Artificial intelligence-based firewall policy management method

Abstract

The present application relates to a firewall policy management method based on artificial intelligence, deeply analyzes the characteristics of abnormal traffic, proposes a multi-dimensional entropy value approximate efficient estimation algorithm, which can effectively reduce the time and space complexity of the entropy value calculation algorithm, and improve the entropy sequence distinguishing ability to abnormal; On the basis of correlation analysis, a support vector regression machine is used to model the detection statistics to predict the optimal detection threshold; A multi-window correlation detection algorithm is proposed to fully utilize the correlation of abnormal trends and improve the detection accuracy of a single detection system; A random forest, OC-SVM classifier and online incremental training method are used to effectively improve the detection accuracy, reduce the dependence on users and avoid security defects; Through the study of an intelligent diagnosis prediction model based on wavelet packet analysis and two-dimensional matrix, the context correlation detection analysis and accurate prediction of high sustained threat attacks under the condition of no sample or few samples are realized.

Description

Technical Field

[0001] This invention relates to the field of computer technology, and in particular to a firewall policy management method based on artificial intelligence. Background Technology

[0002] In recent years, with the increasing power of hardware computing and the ever-growing volume of data, research on the application of deep learning in cyberspace security has gradually emerged, particularly in the development of effective model building methods for malware detection and intrusion detection. Deep learning is applied to multi-dimensional and complex systems in industrial field computing, networking, control, and physical environments. By fusing data from traditional network infrastructure such as backbone network nodes, user networks, and user terminals with industrial field systems, it effectively identifies unknown threats and predicts potential risk behaviors, enabling intelligent security threat diagnosis based on global data of assets, traffic, logs, boundaries, and links.

[0003] The integration of large-scale industrial control networks and deep learning in the context of new global trends presents significant challenges in the field of cyberspace security. Major scientific issues include: multi-layered networks requiring protocol compatibility to simplify complex network structures and improve adaptability; limited sample size and uneven data distribution due to complex systems, resulting in low recognition rates; and inefficient modeling that fails to meet the real-time requirements for predicting the behavior of industrial control networks. Summary of the Invention

[0004] This invention addresses the technical problems existing in the prior art by providing an artificial intelligence-based firewall policy management method. This method solves the problems of single samples in multi-layered networks, inconsistent and uneven data samples due to complex systems, low recognition rate, and low modeling efficiency, which fail to meet the real-time requirements of industrial control network behavior prediction.

[0005] The present invention addresses the aforementioned technical problems. In a first aspect, embodiments of the present invention provide the following technical solution: a firewall policy management method based on artificial intelligence, the method comprising:

[0006] Step S1: Collect multidimensional heterogeneous data in the industrial control network. The multidimensional heterogeneous data is the network traffic data of the multi-layer network in the industrial control network, which includes backbone network nodes, user network and user terminals.

[0007] Step S2: Determine the time-series data of each network traffic data within the time window, and perform anomaly detection on the time-series data through a classification model, dividing the time-series data into abnormal data and normal data, and extracting multi-dimensional security events from the time-series data;

[0008] Step S3: Construct a data context feature set based on the abnormal data and the normal data; construct an intelligent diagnostic prediction model based on wavelet packet analysis and two-dimensional matrix; train the intelligent diagnostic prediction model based on the multi-dimensional security events and the data context feature set; and perform intelligent diagnosis and prediction of security threats to the industrial control network based on the trained intelligent diagnostic prediction model.

[0009] Preferably, step S2 further includes:

[0010] For backbone network nodes, a multidimensional entropy approximation algorithm is used to determine the common characteristics of network traffic data. Based on the correlation between the entropy sequences of network traffic data, the multidimensional entropy sequences of each time window are arranged into detection vectors. Based on the OC-SVM detection vector classification algorithm, for detection vectors with a misclassification ratio greater than a preset ratio threshold, a data acquisition accuracy optimization algorithm is used to perform comprehensive detection at multiple time points.

[0011] Preferably, in step S2, the multidimensional entropy sequence includes one or more of the following: source IP entropy sequence, destination IP entropy sequence, source port entropy sequence, destination port entropy sequence, and IP packet length entropy sequence.

[0012] Preferably, step S1 specifically includes:

[0013] Multidimensional heterogeneous data from industrial control networks is collected based on IPv4 / IPv6 and Modbus / S7 industrial protocols. Based on a pre-determined extraction and format conversion rule base, data is automatically extracted in a multi-threaded manner and then converted and processed according to Hadoop big data methods to unify the data format.

