A strategy adaptive control method based on cloud environment

Abstract

A policy adaptive control method based on a cloud environment, the present invention relates to a policy adaptive control method based on a cloud environment. The purpose of the present invention is to configure the policies of network devices in a cloud environment efficiently, accurately, dynamically and adaptively. The process is: S1, obtain the policies of three network devices from the current network environment; define the current network environment model, network path, access request, decision results of the firewall decision model and multiple policy collaborative decision models; S2, express the access request in the form of an access request, and decompose it into multiple sub-request sequences; S3, generate new AV policy rules, new firewall policy rules and new switch policy rules; S4, perform conflict detection on the new rules generated by S3 and the rules corresponding to the policy obtained by S1, and put the new rules into the rule base when there is no conflict, and put the new rules after the conflict is resolved into the rule base when there is a conflict. The present invention belongs to the field of information security in cloud environments.

Description

Technical Field

[0001] The present invention belongs to the field of information security in cloud environments, and in particular relates to a policy adaptive control method based on a cloud environment. Background Art

[0002] A cloud environment refers to an Internet or big data environment that can provide computing power, storage capacity, or virtual machine services to users or various application systems on demand from a dynamic virtualized resource pool.

[0003] Cloud environment equipment mainly refers to computing resource equipment (CPU, memory, etc.), storage resource equipment (database, etc.) and network resource equipment (firewalls, data center switches, VPNs and routers, etc.).

[0004] Due to the large number of network devices in cloud environments and the large and complex policies corresponding to each device, manually assigning permissions to each network device is becoming increasingly complex. Efficient, accurate, dynamic, and adaptive policy configuration for network devices in cloud environments, and thus dynamic control of resource access requests, is of great practical significance and value. However, existing research on network devices is limited to individual network devices, and there is no method for collaborative policy decision-making across multiple network devices. Summary of the Invention

[0005] The purpose of the present invention is to configure the policies of network devices in a cloud environment efficiently, accurately, dynamically and adaptively, and propose a policy adaptive control method based on a cloud environment.

[0006] The specific process of a strategy adaptive control method based on cloud environment is as follows:

[0007] S1. Obtain the policies of three network devices from the current network environment, namely the policies of the SELinux system, firewall device, and switch device;

[0008] Define the current network environment model G, network path p, access request r, decision results of the firewall decision model, and multiple policy collaborative decision models M;

[0009] S2. Express the access request in the form of access request r, and then decompose it into multiple sub-request sequences according to the devices involved in r;

[0010] S3. Perform policy decisions on the sub-request sequence using a multi-policy collaborative decision model to obtain a final decision result α for the current access sub-request sequence. If the access request differs from the final decision result α, new AV policy rules, new firewall policy rules, and new switch policy rules are generated.

[0011] The multiple policy collaborative decision-making models are SELinux system, firewall equipment and OpenFlow switch equipment;

[0012] S4. Conflict detection is performed on the generated new AV policy rules, new firewall policy rules, and new switch policy rules with the rules corresponding to the policies of the SELinux system, firewall device, and switch device obtained in S1. When there is no conflict, the new rules are placed in the rule base. When there is a conflict, the conflict is resolved and the resolved new rules are placed in the rule base.

[0013] The beneficial effects of the present invention are:

[0014] The present invention proposes a policy adaptive control method based on a cloud environment. First, the present invention proposes a dynamic policy calculation method based on a multi-policy collaborative decision-making model for cross-host access control, dynamically controls the policies of the SELinux system, firewall equipment and OpenFlow switch, and generates new rules for the corresponding equipment required by the request when the request is different from the calculated result. Finally, the present invention proposes a policy adaptive method corresponding to multiple network devices, automatically analyzes, detects and repairs conflicts caused by new rules, and realizes policy adaptive control of multiple devices. The present invention adopts an efficient policy analysis method to dynamically generate and optimize policies, thereby improving the policy adaptive control capability of resource access requests under the three devices of SELinux system, firewall and switch across hosts. BRIEF DESCRIPTION OF THE DRAWINGS

[0015] Figure 1 This is an example diagram of the network environment topology;

[0016] Figure 2 The overall design diagram of the dynamic strategy calculation method for the multi-strategy collaborative decision-making model;

[0017] Figure 3 This is a diagram of SELinux access control functions based on the rule engine;

[0018] Figure 4 This is the flow chart of PC-NN classifier;

[0019] Figure 5 This is the flow chart of the P2R-Gap classifier;

[0020] Figure 6 This is the flow chart of the AP-CM classifier;

[0021] Figure 7 This is the flow chart of DT classifier;

[0022] Figure 8 It is the lower limit clue tree diagram;

[0023] Figure 9 It is the upper limit clue tree diagram;

[0024] Figure 10 Flowchart of the greedy firewall policy conflict resolution algorithm;

[0025] Figure 11 Example diagram of a B+ tree constructed for OpenFlow switch policy. DETAILED DESCRIPTION

[0026] Specific implementation method 1: The specific process of this implementation method of a strategy adaptive control method based on a cloud environment is as follows:

[0027] The cloud-based policy adaptive control method provided by this invention can be applied to the information security field of cloud environments, improving the policy adaptive control capability of resource access requests across three devices in the cloud environment: the SELinux system, firewall, and switch. The specific implementation process is as follows:

[0028] Adaptive control across hosts;

[0029] Cross-host access control is adaptive control between the local SELinux system, firewall devices, and switch devices;

[0030] S1. Obtain the policies (policy is a set of rules) of the three network devices in this article from the current network environment, namely the policies (policy is a set of rules) of the SELinux system, firewall device, and switch device;

[0031] Define the current network environment model G, the network path p, the access request r, the decision result of the firewall decision model (the decision result refers to the matching of the access request with the policy rules. For example, if the policy rule states that the user subject is not allowed to access the object, then the decision result is deny), the decision result of the switch decision model (the decision result refers to the matching of the access request with the policy rules. For example, if the policy rule states that the user subject is not allowed to access the object, then the decision result is deny), and the multi-policy collaborative decision model M.

[0032] S2. Express the access request in the form of access request r, and then decompose it into multiple sub-request sequences according to the devices involved in r;

[0033] The access request is expressed as an access request r (access request r, r = (r1, r2 ... r n ), where r1, r2…r nis a constraint on the current access request), and then decomposed into multiple sub-request sequences according to the devices involved in r (the three devices in this article: SELinux system, firewall, switch; when the device involved in the path of the network interconnection environment model has one of these three devices, r is decomposed into the request sub-sequence corresponding to the device by extracting the corresponding fields; for example, the SELinux request sub-sequence is the subject domain type corresponding to the user and the object to be operated; the firewall request sub-sequence is the source IP address, destination IP address, etc.; the switch request sub-sequence is the source MAC address, destination MAC address, etc.);

[0034] S3. Perform policy decisions on the sub-request sequence using a multi-policy collaborative decision model to obtain a final decision result α for the current access sub-request sequence. If the access request differs from the final decision result α, new AV policy rules, new firewall policy rules, and new switch policy rules are generated.

[0035] The multiple policy collaborative decision-making models are SELinux system, firewall equipment and OpenFlow switch equipment;

[0036] S4. Conflict detection is performed on the generated new AV policy rules, new firewall policy rules, and new switch policy rules with the rules corresponding to the policies of the SELinux system, firewall device, and switch device obtained in S1 (policy is a collection of rules). When there is no conflict, the new rules are placed in the rule base. When there is a conflict, the conflict is resolved and the resolved new rules are placed in the rule base.

[0037] Specific embodiment 2: This embodiment differs from specific embodiment 1 in that S1 obtains the policies of the three network devices in this article (policy is a set of rules) from the current network environment, namely, the policies of the SELinux system, the firewall device, and the switch device (policy is a set of rules);

[0038] Define the current network environment model G, the network path p, the access request r, the decision result of the firewall decision model (the decision result refers to the matching of the access request with the policy rules. For example, if the policy rule states that the user subject is not allowed to access the object, then the decision result is deny), the decision result of the switch decision model (the decision result refers to the matching of the access request with the policy rules. For example, if the policy rule states that the user subject is not allowed to access the object, then the decision result is deny), and the multi-policy collaborative decision model M. The specific process is as follows:

[0039] Define the current network environment model G, G = (V, E), where V represents the set of device nodes in the network environment, E = {(V, V)} represents the set of connections between nodes V → V, and use the links function Edge(v) = {m|(V, n)∈E} to represent all nodes n connected to node V; the current network environment topology is shown in the figure below. Figure 1 shown.

