible attack path for the i-th terminal; This represents the probability value of the most likely attack path occurring at time tn for the i-th terminal.

2. The security policy selection method based on LSTM terminal adaptive optimization as described in claim 1, characterized in that, The risk assessment of the attack path and the selection of a security strategy model based on system security level requirements to adapt to dynamic changes in terminal risks and system security needs specifically include: A risk assessment is performed on the attack path to obtain the availability risk, integrity risk, and confidentiality risk of the terminal under attack, thereby obtaining the risk value of the terminal; Calculate the terminal risk defense cost, and select a security strategy model based on the terminal risk defense cost and security level requirements to adapt to the dynamic changes in terminal risk and system security needs; The availability risk of the i-th terminal at time tn is represented as follows: The integrity risk of the i-th terminal at time tn is represented as follows: The confidentiality risk of the i-th terminal at time tn is represented as follows: The risk value of the i-th terminal at time tn is expressed as: Wherein, V1, V2, and V3 represent the degree of impact of threats such as unauthorized physical access by devices, tampering of control information, and unauthorized network connections on the integrity of the i-th terminal at time tn, respectively; V4, V5, and V6 represent the degree of impact of threats such as unauthorized physical access by devices, tampering of control information, and unauthorized network connections on the confidentiality of the i-th terminal at time tn, respectively; and w1, w2, and w3 are the weights of the availability risk, integrity risk, and confidentiality risk, respectively.

3. The security policy selection method based on LSTM terminal adaptive optimization as described in claim 2, characterized in that, The calculation of the terminal risk defense cost, and the selection of a security strategy model based on the terminal risk defense cost and system security level requirements to adapt to dynamic changes in terminal risk and system security needs, specifically includes: Based on the risk value of the aforementioned terminal, the risk defense cost for all terminals in the system is obtained as follows: Where N represents the number of terminals in the system; d i This indicates the security policy adopted by the i-th terminal; A security strategy model is selected based on the risk defense costs of all terminals in the system and the requirements of the system security level, so as to adapt to the dynamic changes in terminal risks and system security requirements. The security strategy model is as follows: Where μ≤σ is the constraint condition of the security strategy model, μ is the load imbalance degree of the system, σ is the setting value of the system, and 0≤σ≤20%.

4. A security policy selection device based on LSTM terminal adaptive optimization, characterized in that, include: An attack path generation module is used to combine the influencing factors of security risks with time through LSTM to form the identification and analysis of attack intent, so as to generate the most likely attack path; wherein, the influencing factors include threat type, threat occurrence probability, vulnerability level and system security level; The security policy selection module is used to assess the risks of the attack paths and select a security policy model based on the system security level requirements to adapt to the dynamic changes in terminal risks and system security needs. Specifically, the attack path generation module is used for: By combining the influencing factors of security risks with time through LSTM, expressions for the threat type, probability of threat occurrence, and vulnerability level of the terminal are obtained, thereby obtaining the security risk status of the terminal; Based on the security risk of the terminal and the security level of the system, attack intentions are identified and analyzed to generate the most likely attack path; The expression for the threat type is as follows: In the formula, This represents the threat vector faced by the i-th terminal at time tn; This indicates the first threat to the i-th terminal at time tn; This indicates the second threat to the i-th terminal at time tn; This represents the j-th threat to the i-th terminal at time tn; This represents the s-th threat to the i-th terminal at time tn; The expression for the probability of the threat occurring is: In the formula, This represents the probability that the i-th terminal will be attacked by x at time tn; This represents the probability that the i-th terminal becomes an attack access point at time tn; vul k f represents the difficulty for the i-th terminal to launch an attack using the k-th vulnerability at time tn; m represents the number of vulnerabilities; f x This represents the quantized value of the frequency of system attack x at time tn; The expression for the vulnerability level is: In the formula, This represents the vulnerability level vector faced by the i-th terminal at time tn; This indicates the confidentiality vulnerability of the i-th terminal; This represents the complete vulnerability of the i-th terminal at time tn; This indicates the availability and vulnerability of the i-th terminal at time tn; The most likely attack path is represented as follows: In the formula, This represents the maximum possible attack path for the i-th terminal; This represents the probability value of the most likely attack path occurring at time tn for the i-th terminal.

5. The security policy selection device based on LSTM terminal adaptive optimization as described in claim 4, characterized in that, The security policy selection module is specifically used for: A risk assessment is performed on the attack path to obtain the availability risk, integrity risk, and confidentiality risk of the terminal under attack, thereby obtaining the risk value of the terminal; Calculate the terminal risk defense cost, and select a security strategy model based on the terminal risk defense cost and security level requirements to adapt to the dynamic changes in terminal risk and system security needs; The availability risk of the i-th terminal at time tn is represented as follows: The integrity risk of the i-th terminal at time tn is represented as follows: The confidentiality risk of the i-th terminal at time tn is represented as follows: The risk value of the i-th terminal at time tn is expressed as: Wherein, V1, V2, and V3 represent the degree of impact of threats such as unauthorized physical access by devices, tampering of control information, and unauthorized network connections on the integrity of the i-th terminal at time tn, respectively; V4, V5, and V6 represent the degree of impact of threats such as unauthorized physical access by devices, tampering of control information, and unauthorized network connections on the confidentiality of the i-th terminal at time tn, respectively; and w1, w2, and w3 are the weights of the availability risk, integrity risk, and confidentiality risk, respectively.

6. The security policy selection device based on LSTM terminal adaptive optimization as described in claim 5, characterized in that, The calculation of the terminal risk defense cost, and the selection of a security strategy model based on the terminal risk defense cost and system security level requirements to adapt to dynamic changes in terminal risk and system security needs, specifically includes: Based on the risk value of the aforementioned terminal, the risk defense cost for all terminals in the system is obtained as follows: Where N represents the number of terminals in the system; d i This indicates the security policy adopted by the i-th terminal; A security strategy model is selected based on the risk defense costs of all terminals in the system and the requirements of the system security level, so as to adapt to the dynamic changes in terminal risks and system security requirements. The security strategy model is as follows: Where μ≤σ is the constraint condition of the security strategy model, μ is the load imbalance degree of the system, σ is the setting value of the system, and 0≤σ≤20%.

7. A security policy selection device based on LSTM terminal adaptive optimization, characterized in that, The system includes a processor, a memory, and a computer program stored in the memory and configured to be executed by the processor, wherein the processor, when executing the computer program, implements the LSTM-based terminal adaptive optimization security policy selection method as described in any one of claims 1-3.

8. A computer-readable storage medium, characterized in that, The computer-readable storage medium includes a stored computer program, wherein, when the computer program is executed, it controls the device where the computer-readable storage medium is located to perform the security policy selection method based on LSTM terminal adaptive optimization as described in any one of claims 1-3.

Images