[0014] Preferably, in step S2, the classification model includes a random forest classifier and an SVM classifier;

[0015] Anomaly detection is performed on the time-series data using a classification model, specifically including:

[0016] A detection engine is constructed, which includes multiple anomaly detection systems. The detection statistics of each anomaly detection system are modeled based on support vector regression machine to predict the optimal detection threshold. The detection capability of the detection statistics is determined based on the information gain method, and the detection capability is used as the weight of each anomaly detection system.

[0017] The time-series data is initially classified and feature-combined based on a random forest classifier, and then the combined features are further classified based on the SVM classifier. The combined features are then input into the detection engine according to the weights of the anomaly detection system.

[0018] Preferably, the multi-dimensional security events include one or more of the following: abnormal network connection, botnet behavior, Trojan horse backlink, unauthorized download, brute-force attack, WebShell, DDoS, worm virus and unknown threat.

[0019] Preferably, a data context feature set is constructed based on the abnormal data and the normal data, specifically including:

[0020] A latent feature vector learning mechanism based on gradient descent is proposed, and a transformation mechanism for latent feature vectors is determined based on the initialized feature vectors to generate a data context feature set for multi-dimensional security events in a multi-layer network.

[0021] Secondly, embodiments of the present invention provide the following technical solution: a firewall policy management system based on artificial intelligence, comprising:

[0022] The data acquisition module collects multidimensional heterogeneous data from the industrial control network. The multidimensional heterogeneous data is network traffic data of a multi-layer network in the industrial control network, which includes backbone network nodes, user networks, and user terminals.

[0023] The classifier module determines the time-series data of each network traffic data within a time window, performs anomaly detection on the time-series data through a classification model, divides the time-series data into abnormal data and normal data, and extracts multi-dimensional security events from the time-series data.

[0024] The anomaly detection module employs a latent feature vector learning mechanism based on gradient descent and determines the transformation mechanism of latent feature vectors based on initialized feature vectors to generate a complete feature set of multi-dimensional security events for multi-layer networks. It constructs an intelligent diagnostic prediction model based on wavelet packet analysis and two-dimensional matrices, trains the intelligent diagnostic prediction model based on the multi-dimensional security events and the complete feature set, and uses the trained intelligent diagnostic prediction model to intelligently diagnose and predict security threats to industrial control networks.

[0025] Thirdly, the embodiments of the present invention provide the following technical solution: an electronic device, comprising:

[0026] Memory, used to store computer software programs;

[0027] A processor is used to read and execute the computer software program, thereby implementing the artificial intelligence-based firewall policy management method described in the first aspect embodiment.

[0028] Fourthly, the present invention provides the following technical solution: a non-transitory computer-readable storage medium, wherein the storage medium stores a computer software program for implementing the artificial intelligence-based firewall policy management method as described in the first aspect embodiment.

[0029] The beneficial effects of this invention are as follows: It deeply analyzes the characteristics of abnormal traffic and proposes a multi-dimensional entropy value approximation algorithm that effectively reduces the time and space complexity of entropy value calculation algorithms and improves the ability of entropy sequences to distinguish anomalies; addressing the correlation between entropy sequences, it arranges the multi-dimensional entropy sequences of each time window into detection vectors and employs the OC-SVM classification method to improve detection accuracy and generalization ability; when an anomaly occurs, the detection vectors between adjacent windows show similar changing trends, and a corresponding detection accuracy optimization method is proposed; based on correlation analysis, it proposes using support vector regression to model the detection statistics and predict the optimal detection threshold; and it proposes a multi-window association detection algorithm to fully utilize anomaly trends. This paper explores various methods to improve the detection accuracy of individual detection systems by addressing the correlation between network security data and data types. It proposes using random forests, OC-SVM classifiers, and online incremental / decremental training to effectively enhance detection accuracy, reduce reliance on users, and mitigate security vulnerabilities. A comprehensive reference feature set production mechanism is proposed, exploring a latent feature vector learning mechanism based on gradient descent. Based on initialized feature vectors, the transformation mechanism of latent features is studied to generate a comprehensive feature set integrating multi-layered network security events, including backbone network nodes, user networks, and user terminals. Furthermore, an intelligent diagnostic prediction model based on wavelet packet analysis and two-dimensional matrices is developed to achieve contextual correlation detection and analysis of security event data and accurate prediction of high-persistent threat attacks under conditions of no or few samples. A feedback optimization mechanism is established to continuously optimize the model. Attached Figure Description

[0030] Figure 1 This is a flowchart of an artificial intelligence-based firewall policy management method according to an embodiment of the present invention;

[0031] Figure 2 This is a roadmap for automated acquisition and processing of multi-level network data according to an embodiment of the present invention.