[0040] Define the network path p, p=(s,t,V p ,E p ), where s represents the source node of the path, t represents the destination node of the path, and V p ={v1,v2,…,v k} represents the set of nodes involved in the path, E p ={(s,v1),(v1,v2),…,(v k ,t)} represents the set of network connections between nodes; v1 represents the first node in the path, v k represents the kth node in the path;

[0041] Define access request r, r=(r1,r2…r n ), where r1, r2…r n It is a restriction on the current access request and is related to the condition matching part above the data packet field; for example, r={IP sr =10.0.6.21,IP dest =10.0.8.12,Protocol=TCP}, indicating that the protocol is TCP access request flow between two IP addresses;

[0042] The policy of the SELinux system is the five-tuple rule in the AV policy document, namely action, subject_domain, object_type, object_class, permissions (action, subject domain, object type, object class, permissions);

[0043] The rules that define the firewall decision model are Match f →Action f ;

[0044] Match f =(IP sr ,IP dest ,Port sr ,Port dest ,Protocol),

[0045] Among them, Match fIt is the condition matching domain of the rules of the firewall decision model, that is, the firewall packet filtering domain, IP sr Indicates the source IP address. The matching domain can be a specific IP address or a network segment. dest Indicates the destination IP address. The value is the same as IP sr Same; Port sr Indicates the source port number. Since the port number occupies two bytes in the data packet, its value range is 0 to 2. 16 Any integer within -1; Port dest Indicates the destination port number, the value range is the same as Port sr Same; Protocol indicates the protocol type of the data packet, including TCP, UDP or ICMP, etc.

[0046] Action f ={allow,deny},

[0047] Action f Firewall action domain, which indicates the operation performed by the firewall rule on the matching data packet. Common values are allow (allow) or deny (deny);

[0048] The rule defining the switch decision model is Match j →Action j ,

[0049] Match j =(ingress,mac sr ,mac dest ,IP sr ,IP dest ,Port sr ,Port dest ,Protocol),

[0050] Among them, Match j Indicates the conditional matching domain of the switch decision model, that is, the switch packet filtering domain, ingress indicates the port where the packet flows in, mac sr Indicates the source MAC address of the data packet, mac dest Indicates the destination MAC address of the data packet; the meanings of the remaining fields are the same as those of the firewall rules.

[0051] Action j ={set field :n,output:port,drop},

[0052] Among them, Action jThe switch execution action domain indicates the operation performed by the switch rule on the matching data packet. Common values include modification (set field :n), discard (drop) and forward (output:port);

[0053] Define a multi-strategy collaborative decision model M, M=(r,p st ,ca,α);

[0054] Among them, r is the access request composed of the data packet fields, p st is the set of paths from the source node to the target node supported by the current network topology G, ca represents the condition attribute given to the access request (the condition attribute means that the network communication must pass through router S2), and α is the result of the final decision, which is either allow or deny. The overall design diagram of the dynamic strategy calculation method of the multi-strategy collaborative decision model is shown in Figure 2 As shown;

[0055] For example, the network administrator wants to apply a policy: Ana is a user in the IT department, the host IP address of the user is 192.168.16.1, and the user is allowed to access the database service with the IP address 192.168.12.10 and port 1531. Network communication must pass through router S2.

[0056] Where r = {IP sr =192.168.16.1,IP dest =192.168.12.10,Protocol=TCP,Port dest =1531}, and the matching network path is p = (IT, DB, S2). Therefore, if there is a device on all network paths that meets the required policy rules and instruction set, then the decision α of the multi-policy collaborative decision model M is allowed; otherwise, it is rejected. Therefore, the decision results of collaborative computing need to be verified by rules on multiple devices on the path.

[0057] Other steps and parameters are the same as those in the first embodiment.

[0058] Specific implementation method three: This implementation method differs from specific implementation methods one or two in that, in S3, policy decisions are made on the sub-request sequence through a multi-policy collaborative decision model to obtain the final decision result α of the current access sub-request sequence; and new AV policy rules, new firewall policy rules and new switch policy rules are generated when the access request is different from the final decision result α obtained.

[0059] The multiple policy collaborative decision-making models are SELinux system, firewall equipment and OpenFlow switch equipment;

[0060] The specific process is:

[0061] S31, the SELinux system, the firewall device, and the OpenFlow switch device each make access control decisions on the sub-request sequence (comparing the three device rules with the three device request sub-sequences. If the request meets the requirements, the decision result is permission. Otherwise, it is not allowed). Three matching results are obtained. If one of them is not allowed, the final result is not allowed; if all of them meet the requirements, the final result is allowed. The expression is:

[0062] α:act1∧act2∧…∧act n →{allow,deny},

[0063] Among them i represents the decision result generated by a single device (for example, act1 is the SELinux decision to allow, act2 is the firewall decision to allow, and act3 is the switch decision to deny, so the final decision is deny; only when the access decisions of all devices on a path are allowed can the entire access request be allowed;), ∧ represents the intersection, deny represents denial; α represents the final decision result;

[0064] S32, generating new AV policy rules, new firewall policy rules, and new switch policy rules when the access request is different from the final decision result α; the specific process is:

[0065] When the administrator finds that an access request should be allowed, but the final decision result α is denied, a new permission rule should be issued to the device that denied the access request so that the device can allow the access request. For example, the final decision result a of this request is denied, but the administrator insists on allowing this request.

[0066] When the administrator finds that an access request should be denied, but the final decision result α is allowed, a new denial rule should be issued to the device that allows the access request, so that the device that allows the access request denies the access request; for example, the final decision result α of this request is allowed, but the administrator finds it unsafe and must deny the request.

[0067] The specific process of issuing a new allow rule or issuing a new deny rule is as follows:

[0068] The authorization that should be allowed or denied is combined with the information in the access sub-request of SELinux, firewall, and switch devices to generate new AV policy rules, new firewall policy rules, and new switch policy rules (for example: firewall rule matchf->actionf. The request only contains matchf information. Adding actionf becomes a new rule).

[0069] Other steps and parameters are the same as those in the first or second embodiment.

[0070] Specific embodiment 4: This embodiment differs from specific embodiments 1 to 3 in that the SELinux access control function diagram based on the rule engine is as follows: Figure 3 As shown, the specific process of generating new AV policy rules is as follows:

[0071] A. Collect data from the SELinux system to form known access patterns and unknown access patterns in the rule base. The specific process is as follows:

[0072] Collect data from the SELinux system, namely AV policy documents, audit logs, attribute and type mapping documents, and type and specific file mapping documents;

[0073] Standardize AV policy documents, audit logs, attribute-to-type mapping documents, and type-to-specific file mapping documents;

[0074] Detect and resolve policy conflicts (resolve administrator settings) on standardized AV policy documents;

[0075] The standardization process is to first remove noise and then convert it into JSON format;

[0076] If there is no conflict after the normalized AV policy document is detected, the normalized AV policy document without conflict is added to the policy list in the rule base for storage, and the normalized AV policy document without conflict is combined with the two mapping documents to form a known access pattern in the rule base (the normalized AV policy document without conflict is combined with the attribute and type mapping document and the type and specific file mapping document to form a known pattern);

[0077] If a conflict is detected in the standardized AV policy document, the conflicting standardized AV policy document is resolved, and the resolved AV policy document is placed in the policy list in the rule base for storage. The resolved AV policy document is combined with the two mapping documents to form a known access pattern in the rule base (the conflicting AV policy document is converted into a non-conflicting document after resolution. The non-conflicting AV policy document is combined with the two mapping document attribute and type mapping documents, and type and specific file mapping documents to form a known pattern);

[0078] Policy conflict detection involves applying seven policy conflict detection methods to standardized AV policy documents, which are then resolved by the administrator. The resolved AV policy documents are combined with two mapping documents to form known access patterns in the rule base.

[0079] After policy generation, policy conflict detection, and resolution, a new policy is generated. The new policy is then tested against known access patterns using seven policy conflict detection methods, and the administrator resolves the conflict. Ultimately, a new, conflict-free rule is obtained.

[0080] The standardized audit logs form unknown access patterns in the rule base;

[0081] The AV policy document records the rule set for the subject's access rights to the object; the AV policy rules include five basic elements, namely action, subject_domain, object_type, object_class, and permissions (action, subject domain, object type, object class, and permissions); AV policy rules are divided into allow and neverallow types of AV policy rules;

[0082] The audit log records access requests denied by SELinux. The audit log types are divided into AVC and SYSCALL log entries;

[0083] AVC is the access vector cache; SYSCALL is the system call;

[0084] The policy conflict detection method is:

[0085] Direct conflict: This refers to a conflict that occurs when the subject, object, and operation are the same but the authorizations are different.

[0086] There is a conflict as follows:

[0087] Known modes: allow system_t device_t:lnk_file{write,read}

[0088] New access mode: neverallow system_t device_t:lnk_file{write,read}

[0089] Object file category conflict: Considers the inclusion relationship between object categories, but conflicts arising from different authorizations, such as directories and files;

[0090] There is a conflict as follows:

[0091] Known pattern: allow tmp_t obj_t:dir{getattr}

[0092] New access mode: neverallow tmp_t obj_t:file{getattr}

[0093] Access rights conflicts: Consider the priority relationship between access rights, but conflicts arising from different authorizations, such as read and write;

[0094] There is a conflict as follows:

[0095] Known patterns: allow tmp_t obj_t:file{write}

[0096] New access mode: neverallow tmp_t obj_t:file{read open}

[0097] Subject-object cross-conflict: Conflicts arise when different subject types contain the same file but have different authorizations;

[0098] There is a conflict as follows:

[0099] Known patterns: allow tmp_t obj_t:file{write}

[0100] New access mode: neverallow fx_t obj_t:file{write}

[0101] Indirect reading of unauthorized files: This conflict occurs when a user indirectly calls other programs and reads files that they do not have permission to read.

[0102] There is a conflict as follows:

[0103] Known modes: neverallow user_t secure_t:file{read}

[0104] New access modes: allow user_t obj_t:file{read} allow obj_t secure_t:file{read}

[0105] Indirect modification of unauthorized files: This conflict occurs when a user indirectly calls other programs and modifies files that they do not have permission to modify.

[0106] There is a conflict as follows:

[0107] Known modes: neverallow user_t secure_t:file{write}

[0108] New access modes: allow user_t obj_t:file{write} allow obj_t secure_t:file{write}

[0109] Indirect call of unauthorized programs: This conflict occurs when a user indirectly calls other programs and performs unauthorized operations.

[0110] There is a conflict as follows:

[0111] Known patterns: neverallow user_t secure_t:file{delete}

[0112] New access modes: allow user_t obj_t:file{write} allow obj_t secure_t:file{delete}

[0113] The policies detected by the above seven policy conflict detection methods are resolved to generate corresponding rules and conflict JSON files; finally, the resolved rule-generated policy .te file is loaded into the SELinux system.

[0114] All of this data can be exported from the SELinux system in text format, which is not suitable as input for the algorithm. Therefore, in this project, we first extract the values of valid fields in the source data and generate a JSON format that is convenient for formal calculations.

[0115] An example of AV policy rules before standardization is as follows:

[0116] allow user_t system_t:file{read}

[0117] An example of an audit log before standardization is as follows:

[0118] type=AVC msg=audit(1647861379.113:1134):avc:denied{open}for pid=64207comm="head" path=" / proc / sys / fs / file-nr" dev="proc"ino=39152scontext=staff_u:staff_r:staff_t:s0-s0:c0.c1023 tcontext=system_u:object_r:sysctl_fs_t:s0tclass=file permissive=1

[0119] type=SYSCALL msg=audit(1647861379.113:1134):arch=c000003e syscall=257success=yes exit=3a0=ffffff9c a1=7ffd1d9c7d2b a2=0a3=0items=0ppid=64204pid=64207auid=1002uid=1002gid=1002euid=1002suid=1002fsuid=1002egid=1002sgid= 1002fsgid=1002tty=(none)ses=4comm="head"exe=" / usr / bin / head"subj=staff_u:staff_r:staff_t:s0-s0:c0.c1023 key=(null)

[0120] The standardized JSON file is shown below. Because the original AV policy document of the system may have been manually modified and there are conflicting rules, the AV policy document needs to be screened. Through the seven policy conflict detection methods in the policy generation and detection engine, benign policy rules are extracted, namely direct conflict, object file category conflict, access permission conflict, subject-object cross conflict, indirect reading of unauthorized files conflict, indirect modification of unauthorized files conflict and indirect calling of unauthorized files conflict. The construction of AV policy list, known pattern and unknown pattern in the rule base is as follows. Figure 3 shown.

[0121] Standardized AV policy rules:

[0122] {

[0123] "policy_id":1,

[0124] "action":"allow",

[0125] "subject_domain":"user_t",

[0126] "object_type":"system_t",

[0127] "object_class":"file",

[0128] "permissions":[

[0129] "read" ]

[0131] }

[0132] Standardized audit log document:

[0133] {

[0134] "log_id":1,

[0135] "subject":" / usr / bin / head",

[0136] "subject_domain":"staff_t",

[0137] "object":" / proc / sys / fs / file-nr",

[0138] "object_type":"sysctl_fs_t",

[0139] "object_class":"file",

[0140] "permissions":[

[0141] "open"

[0142] ],

[0143] "timestamp":"1647861379"

[0144] }

[0145] B. Use different classifiers and known access patterns in the rule base to classify unknown access patterns in the rule base. When the classification results of most classifiers are the same, that is, they all judge a rule to be allowed or denied (2 allow and 2 deny, the classification result is 0, and the authorization status of the rule cannot be determined), then the result is output as the final classification result, and new AV policy rules are generated based on the unknown access pattern and the classification results of the unknown access pattern.

[0146] The other steps and parameters are the same as those in the first to third embodiments.

[0147] Specific embodiment 5: This embodiment differs from specific embodiments 1 to 4 in that B) uses different classifiers and known access patterns in the rule base to classify unknown access patterns in the rule base. When the classification results of most classifiers are the same, that is, they all judge a rule as allowing or denying (two allow and two deny, the classification result is 0, and the authorization status of the rule cannot be determined), this result is output as the final classification result, and a new AV policy rule is generated based on the unknown access pattern and the classification result of the unknown access pattern. The specific process is as follows:

[0148] PC-NN Classifier:

[0149] This project is based on the idea of the nearest neighbor classification algorithm, using access pattern relevance as a distance measurement method, and proposes a nearest neighbor classifier algorithm based on access pattern relevance (PC-NN). The design principle is that when multiple known access patterns (or subjects) are connected to the same new access pattern (or subject), the new access pattern (or subject) should be inferred based on the majority of connected known neighbors to determine whether it should be allowed or denied; the PC-NN classifier flow chart is as follows: Figure 4 shown.

[0150] P2R-Gap Classifier:

[0151] Based on the similarity between unknown patterns and existing rules, this project proposes a classifier algorithm based on pattern-rule distance (P2R-Gap) to achieve the classification of unknown patterns. The design principle is to calculate the distance between the policy rules of the unknown pattern and the known pattern; if the access permission of the known pattern rule closest to the unknown pattern is allowed, the unknown pattern is considered benign; if the access permission of the known pattern rule closest to the unknown pattern is denied, the unknown pattern is considered malicious; if the calculated distance between the unknown pattern and the policy rules of the known pattern does not reach the classification threshold, that is, it is not close to any authorization type of rule, the unknown pattern is kept in an unclassified state; the P2R-Gap classifier flow chart is as follows Figure 5 shown.

[0152] AP-CM Classifier:

[0153] Based on the co-occurrence between access patterns in audit logs, this project proposes a classifier algorithm based on the access pattern co-occurrence matrix (AP-CM) to achieve the classification of unknown patterns. The working principle is to consider the correlation between access patterns based on the statistical relationship between unknown patterns and known patterns that often appear together in audit logs. It is generally believed that benign access behaviors or malicious attacks usually involve a series of access patterns, which are captured and recorded in the audit logs at the same time. In other words, patterns that occur at the same time as benign access behaviors should also be benign, and if access behaviors that occur at the same time are always rejected by the system, then the access request should also be malicious. If an unknown pattern and a known pattern appear at the same time, the known pattern can be used to infer the classification of the unknown pattern (the unknown pattern and the known pattern are the same); if the unknown pattern and the known pattern do not appear at the same time, the unknown pattern is kept in an unclassified state; the AP-CM classifier flow chart is as follows Figure 6 shown.

[0154] DT Classifier:

[0155] This project proposes a classifier algorithm based on decision tree (DT) based on the consistency of subject and object types of unknown patterns and known rules to realize the classification of unknown patterns. The working principle is based on the consistency of subject and object types of access requests. If a known access control policy allows a certain type of subject to perform operations on a certain type of object, then when an unknown access pattern applies to this type of subject and attempts to access this type of object again, the policy is considered benign. Therefore, if the unknown access control policy finds a matching known access control policy, that is, it has the same subject domain type, object type and object category, the classification of the unknown pattern is inferred based on the known pattern; if no matching known access control policy is found, it remains in an unclassified state; this judgment method has greater randomness than the previous three methods, so it is suitable for comparison of patterns of the same type. The DT classifier flow chart is as follows Figure 7 shown.