[0032] Figure 3 This is a schematic diagram illustrating the principle of efficient multi-level network data acquisition and processing in an embodiment of the present invention.

[0033] Figure 4 This is a roadmap for time-series-based data classification and anomaly detection technology according to embodiments of the present invention;

[0034] Figure 5 This is a schematic diagram illustrating the principle of time-series-based data classification and anomaly detection in an embodiment of the present invention.

[0035] Figure 6 This is a roadmap for a prediction engine technology based on time-series data, as described in an embodiment of the present invention.

[0036] Figure 7This is a schematic diagram illustrating the principle of intelligent diagnosis based on deep learning, according to an embodiment of the present invention.

[0037] Figure 8 A schematic diagram illustrating an embodiment of the electronic device provided by the present invention;

[0038] Figure 9 A schematic diagram illustrating an embodiment of the computer-readable storage medium provided by the present invention. Detailed Implementation

[0039] The principles and features of the present invention are described below with reference to the accompanying drawings. The examples given are only for explaining the present invention and are not intended to limit the scope of the present invention.

[0040] In this document, the term "embodiment" means that a particular feature, structure, or characteristic described in connection with an embodiment may be included in at least one embodiment of this application. The appearance of this phrase in various places throughout the specification does not necessarily refer to the same embodiment, nor is it a separate or alternative embodiment mutually exclusive with other embodiments. It will be explicitly and implicitly understood by those skilled in the art that the embodiments described herein can be combined with other embodiments.

[0041] The field of cyberspace security is extremely challenging, and its major scientific problems are reflected in: multi-layered networks, which require simplification of complex network structures and improvement of adaptability through protocol compatibility; single sample size, with complex systems leading to inconsistent and uneven data samples and low recognition rates; and inefficient modeling, which fails to meet the real-time requirements of industrial control network behavior prediction.

[0042] Therefore, embodiments of the present invention provide an artificial intelligence-based firewall policy management method and system. For coordinated attack events, the system employs four stages: data collection and preprocessing, model training and validation, security event prediction, and prediction performance monitoring. Historical events are used as initial input, and a probability distribution is predicted. Given a ranking, the event with the highest probability is selected as the prediction result. To maintain prediction accuracy, prediction performance monitoring tracks and reports whether the correct event was predicted. If the prediction accuracy drops below a certain threshold, the system automatically retrains the model. The following description, in conjunction with the accompanying drawings, illustrates an artificial intelligence-based firewall policy management method and system.

[0043] Figures 1 to 7 According to an embodiment of the present invention, a firewall policy management method based on artificial intelligence is provided, such as... Figure 1 As shown, the method includes:

[0044] Step S1: Collect multidimensional heterogeneous data in the industrial control network. The multidimensional heterogeneous data is the network traffic data of the multi-layer network in the industrial control network, which includes backbone network nodes, user networks and user terminals.

[0045] like Figure 2 As shown in this embodiment, multi-dimensional heterogeneous data in the industrial control network is collected based on the IPv4 / IPv6 protocol and the Modbus / S7 industrial protocol. By exploring the distribution patterns and data types of multi-level network data, common features of multi-source and multi-dimensional heterogeneous data are extracted. Traffic collection methods are explored, feature extraction rules for various types of heterogeneous data are realized, data is automatically extracted in a multi-threaded manner, and data format conversion and processing analysis are performed in conjunction with Hadoop big data technology to achieve a unified and standardized data format.

[0046] like Figure 3 As shown, this paper addresses the issue of data fusion between traditional network infrastructure such as backbone network nodes, user networks, and user terminals and industrial field systems. First, a data extraction and format conversion rule base is constructed. Next, an acquisition engine for intelligent identification of multi-layered network protocols is built, exploring automated data acquisition and processing mechanisms. Finally, methods for cleaning and classifying multimodal, massive, multi-dimensional, heterogeneous data are studied, and a time-series-based data cleaning framework is constructed to achieve data cleaning and multi-layered fusion and sorting models. A massive, multi-dimensional, heterogeneous traffic data storage architecture based on TSDB (Time Series Database) is established to generate high-quality traffic data.