[0156] When most classifiers have the same classification results, that is, they all judge a rule as allow or deny (if 2 allow and 2 deny, the classification result is 0, and the authorization status of the rule cannot be determined), the result is output as the final calculation result, and a new AV policy rule is generated based on the classification result;

[0157] The specific process of generating new AV policy rules based on the classification results is as follows:

[0158] The four basic elements of unknown access mode are subject_domain, object_type, object_class, and permissions (subject domain, object type, object class, and permissions).

[0159] The four basic elements of the unknown access pattern and the classification results form a five-tuple of new AV policy rules;

[0160] A rule with a classification result of 1 is given positive authorization, a rule with a classification result of -1 is given negative authorization, and a rule with a classification result of 0 cannot be added to a new rule set.

[0161] The other steps and parameters are the same as those in the first to fourth embodiments.

[0162] Specific embodiment 6: This embodiment differs from any one of specific embodiments 1 to 5 in that, in S4, the generated new AV policy rules, new firewall policy rules, and new switch policy rules are detected for conflicts with the rules corresponding to the SELinux system, firewall device, and switch device policies (a policy is a collection of rules) obtained in S1. If there is no conflict, the new rules are placed in the rule base. If there is a conflict, the conflict is resolved and the resolved new rules are placed in the rule base. The specific process is as follows:

[0163] The generated new rules (new AV policy rules, new firewall policy rules and new switch policy rules) are checked with the original rules of the device to achieve policy adaptive control of multiple devices.

[0164] S41. When the final decision result obtained in S3 includes the new AV policy rule, a policy conflict detection (seven policy conflict detection methods) is performed on the new AV policy rule based on the known access pattern (excluding no processing). If there is no conflict, the final decision result obtained in S2 corresponds to the requested new rule, which is the final result. If there is a conflict, the conflict is resolved, and the decision result after the resolution corresponds to the requested new rule, which is the final result.

[0165] S42. When the decision result obtained in S3 includes a new firewall policy rule, a policy conflict detection (a firewall policy adaptive method based on greedy thinking and a clue tree) is performed on the new firewall policy rule according to the known firewall policy rules (excluding non-processing). If there is no conflict, the final decision result obtained in S3 corresponds to the requested new rule, which is the final result; if there is a conflict, the conflict is resolved, and the decision result after the resolution corresponds to the requested new rule, which is the final result;

[0166] S43. When the decision result obtained by S3 contains a new switch policy rule, a policy conflict detection (OpenFlow switch policy adaptive method based on bit vector and B+ tree) is performed on the new switch policy rule according to the known switch policy rule (excluding no processing). If there is no conflict, the final decision result obtained by S3 corresponds to the requested new rule, which is the final result; if there is a conflict, the conflict is resolved, and the decision result after the resolution corresponds to the requested new rule, which is the final result.

[0167] Proceed based on the new device rules contained in the obtained policy result. For example, if there are no new SELinux rules, skip S41 and proceed directly to S42.

[0168] If all three devices exist, proceed in the order of S31, S32, and S33.

[0169] The other steps and parameters are the same as those in the first to fifth embodiments.

[0170] Specific embodiment seven: This embodiment differs from any one of specific embodiments one to six in that, in step S42, when the decision result obtained in step S3 includes a new firewall policy rule, a policy conflict detection is performed on the new firewall policy rule according to the known firewall policy rules (a firewall policy adaptive method based on greedy thinking and a clue tree) (excluding non-processing); the specific process is as follows:

[0171] S421, digitize the values of the five matching fields of the known firewall policy rule and the new firewall policy rule;

[0172] Since the value of the firewall rule matching domain can be a specific value, a network segment range value, and a wildcard, it is necessary to match the five matching domains (Match f =(IP sr ,IP dest ,Port sr ,Port dest ,Protocol), where Match f It is the condition matching domain of the rules of the firewall decision model, that is, the firewall packet filtering domain; IP sr Indicates the source IP address; IP dest Indicates the destination IP address; Port sr Indicates the source port number; Port dest Indicates the destination port number; Protocol indicates the protocol type of the data packet, including TCP, UDP, or ICMP, etc.;) the value is digitized (for IP addresses, a 64-bit integer is used to encode the protocol type, 0 and 1 are used to represent TCP and UDP, and wildcards do not need to be digitized.).

[0173] Convert the matching domain value of each rule in the existing rule set to a range, indicating that the range of the wildcard character "*" is all values on the matching domain.

[0174] Specifically, this project is introduced using the firewall rules in the firewall rule example table as an example. For example, IP sr 140.192.37.0 / 24 means the IP address range is 140.192.37.0 to 140.192.37.255. sr The interval is represented as [2361402624, 2361402879].

[0175] Firewall rule example table

[0176]

[0177] S422: Construct an AVL tree based on the value set in the matching domain, and thread the AVL tree to obtain a lower limit thread tree and an upper limit thread tree. The specific process is as follows:

[0178] S4221, according to the value set in the matching domain (firewall rule Match f =

[0179] (IP sr ,IPdest ,Port sr ,Port dest ,Protocol), construct an AVL tree with the numerical value after digitization;

[0180] S4222. Thread the AVL tree to obtain a lower limit thread tree and an upper limit thread tree. The process is as follows:

[0181] Each node in the interval lower bound clue tree stores all rule numbers that are less than or equal to the current node value;

[0182] Each node in the interval upper limit clue tree stores all rule numbers that are greater than or equal to the current node value;

[0183] The AVL tree is a balanced binary tree;

[0184] The threading process aggregates rule numbers. Specifically, each node in the lower limit thread tree stores all rule numbers less than or equal to the current node value; each node in the upper limit thread tree stores all rule numbers greater than or equal to the current node value.

[0185] Specifically, taking the "Destination Port" column data in the table as an example, the range values of each rule under the current dimension are counted, and the lower limit of the range value is classified into the lower limit set, and the upper limit is classified into the upper limit set. For example, in the firewall rule example table: the interval lower limit set is [83, 84, 80, 80, 90, 85, 88, 92, 94]; the interval upper limit set is [87, 86, 83, 88, 93, 89, 90, 95, 95]. Figure 8 is the lower limit clue tree constructed, Figure 9 It is the upper limit clue tree;

[0186] S423. Calculate the interval intersection according to the clue tree and resolve the intersection. If there is no conflict, the final decision result obtained in S2 corresponds to the requested new rule, which is the final result; if there is a conflict, resolve the conflict, and the result of the decision after the resolution corresponds to the requested new rule, which is the final result.

[0187] The other steps and parameters are the same as those in the first to sixth embodiments.

[0188] Specific embodiment eight: This embodiment differs from specific embodiments one to seven in that, in step S423, the interval intersection is calculated based on the clue tree and the intersection is resolved. If there is no conflict, the final decision result obtained in step S2 corresponds to the requested new rule, which is the final result; if there is a conflict, the conflict is resolved, and the decision result after the resolution corresponds to the requested new rule, which is the final result. The specific process is as follows:

[0189] S4231. Use the upper limit value of a matching domain interval in the new firewall policy rule to search for the node with the largest value among the nodes less than or equal to the upper limit value in the constructed lower limit clue tree (for example, in the interval [83, 87], search for the largest node less than or equal to 87 in the lower limit clue tree and find 85; search for the largest node greater than or equal to 83 in the upper limit clue tree and find 83);

[0190] S4232. Use the lower limit of a matching domain interval in the new firewall policy rule to search for the node with the smallest value among the nodes greater than or equal to the lower limit in the constructed upper limit clue tree (for example, the interval [83, 87]. Search the upper limit clue tree for the maximum node greater than or equal to 83, and find 83;);

[0191] Take the intersection of the rule sets of the largest node obtained in S4231 and the smallest node obtained in S4232 (for example, the interval [83, 87]. Search the clue tree for the largest node less than or equal to 87 at the lower limit of the interval and find 85; search the clue tree for the largest node greater than or equal to 83 at the upper limit of the interval and find 83; then the rule set for 85 is {1, 2, 3, 4, 6}, and the rule set for 83 is {1, 2, 3, 4, 5, 6, 7, 8, 9}; the intersection is {1, 2, 3, 4, 6}). This is the rule number for a certain matching domain of the new firewall policy rule that has an intersection. Calculate the intersection of the rule number sets of all matching domains (5 matching domains). The intersection is the rule number set that may cause conflict in the new rule.

[0192] Compare the intersection of the rule number set with the five fields (IP sr ,IP dest ,Port sr ,Port dest ,Protocol), if all five domains have an inclusion relationship, then the known firewall policy rule is in conflict with the new firewall policy rule; if not all five domains have an inclusion relationship, then the known firewall policy rule is in conflict with the new firewall policy rule;

[0193] If there is no conflict, the final decision result obtained by S2 corresponds to the requested new rule and is the final result; if there is a conflict, the conflict is resolved, and the decision result after the resolution corresponds to the requested new rule and is the final result;

[0194] The process of the digestion is:

[0195] 1. Generate all packets covered by the new firewall policy rules using Libnet packet generation technology;

[0196] 2. Use known firewall policy rules to identify and classify data packets generated by new firewall policy rules, including correct decisions and incorrect decisions, and correct incorrect decisions;

[0197] The decision-making identification and classification of the data packets generated by the new firewall rules using the existing firewall policy rules include correct decisions and incorrect decisions. The specific process is as follows:

[0198] Convert existing firewall policies into all-match firewall decision diagrams (all-match FDDs);

[0199] A fully matched firewall decision graph is a typical representative of a firewall policy. Any firewall policy can be converted into an equivalent fully matched firewall decision graph.

[0200] The decision graph can be used to retrieve the first firewall policy rule that the data packet matches. This rule also determines whether the subsequent operation of the data packet is to allow or deny.

[0201] The specific process of correcting wrong decisions is as follows:

[0202] A. Next, we adopt the greedy idea to correct the order of rules (change the labels of rules 1, 2, 3, and 4 in the clue tree) and change the action of the rules. f (Action f There are three ways to reduce the number of wrong decision packets: change, change allow to deny, deny to allow) and delete redundant rules;

[0203] B. If the number of packets with incorrect decisions remains unchanged after the three corrections, you need to compensate for the new firewall policy rules (5 rules plus one rule), and repeat the A and B processes (correcting the order of rules, changing the rule action, etc.) f Threshold and deletion of redundant rules, and a new compensation method) until the number of all wrong decision packets is zero, thereby completing the conflict resolution of the new firewall policy rules.

[0204] Specifically, there are only two firewall rules R x With R y Five matching domains R x [field i ] and R y [field j ]When all containment relationships exist, rule R x With R y Conflicts may occur. To match the field i For example, when calculating with field i When there are existing rule sets that intersect, this is done by using fieldi The upper limit value of the interval is used to find the node with the largest value among the nodes less than or equal to the value in the constructed lower limit clue tree of the interval, using field i The lower limit of the interval is found in the constructed upper limit clue tree of the interval, and the node with the smallest value among the nodes is greater than or equal to the value. The intersection of the rule sets matching the two clue trees is the current matching domain field. i The rule numbers for the intersections are calculated in the same way as for other matching domains.

[0205] In the firewall rule example table, in Port dest Take the search for rule numbers that intersect with the interval [83, 87] in the column construction clue tree as an example. First, Figure 8 The clue tree represented by searching for the maximum node less than or equal to 87, it can be found that the node value 85 is the target node, and the corresponding rule number set is {1, 2, 3, 4, 6}, then Figure 9 The clue tree represented by the search is greater than or equal to the minimum node 83. It can be found that the node value 83 is the target node, and the corresponding rule number set is {1, 2, 3, 4, 5, 6, 7, 8, 9}. The intersection of the two sets is {1, 2, 3, 4, 6}. The intersection at this time represents the matching domain Port dest There is an intersection of rule numbers in the interval [83, 87]. Each matching domain will generate a rule number set, and finally calculate the intersection of the rule number sets of all matching domains. The intersection is the new rule R new A set of rule numbers that may conflict, comparing the Action in the rule set with the newly added rule f Domain, if it has unequal Action f domain, then the rule is in genuine conflict with the new rule.

[0206] Specifically, Figure 10 The process of the algorithm is described in detail. First, all the data packets covered by the new rules are generated through data packet generation technology. Then, the existing firewall policy rules are used to make decisions and identify the data packets generated by the new rules. The method for data packet decision identification is to convert the existing firewall policy into all-match FDDs. The first firewall policy rule that the data packet matches can be retrieved through FDD. This rule also determines the subsequent operation of the data packet, whether it is accept or drop. After calculating the data packets with correct decisions and incorrect decisions, the algorithm will use a greedy approach to correct the data packets with incorrect decisions. First, the action of correcting the rule order and changing the rule is adopted. fThe three methods of correcting the wrong decision packets are to add new rules, add new rules, and delete redundant rules. If the number of wrong decision packets remains unchanged after the three corrections, it is necessary to compensate them by adding new rules. Repeat this process until the number of all wrong decision packets is zero, thus completing the policy conflict resolution.

[0207] The other steps and parameters are the same as those in the first to seventh embodiments.

[0208] Specific embodiment nine: This embodiment differs from any one of specific embodiments one to eight in that, in step S43, when the decision result obtained in step S3 includes a new switch policy rule, a policy conflict detection (OpenFlow switch policy adaptive method based on bit vector and B+ tree) is performed on the new switch policy rule according to the known switch policy rule (excluding non-processing). If there is no conflict, the final decision result obtained in step S2 corresponds to the requested new rule, which is the final result; if there is a conflict, the conflict is resolved, and the decision result after the resolution corresponds to the requested new rule, which is the final result. The specific process is as follows:

[0209] S431. Construct a B+ tree. The specific process is as follows:

[0210] Condition matching domain of known switch policy rules and new switch policy rules (Match j =(ingress,mac sr ,mac dest ,IP sr ,IP dest ,Port sr ,Port dest ,Protocol), Match j Each matching domain in the switch decision model corresponds to a dimension, and a B+ tree is constructed in each dimension. The specific process is as follows:

[0211] First, define the keyword Key and node value Value in the B+ tree;

[0212] The keyword Key is a hash value that matches the domain attribute.

[0213] Since there are cases where the Key hash value of multiple rules is the same, the node value Value stores the set of corresponding rule numbers;

[0214] Perform different hashing on the keyword Key and node value Value;

[0215] Since the domains of the rules are independent of each other, parallel computing is used to update the eight dimensions during index construction.

[0216] The eight dimensions are: (ingress,mac sr ,mac dest ,IP sr ,IP dest ,Port sr ,Port dest ,Protocol)

[0217] The calculation method of the matching domain attribute hash value is as follows:

[0218] When ingress is a single value A, the hash value is A*255+A; when ingress is in the range AB, the hash value is A*255+B; * represents multiplication, A is a single inbound port number value, and B is another inbound port number value;

[0219] Mac sr ,mac dest It is a single value, a specific value or a wildcard (*), and the hash value is the identification ID;

[0220] IP sr ,IP dest For single value CDEF and interval range CDEF / N, the hash value is C*2553+D*2552+E*255+F;

[0221] Among them, if the IP is 11.12.13.14 / 24, C is 11, D is 12, E is 13, F is 14, and N is the port number 24,

[0222] Port sr ,Port dest If the value is a single value H, the hash value is H*65535+H; if the value is an interval range [H,L], the hash value is H*65535+L;

[0223] When Protocol is a single value S, the hash value is S*255+S; when Protocol is in the interval [S, T], the hash value is S*255+T;

[0224] Figure 11 An example of a B+ tree constructed by an OpenFlow switch policy is shown, with p1, p2, and p3 as pointers.

[0225] S432, conflict detection; the specific process is as follows:

[0226] First, calculate each matching attribute value (matching domain attribute hash value) in the new switch rule and the known switch policy rule (switch rule, these eight attributes (ingress, mac sr ,mac dest ,IP sr ,IP dest,Port sr ,Port dest ,Protocol) has conflicting value ranges;

[0227] Then, take the intersection range of each matching attribute value in the new switch rule and each matching attribute value in the known switch policy rule where there is a conflict, and obtain a set of conflict intersection ranges (no intersection means no conflict);

[0228] Assuming that the number of matching domain attributes of the new rule is n, we get n sets of conflict intersection ranges;

[0229] The indexes of the n conflicting intersection ranges and the corresponding new rule number sets are obtained by searching the constructed B+ tree. The indexes of the n conflicting intersection ranges are stored in a bit vector (BV). The bit vector sets the positions that meet the search criteria to 1 and the positions that do not meet the search criteria to 0.