[0047] Step S2: Determine the time-series data of each network traffic data within the time window, and perform anomaly detection on the time-series data through a classification model to divide the time-series data into abnormal data and normal data, and extract multi-dimensional security events from the time-series data.

[0048] In this embodiment, based on the analysis of the principles of large-scale network attacks such as worms and DDoS (Distributed Denial of Service) attacks, an efficient approximation algorithm for multidimensional entropy is used to extract the common features of multimodal massive data in network traffic. An OC-SVM-based detection vector classification algorithm is explored. For detection vectors that may be misclassified, an accuracy optimization algorithm is used to perform comprehensive detection at several time points, realizing a multi-layered fusion anomaly detection framework based on time series. Based on accurate identification of anomaly data, a high-quality anomaly knowledge graph is generated. Addressing the high-speed bandwidth requirements of backbone network node anomaly detection, the characteristics of anomaly traffic are analyzed in depth, and an efficient approximation algorithm for multidimensional entropy is proposed. This algorithm effectively reduces the time and space complexity of entropy calculation algorithms and improves the ability of entropy sequences to distinguish anomalies. Considering the correlation between entropy sequences, the multidimensional entropy sequences of each time window are arranged into detection vectors, and the OC-SVM classification method is used to improve detection accuracy and generalization ability. When anomalies occur, detection vectors between adjacent windows show similar changing trends, and a corresponding detection accuracy optimization method is proposed.

[0049] like Figure 4 As shown, for backbone network nodes, based on the multidimensional entropy approximation algorithm, the common characteristics of network traffic data are determined. Based on the correlation between the entropy sequences of network traffic data, the multidimensional entropy sequences of each time window are arranged into detection vectors. Based on the OC-SVM detection vector classification algorithm, for detection vectors with a misclassification ratio greater than a preset ratio threshold, the acquisition accuracy optimization algorithm performs comprehensive detection at multiple time points.

[0050] The multidimensional entropy sequence includes one or more of the following: source IP entropy sequence, destination IP entropy sequence, source port entropy sequence, destination port entropy sequence, and IP packet length entropy sequence.

[0051] like Figure 5 As shown, in the process of large-scale industrial control network traffic analysis and anomaly detection, certain measurement methods are usually used to describe the normal pattern of network traffic. If the traffic deviates significantly from the normal pattern, it is considered an anomaly. The core lies in selecting traffic features and using appropriate statistics (time series) for measurement. This embodiment mainly focuses on the comprehensive application of multi-sequence detection and data mining-related technologies. Using statistical or classification methods on time series of multiple network traffic-related statistics to detect anomalies is a widely used approach. Using classifiers and other methods on multiple time series has good scalability and is suitable for anomaly detection on high-speed networks. These methods learn a classification model from a given training dataset using statistical or machine learning methods, and then use this model to classify the collected samples, thereby separating abnormal and normal situations, ultimately achieving the purpose of anomaly detection.

[0052] For industrial protocols such as IPv4 / IPv6 and Modbus / S7, different anomaly detection systems employ different detection measures, and the detection capabilities corresponding to these measures vary. However, there is some correlation between the detection statistics. Based on the analysis of detection statistics from several typical anomaly detection systems, it was found that the detection statistics can be characterized by stochastic processes under normal conditions, and the impact of anomalies on network traffic is continuous. Furthermore, different detection statistics exhibit correlations under both normal and anomaly conditions. Based on this correlation analysis, a support vector regression machine is proposed to model the detection statistics and predict the optimal detection threshold. A multi-window correlation detection algorithm is proposed to fully utilize the correlation of anomaly trends and improve the detection accuracy of individual detection systems. A multi-measure correlation detection algorithm is proposed to fuse the results of multiple anomaly detection systems. To address the difficulty in determining weights in the proposed algorithms, the information gain method is used to describe the detection capability of each detection statistic, and this information gain is used as the weight for each detection system.