[0230] The index in the B+ tree node is a pointer, and the node stores the data with the rule number;

[0231] Then perform an “AND” operation on the n bit vectors;

[0232] In the bit vector result after n times of "AND" operation, the position that is still 1 indicates that the corresponding numbered known rule and the new rule have an intersection in the n-dimensional attributes. The conflict type is determined according to the matching domain attribute value and actionj domain value of the rule;

[0233] Conflict types are divided into redundancy conflicts, reverse redundancy conflicts, generalization conflicts and association conflicts, coverage conflicts, and partial redundancy conflicts;

[0234] Redundancy conflict: If the matching domain of the known rule and the matching domain of the new rule are both in an inclusion relationship and the value of the Action_j domain is the same, then the new rule is redundant and a redundancy conflict occurs between the rules;

[0235] Reverse redundancy conflict: If the matching domain of the new rule and the matching domain of the existing rule are both in an inclusion relationship and the value of the Action_j domain is the same, then the existing rule is redundant and a reverse redundancy conflict occurs between the rules;

[0236] Generalization conflict: If the known rule can match all matching domains of the new rule, but the new rule cannot match all matching domains of the known rule, and the values of the Action_j domain are different, then a generalization conflict occurs between the rules;

[0237] Association conflict: If the partial matching domain of the known rule can match the matching domain of the new rule, and the partial matching domain of the new rule can also match the matching domain of the known rule, and the values of Action_j are different, then an association conflict occurs between the rules;

[0238] Override conflict: If the matching domain of the known rule and the matching domain of the new rule are both in an inclusion relationship, and the Action_j domains are different, then an override conflict occurs between the rules;

[0239] Partial redundancy conflict: If the partial matching domain of the known rule and the corresponding matching domain of the new rule are both in an inclusion relationship, and the value of the Action_j domain is the same, then a partial redundancy conflict occurs between the rules.

[0240] S433. Use the OpenFlow switch policy conflict resolution algorithm to resolve different conflict types. The specific process is as follows:

[0241] The pseudo code of the algorithm is shown below.

[0242]

[0243] For redundancy conflicts, due to rule R new Has been R old Contains, just discard rule R new , complete the policy conflict resolution;

[0244] For reverse redundancy conflict, which is opposite to the case of redundancy conflict, rule R new Contains existing rule R old , now the existing rule R old Remove from the flow table rule set and add a new rule R new Go to the flow table rule set to complete policy conflict resolution;

[0245] For the resolution of generalization conflicts and association conflicts, this algorithm takes the new rules as the standard and updates the existing rules in the flow table rule set: so the existing rule R is removed. old With the new rule R new Overlapping matching address spaces; and adding new rules to the flow table rule set to complete policy conflict resolution;

[0246] For coverage conflicts, the new rules are also used as the benchmark, and the R old Remove and add R new To ensure policy security, the conflict is resolved by notifying the administrator for confirmation.

[0247] Finally, for partial redundancy conflict resolution, the deletion rule R is used. old, merge rule R old With Rule R new The matching space of the new rule R new Add it to the flow table rule set to resolve policy conflicts.

[0248] The other steps and parameters are the same as those in Specific Embodiments 1 to 8.

[0249] Specific embodiment 10: This embodiment differs from the specific embodiments 1 to 9 in that the calculation of each matching attribute value (matching domain attribute hash value) in the new switch rule and the known switch policy rule (switch rule, these eight attributes (ingress, mac sr ,mac dest ,IP sr ,IP dest ,Port sr ,Port dest ,Protocol) conflicting value ranges are calculated as follows:

[0250] When the hash value of ingress is A*255+A, the conflict range is {x*255+y|0≤x≤A,A≤y≤255,x≤y}; when the hash value of ingress is A*255+B, the conflict range is {x*255+y|0≤x≤B,A≤y≤255,x≤y};

[0251] Where x is the incoming port number value of the new rule, y is the incoming port number value of another new rule; * is the multiplication sign;

[0252] Mac sr ,mac dest The hash value is W, and the collision range is {W};

[0253] IP sr ,IP dest The hash value is K (the final result after calculating C*2553+D*2552+E*255+F is a single value). However, when the value is a single value, the conflict range is {K, the hash value of the corresponding URL}; but when the value is a range, the conflict range is {x, K≤x≤K+255};

[0254] Port sr ,Port dest The hash value is H*65535+H, and the collision range is {h*65535+l|0≤h≤H,H≤l≤65535,h≤l}; Port sr ,Port dest The hash value is H*65535+L, and the collision range is {h*65535+l0≤h≤L,H≤l≤65535,h≤l};

[0255] When the hash value of Protocol is S*255+S, the collision range is {ss*255+st|0≤ss≤S,S≤st≤255,ss≤st}; when the hash value of Protocol is S*255+T, the collision range is {ss*255+st|0≤ss≤T,S≤st≤255,ss≤st};

[0256] The other steps and parameters are the same as those in Specific Embodiments 1 to 9.

[0257] The above examples are merely illustrative of the calculation model and process of the present invention and are not intended to limit the embodiments of the present invention. Persons skilled in the art will readily appreciate that other variations or modifications based on the above description are possible. This list of embodiments is not exhaustive; however, any obvious variations or modifications derived from the technical solution of the present invention remain within the scope of protection of the present invention.

Claims

1. A strategy adaptive control method based on a cloud environment, characterized by: The specific process of the method is: S1. Obtain the policies of three network devices from the current network environment, namely the policies of the SELinux system, firewall device, and switch device; S2. Express the access request in the form of access request r, r=(r1, r2…r n ), where r1, r2…r n It is a constraint restriction on the current access request; Then decompose it into multiple sub-request sequences according to the devices involved in r; S3. Perform policy decisions on the sub-request sequence using a multi-policy collaborative decision model to obtain a final decision result α for the current access sub-request sequence. If the access request differs from the final decision result α, new AV policy rules, new firewall policy rules, and new switch policy rules are generated. The multi-strategy collaborative decision-making model includes SELinux system, firewall equipment and OpenFlow switch equipment; The specific process is: S31, SELinux system, firewall device and OpenFlow switch device make access control decisions on the sub-request sequence respectively, and obtain three matching results. If one of them is not allowed, the final result is not allowed; if all of them are allowed, the final result is allowed. The expression is: α:act1∧act2∧…∧act n →{allow,deny}, Among them i Represents the decision result generated by a single device, ∧ represents intersection, deny represents denial; α represents the final decision result; S32, generating new AV policy rules, new firewall policy rules, and new switch policy rules when the access request is different from the final decision result α; The specific process is: When the administrator finds that an access request should be allowed, but the final decision result α is denied, a new permission rule should be issued to the device that denied the access request to allow the access request to be allowed. When the administrator finds that an access request should be denied, but the final decision result α is to allow, a new deny rule should be issued to the device that allowed the access request, so that the device that allowed the access request will deny the access request; The specific process of issuing a new allow rule or issuing a new deny rule is as follows: Combine the authorization that should be allowed or denied with the access sub-request information of SELinux, firewall, and switch devices to generate new AV policy rules, new firewall policy rules, and new switch policy rules; S4. Conflict detection is performed on the generated new AV policy rules, new firewall policy rules, and new switch policy rules with the rules corresponding to the policies of the SELinux system, firewall device, and switch device obtained in S1. When there is no conflict, the new rules are placed in the rule base. When there is a conflict, the conflict is resolved and the resolved new rules are placed in the rule base.

2. The cloud-based adaptive control method according to claim 1, characterized in that: S1, obtaining the policies of three network devices from the current network environment, namely, the policies of the SELinux system, the firewall device, and the switch device; Define the current network environment model G, network path p, access request r, the decision results of the firewall decision model, the decision results of the switch decision model, and the multi-strategy collaborative decision model M. The specific process is as follows: Define the current network environment model G, G = (V, E), where V represents the set of device nodes in the network environment, E = {(V, V)} represents the set of connections that allow communication between nodes V → V, and the links function is used to represent all nodes connected to node V; Define the network path p, p=(s,t,V p ,E p ), where s represents the source node of the path, t represents the destination node of the path, and V p ={v1,v2,…,v k } represents the set of nodes involved in the path, E p ={(s,v1),(v1,v2),…,(v k ,t)} represents the set of network connections between nodes; v1 represents the first node in the path, v k represents the kth node in the path; The policy of the SELinux system is the five-tuple rule in the AV policy document; The rules that define the firewall decision model are Match f →Action f ; Match f =(IP sr ,IP dest ,Port sr ,Port dest ,Protocol), Among them, Match f It is the condition matching domain of the rules of the firewall decision model, that is, the firewall packet filtering domain, IP sr Indicates the source IP address; IP dest Indicates the destination IP address; Port sr Indicates the source port number; Port dest Indicates the destination port number; Protocol indicates the protocol type of the data packet, including TCP, UDP or ICMP; Action f ={allow,deny}, Action f Firewall action domain, indicating the operation performed by the firewall rule on the matching data packet, with values of allow or deny; The rule defining the switch decision model is Match j →Action j , Match j =(ingress,mac sr ,mac dest ,IP sr ,IP dest ,Port sr ,Port dest ,Protocol), Among them, Match j Indicates the conditional matching domain of the switch decision model, that is, the switch packet filtering domain, ingress indicates the port where the packet flows in, mac sr Indicates the source MAC address of the data packet, mac dest Indicates the destination MAC address of the data packet; Action j ={set field :n,output:port,drop}, Among them, Action j The switch action field indicates the operation performed by the switch rule on the matching data packet. The values include modify, discard, and forward. Define a multi-strategy collaborative decision model M, M=(r,p st ,ca,α); Among them, r is the access request composed of the data packet fields, p st It is the set of paths from the source node to the target node supported by the current network topology G. ca represents the conditional attribute given by the access request, and α is the result of the final decision, which is either allow or deny.

3. The cloud-based adaptive control method according to claim 2, characterized in that: The specific process of generating new AV policy rules is as follows: A. Collect data from the SELinux system to form known access patterns and unknown access patterns in the rule base. The specific process is as follows: Collect data from the SELinux system, namely AV policy documents, audit logs, attribute and type mapping documents, and type and specific file mapping documents; Standardize AV policy documents, audit logs, attribute-to-type mapping documents, and type-to-specific file mapping documents; Detect and resolve policy conflicts on standardized AV policy documents; The standardization process is to first remove noise and then convert it into JSON format; If there is no conflict after the standardized AV policy document is detected, the conflict-free standardized AV policy document is placed in the policy list in the rule base for storage, and the conflict-free standardized AV policy document is combined with the two mapping documents to form a known access pattern in the rule base; If there is a conflict after the standardized AV policy document is detected, the conflicting standardized AV policy document is resolved, and the resolved AV policy document is placed in the policy list in the rule base for storage. The resolved AV policy document is combined with the two mapping documents to form a known access pattern in the rule base. The standardized audit logs form unknown access patterns in the rule base; The AV policy document records the rule set of the subject's access rights to the object; the AV policy rules include five basic elements, namely action, subject_domain, object_type, object_class, and permissions; AV policy rules are divided into allow and neverallow types of AV policy rules; The audit log records access requests denied by SELinux. The audit log types are divided into AVC and SYSCALL log entries; AVC is the access vector cache; SYSCALL is the system call; The policy conflict detection method is: Direct conflict: This refers to a conflict that occurs when the subject, object, and operation are the same but the authorizations are different. Object file category conflict: Considers the inclusion relationship between object categories, but conflicts arising from different authorizations; Access rights conflict: Consider the priority relationship between access rights, but conflicts caused by different authorizations; Subject-object cross-conflict: Conflicts arise when different subject types contain the same file but have different authorizations; Indirect reading of unauthorized files: This conflict occurs when a user indirectly calls other programs and reads files that they do not have permission to read. Indirect modification of unauthorized files: This conflict occurs when a user indirectly calls other programs and modifies files that they do not have permission to modify. Indirect call of unauthorized programs: This conflict occurs when a user indirectly calls other programs and performs unauthorized operations. B. Use different classifiers and known access patterns in the rule base to classify unknown access patterns in the rule base. When the classification results of most classifiers are the same, that is, they all judge a certain rule as allow or deny, then the result is output as the final classification result. New AV policy rules are generated based on the unknown access pattern and the classification results of the unknown access pattern.

4. The cloud-based adaptive control method according to claim 3, characterized in that: B. Using different classifiers and known access patterns in the rule base to classify unknown access patterns in the rule base, if most classifiers have the same classification results, that is, if they all judge a rule as allow or deny, then the result is output as the final classification result, and a new AV policy rule is generated based on the unknown access pattern and the classification result of the unknown access pattern. The specific process is as follows: PC-NN Classifier: When multiple known access patterns connect to the same new access pattern, it is inferred whether the new access pattern should be allowed or denied based on the connected known neighbors; P2R-Gap Classifier: If the access permission of the known pattern rule closest to the unknown pattern is allowed, the unknown pattern is considered benign; if the access permission of the known pattern rule closest to the unknown pattern is denied, the unknown pattern is considered malicious; if the calculated distance between the unknown pattern and the policy rule of the known pattern does not reach the classification threshold, that is, it is not close to any authorization type rule, the unknown pattern remains unclassified; AP-CM Classifier: If the unknown pattern and the known pattern appear at the same time, the known pattern can be used to infer the classification of the unknown pattern; if the unknown pattern and the known pattern do not appear at the same time, the unknown pattern is kept in an unclassified state; DT Classifier: If an unknown access control policy finds a matching known access control policy, i.e., one with the same subject domain type, object type, and object category, the classification of the unknown pattern is inferred based on the known pattern; If no matching known access control policy is found, the class remains unclassified; When most classifiers have the same classification results, that is, they all judge a rule as allow or deny, the result is output as the final calculation result, and a new AV policy rule is generated based on the classification result; The specific process of generating new AV policy rules based on the classification results is as follows: The four basic elements of unknown access mode are subject_domain, object_type, object_class, and permissions; The four basic elements of the unknown access pattern and the classification results form a five-tuple of new AV policy rules; A rule with a classification result of 1 is given positive authorization, a rule with a classification result of -1 is given negative authorization, and a rule with a classification result of 0 cannot be added to a new rule set.

5. The cloud-based adaptive control method according to claim 4, characterized in that: S4: Detect conflicts between the generated new AV policy rules, new firewall policy rules, and new switch policy rules and the rules corresponding to the policies of the SELinux system, firewall device, and switch device obtained in S1. If there is no conflict, the new rules are placed in the rule base. If there is a conflict, the conflict is resolved and the resolved new rules are placed in the rule base. The specific process is as follows: S41. When the final decision result obtained by S3 includes the new AV policy rule, a policy conflict detection is performed on the new AV policy rule based on the known access pattern. If there is no conflict, the final decision result obtained by S2 corresponding to the requested new rule is the final result. If there is a conflict, the conflict is resolved, and the decision result after the resolution corresponding to the requested new rule is the final result. S42. When the decision result obtained in S3 includes a new firewall policy rule, a policy conflict check is performed on the new firewall policy rule according to the known firewall policy rules. If there is no conflict, the final decision result obtained in S3 corresponds to the requested new rule, which is the final result. If there is a conflict, the conflict is resolved, and the decision result after the resolution corresponds to the requested new rule, which is the final result. S43. When the decision result obtained by S3 contains a new switch policy rule, a policy conflict detection is performed on the new switch policy rule according to the known switch policy rule. If there is no conflict, the final decision result obtained by S3 corresponds to the requested new rule, which is the final result; if there is a conflict, the conflict is resolved, and the decision result after the resolution corresponds to the requested new rule, which is the final result.

6. The cloud-based adaptive control method according to claim 5, characterized in that: In step S42, when the decision result obtained in step S3 includes a new firewall policy rule, a policy conflict detection is performed on the new firewall policy rule according to the known firewall policy rules. The specific process is as follows: S421, digitize the values of the five matching fields of the known firewall policy rule and the new firewall policy rule; S422, construct an AVL tree based on the value set in the matching domain, and thread the AVL tree to obtain a lower limit thread tree and an upper limit thread tree; The specific process is: S4221. Construct an AVL tree based on the value set in the matching domain; S4222. Thread the AVL tree to obtain a lower limit thread tree and an upper limit thread tree; The process is: Each node in the interval lower bound clue tree stores all rule numbers that are less than or equal to the current node value; Each node in the interval upper limit clue tree stores all rule numbers that are greater than or equal to the current node value; The AVL tree is a balanced binary tree; S423. Calculate the interval intersection according to the clue tree and resolve the intersection. If there is no conflict, the final decision result obtained in S2 corresponds to the requested new rule, which is the final result; if there is a conflict, resolve the conflict, and the result of the decision after the resolution corresponds to the requested new rule, which is the final result.