[0053] In this embodiment, the construction of classification vectors, the selection of classifiers, and the training of classifiers in the traffic anomaly detection system significantly affect the system's detection accuracy. The problems encountered in using classifiers are analyzed from four perspectives: detection accuracy, operational efficiency, security, and ease of use. It is proposed that using random forests, single-class support vector machines (OC-SVM) classifiers, and online incremental / decremental training methods can effectively improve detection accuracy. The time-series data is initially classified and features are combined based on a random forest classifier, and the combined features are then reclassified based on the SVM (Support Vector Machine) classifier. The reclassified features are then combined according to the weights of the anomaly detection system and input into the detection engine, reducing reliance on users and mitigating security vulnerabilities. Addressing the drift characteristics of network traffic, an adaptive incremental / decremental online training algorithm is first proposed. Subsequently, it is discovered that removing abnormal samples during online system operation effectively improves classifier accuracy.

[0054] Step S3: Construct a data context feature set based on the abnormal data and the normal data; construct an intelligent diagnostic prediction model based on wavelet packet analysis and two-dimensional matrix; train the intelligent diagnostic prediction model based on the multi-dimensional security events and the data context feature set; and perform model training based on the trained intelligent model.

[0055] like Figure 6 As shown in the figure, this embodiment extracts multi-dimensional security event integration from time-series data, studies the correlation mapping patterns of factors such as users, events, logs, traffic, and application operation, proposes a complete reference feature set production mechanism, explores the implicit feature vector learning mechanism based on gradient descent, and studies the transformation mechanism of implicit features based on initialized feature vectors, thereby generating a complete feature set integrating multi-layer network security events such as backbone network nodes, user networks, and user terminals. Based on this, an intelligent diagnostic prediction model based on wavelet packet analysis and two-dimensional matrices is studied. Various sensor signals during the workpiece processing are simultaneously collected, and wavelet packet decomposition transformation is performed on the data to be analyzed to obtain multiple two-dimensional matrices of wavelet packet coefficients. Each two-dimensional matrix of wavelet packet coefficients corresponds to an input of a feature extraction model, and the one-dimensional feature matrices output by each feature extraction model block are concatenated into a longer one-dimensional matrix, then feature fusion is performed, and a two-layer fully connected network is established, thereby obtaining the intelligent diagnostic prediction model. This enables contextual correlation detection and analysis of security event data and accurate prediction of high-persistent threat attacks under conditions of no or few samples. A feedback optimization mechanism is established to continuously optimize the model and address the prediction of security threats in multi-layered cyberspace and heterogeneous complex attack behaviors.

[0056] like Figure 7As shown, traditional RNNs suffer from the major problem of vanishing gradients. Because errors dilate or decay over time, they lose access to long-range contexts, limiting their modeling capabilities to short time series. To address this challenge, this study investigates a time series algorithm based on LSTM (Long Short-Term Memory) backpropagation for collaborative learning. For cooperative attack events, the algorithm employs four stages: data collection and preprocessing, model training and validation, security event prediction, and prediction performance monitoring. Historical events are used as initial input, and a probability distribution is predicted. Given a ranking, the event with the highest probability is selected as the prediction result. To maintain prediction accuracy, the prediction performance monitoring tracks and reports whether the correct event was predicted. If the prediction accuracy drops below a certain threshold, the system automatically retrains the model.

[0057] Secondly, embodiments of the present invention provide the following technical solution: a firewall policy management system based on artificial intelligence, comprising:

[0058] The data acquisition module collects multidimensional heterogeneous data from the industrial control network. The multidimensional heterogeneous data is network traffic data of a multi-layer network in the industrial control network, which includes backbone network nodes, user networks, and user terminals.

[0059] The classifier module determines the time-series data of each network traffic data within a time window, performs anomaly detection on the time-series data through a classification model, divides the time-series data into abnormal data and normal data, and extracts multi-dimensional security events from the time-series data.

[0060] The anomaly detection module employs a latent feature vector learning mechanism based on gradient descent and determines the transformation mechanism of latent feature vectors based on initialized feature vectors to generate a complete feature set of multi-dimensional security events for multi-layer networks. It constructs an intelligent diagnostic prediction model based on wavelet packet analysis and two-dimensional matrices, trains the intelligent diagnostic prediction model based on the multi-dimensional security events and the complete feature set, and uses the trained intelligent diagnostic prediction model to intelligently diagnose and predict security threats to industrial control networks.

[0061] Please see Figure 8 , Figure 8 This is a schematic diagram illustrating an embodiment of the electronic device provided in this invention. For example... Figure 8 As shown, this embodiment of the invention provides an electronic device 500, including a memory 510, a processor 520, and a computer program 511 stored in the memory 510 and executable on the processor 520. When the processor 520 executes the computer program 511, it performs the following steps:

[0062] Step S1: Collect multidimensional heterogeneous data in the industrial control network. The multidimensional heterogeneous data is the network traffic data of the multi-layer network in the industrial control network, which includes backbone network nodes, user network and user terminals.