7. The cloud-based adaptive control method according to claim 6, characterized in that: The S423, calculates the interval intersection according to the clue tree, and resolves the intersection. If there is no conflict, the final decision result obtained in S2 corresponds to the requested new rule, which is the final result; if there is a conflict, the conflict is resolved, and the decision result after the resolution corresponds to the requested new rule, which is the final result. The specific process is: S4231. Use the upper limit value of a matching domain interval of the new firewall policy rule to search for the node with the largest value among the nodes that are less than or equal to the lower limit value in the constructed clue tree of the lower limit of the interval; S4232, using a matching domain interval lower limit value of the new firewall policy rule, searching for a node with the smallest value among nodes whose values are greater than or equal to the interval upper limit value in the constructed interval upper limit clue tree; The intersection of the rule sets of the largest node obtained in S4231 and the smallest node obtained in S4232 is the rule number of a matching domain of the new firewall policy rule that has an intersection. The intersection of the rule number sets of all matching domains is calculated, and the intersection is the rule number set that will cause a conflict with the new rule. Compare the five fields in the intersection of the rule number set with the new firewall policy rule. If all five fields have an inclusion relationship, then the known firewall policy rule actually conflicts with the new firewall policy rule. If not all five fields have an inclusion relationship, then the known firewall policy rule does not conflict with the new firewall policy rule. If there is no conflict, the final decision result obtained by S2 corresponds to the requested new rule and is the final result; if there is a conflict, the conflict is resolved, and the decision result after the resolution corresponds to the requested new rule and is the final result; The process of the digestion is:

1. Generate all packets covered by the new firewall policy rules using Libnet packet generation technology; 2. Use known firewall policy rules to identify and classify data packets generated by new firewall policy rules, including correct decisions and incorrect decisions, and correct incorrect decisions; The decision-making identification and classification of the data packets generated by the new firewall rules using the existing firewall policy rules include correct decisions and incorrect decisions. The specific process is as follows: Convert existing firewall policies into a fully matched firewall decision graph; The decision graph can be used to retrieve the first firewall policy rule that the data packet matches. This rule also determines whether the subsequent operation of the data packet is to allow or deny. The specific process of correcting wrong decisions is as follows: A. Correct the order of rules and change the action of rules f and deleting redundant rules to reduce the number of wrong decision packets; B. If the number of packets with incorrect decisions remains unchanged after the three corrections, the new firewall policy rules need to be compensated and the A and B processes are repeated until the number of all packets with incorrect decisions is zero, thus completing the conflict resolution of the new firewall policy rules.

8. The cloud-based adaptive control method according to claim 7, characterized in that: In the aforementioned S43, when the decision result obtained in S3 includes a new switch policy rule, a policy conflict detection is performed on the new switch policy rule according to the known switch policy rule. If there is no conflict, the final decision result obtained in S2 corresponds to the requested new rule, which is the final result; if there is a conflict, the conflict is resolved, and the decision result after the resolution corresponds to the requested new rule, which is the final result. The specific process is as follows: S431. Construct a B+ tree. The specific process is as follows: Each matching domain in the condition matching domain of the known switch policy rule and the new switch policy rule corresponds to a dimension, and a B+ tree is constructed in each dimension. The specific process is as follows: First, define the keyword Key and node value Value in the B+ tree; The keyword Key is a hash value that matches the domain attribute. Since there are cases where the Key hash value of multiple rules is the same, the node value Value stores the set of corresponding rule numbers; Update eight dimensions using parallel computing; The eight dimensions are: (ingress,mac sr ,mac dest ,IP sr ,IP dest ,Port sr ,Port dest ,Protocol) The calculation method of the matching domain attribute hash value is as follows: When ingress is a single value A, the hash value is A*255+A; when ingress is in the range AB, the hash value is A*255+B; * represents multiplication, A is a single inbound port number value, and B is another inbound port number value; Mac sr ,mac dest It is a single value, a specific value or a wildcard (*), and the hash value is the identification ID; IP sr ,IP dest For single value CDEF and interval range CDEF / N, the hash value is C*2553+D*2552+E*255+F; Among them, if the IP is 11.12.13.14 / 24, C is 11, D is 12, E is 13, F is 14, and N is the port number 24, Port sr ,Port dest If the value is a single value H, the hash value is H*65535+H; if the value is an interval range [H,L], the hash value is H*65535+L; When Protocol is a single value S, the hash value is S*255+S; when Protocol is in the interval [S, T], the hash value is S*255+T; S432, conflict detection; the specific process is as follows: First, the conflicting value ranges of each matching attribute value in the new switch rule and the known switch policy rule are calculated; Then, take the intersection range where each matching attribute value in the new switch rule conflicts with each matching attribute value in the known switch policy rule to obtain a set of conflicting intersection ranges; Assuming that the number of matching domain attributes of the new rule is n, we get n sets of conflict intersection ranges; The indexes of n conflicting intersection ranges and the corresponding new rule number sets are obtained by searching the constructed B+ tree. The indexes of n conflicting intersection ranges are stored as bit vectors. The bit vectors set the positions that meet the search conditions to 1 and the positions that do not meet the search conditions to 0. Then perform an AND operation on the n bit vectors; In the bit vector result after n times of "AND" operation, the position that is still 1 indicates that the known rule with the corresponding number and the new rule have intersections in the n-dimensional attributes. j Domain value judgment conflict type; Conflict types are divided into redundancy conflicts, reverse redundancy conflicts, generalization conflicts and association conflicts, coverage conflicts, and partial redundancy conflicts; Redundancy conflict: If the matching domain of the known rule and the matching domain of the new rule are both inclusive, and the Action j If the domain values are the same, then the new rule is redundant and a redundancy conflict occurs between the rules; Reverse redundancy conflict: If the matching domain of the new rule and the matching domain of the known rule are both included, and the Action j If the values of the domains are the same, then the known rules are redundant and a reverse redundancy conflict occurs between the rules; Generalization conflict: If the known rule can match all matching domains of the new rule, but the new rule cannot match all matching domains of the known rule, and the Action j If the values of the domains are different, then a generalization conflict occurs between the rules; Association conflict: If the partial matching domain of the known rule can match the matching domain of the new rule, and the partial matching domain of the new rule can also match the matching domain of the known rule, and the Action j If the values of are different, then there is an association conflict between the rules; Overwrite conflict: If the matching domain of the known rule and the matching domain of the new rule are both inclusive, and the Action j If the domains are different, then there is an overwriting conflict between the rules; Partial redundancy conflict: If the partial matching domain of the known rule and the matching domain corresponding to the new rule are both inclusive, and the Action j If the values of the domains are the same, then there is a partial redundancy conflict between the rules; S433. Use the OpenFlow switch policy conflict resolution algorithm to resolve different conflict types. The specific process is as follows: For redundant conflicts, just discard the new rule R new , complete the policy conflict resolution; For reverse redundancy conflicts, the new rule R new Contains existing rule R old , now the existing rule R old Remove from the flow table rule set and add a new rule R new Go to the flow table rule set to complete policy conflict resolution; To resolve generalization conflicts and association conflicts: remove the existing rule R old With the new rule R new Overlapping matching address spaces; and adding new rules to the flow table rule set to complete policy conflict resolution; For overlay conflict resolution: replace the existing rule R in the flow table rule set old Remove and add new rule R new In the flow table rule set, the conflict resolution is prompted to the administrator for confirmation; To resolve some redundant conflicts: delete the existing rule R old , merge existing rules R old With the new rule R new The matching space of the new rule R new Add it to the flow table rule set to resolve policy conflicts.

9. The cloud-based adaptive control method according to claim 8, characterized in that: The calculation method for calculating the value range of each matching attribute value that conflicts between the new switch rule and the known switch policy rule is as follows: When the hash value of ingress is A*255+A, the conflict range is {x*255+y|0≤x≤A,A≤y≤255,x≤y}; when the hash value of ingress is A*255+B, the conflict range is {x*255+y|0≤x≤B,A≤y≤255,x≤y}; Where x is the incoming port number value of the new rule, y is the incoming port number value of another new rule; * is the multiplication sign; Mac sr ,mac dest The hash value is W, and the collision range is {W}; IP sr ,IP dest The hash value is K. When the value is a single value, the conflict range is {K, the hash value of the corresponding URL}; but when the value is an interval range, the conflict range is {x, K≤x≤K+255}; Port sr ,Port dest The hash value is H*65535+H, and the collision range is {h*65535+l|0≤h≤H,H≤l≤65535,h≤l}; Port sr ,Port dest The hash value is H*65535+L, and the collision range is {h*65535+l0≤h≤L,H≤l≤65535,h≤l}; When the hash value of Protocol is S*255+S, the collision range is {ss*255+st|0≤ss≤S,S≤st≤255,ss≤st}. When the hash value of Protocol is S*255+T, the collision range is {ss*255+st|0≤ss≤T,S≤st≤255,ss≤st}.

Images