[0063] Step S2: Determine the time-series data of each network traffic data within the time window, and perform anomaly detection on the time-series data through a classification model, dividing the time-series data into abnormal data and normal data, and extracting multi-dimensional security events from the time-series data;

[0064] Step S3: Construct a data context feature set based on the abnormal data and the normal data; construct an intelligent diagnostic prediction model based on wavelet packet analysis and two-dimensional matrix; train the intelligent diagnostic prediction model based on the multi-dimensional security events and the data context feature set; and perform intelligent diagnosis and prediction of security threats to the industrial control network based on the trained intelligent diagnostic prediction model.

[0065] Please see Figure 6 , Figure 6 This is a schematic diagram illustrating an embodiment of a computer-readable storage medium provided by an embodiment of the present invention. For example... Figure 6 As shown, this embodiment provides a computer-readable storage medium 600, on which a computer program 611 is stored. When the computer program 611 is executed by a processor, it performs the following steps:

[0066] Step S1: Collect multidimensional heterogeneous data in the industrial control network. The multidimensional heterogeneous data is the network traffic data of the multi-layer network in the industrial control network, which includes backbone network nodes, user network and user terminals.

[0067] Step S2: Determine the time-series data of each network traffic data within the time window, and perform anomaly detection on the time-series data through a classification model, dividing the time-series data into abnormal data and normal data, and extracting multi-dimensional security events from the time-series data;

[0068] Step S3: Construct a data context feature set based on the abnormal data and the normal data; construct an intelligent diagnostic prediction model based on wavelet packet analysis and two-dimensional matrix; train the intelligent diagnostic prediction model based on the multi-dimensional security events and the data context feature set; and perform intelligent diagnosis and prediction of security threats to the industrial control network based on the trained intelligent diagnostic prediction model.

[0069] It should be noted that the descriptions of each embodiment in the above embodiments have different focuses. For parts that are not described in detail in a certain embodiment, please refer to the relevant descriptions in other embodiments.

[0070] Those skilled in the art will understand that embodiments of the present invention can be provided as methods, systems, or computer program products. Therefore, the present invention can take the form of a completely hardware embodiment, a completely software embodiment, or an embodiment combining software and hardware aspects. Furthermore, the present invention can take the form of a computer program product embodied on one or more computer-usable storage media (including, but not limited to, disk storage, CD-ROM, optical storage, etc.) containing computer-usable program code.

[0071] This invention is described with reference to flowchart illustrations and / or block diagrams of methods, apparatus (systems), and computer program products according to embodiments of the invention. It will be understood that each block of the flowchart illustrations and / or block diagrams, and combinations of blocks in the flowchart illustrations and / or block diagrams, can be implemented by computer program instructions. These computer program instructions can be provided to a processor of a general-purpose computer, special-purpose computer, embedded computer, or other programmable data processing apparatus to produce a machine, such that the instructions, which execute via the processor of the computer or other programmable data processing apparatus, generate instructions for implementing the flowchart illustrations. Figure 1 One or more processes and / or boxes Figure 1 A device that provides the functions specified in one or more boxes.

[0072] These computer program instructions may also be stored in a computer-readable storage medium that can direct a computer or other programmable data processing device to function in a particular manner, such that the instructions stored in the computer-readable storage medium produce an article of manufacture including instruction means, which are implemented in a process Figure 1 One or more processes and / or boxes Figure 1 The function specified in one or more boxes.

[0073] These computer program instructions may also be loaded onto a computer or other programmable data processing equipment to cause a series of operational steps to be performed on the computer or other programmable equipment to produce a computer-implemented process, thereby providing instructions that execute on the computer or other programmable equipment for implementing the process. Figure 1 One or more processes and / or boxes Figure 1 The steps of the function specified in one or more boxes.

[0074] Although preferred embodiments of the invention have been described, those skilled in the art, upon learning the basic inventive concept, can make other changes and modifications to these embodiments. Therefore, the appended claims are intended to be interpreted as including both the preferred embodiments and all changes and modifications falling within the scope of the invention.

[0075] Obviously, those skilled in the art can make various modifications and variations to this invention without departing from its spirit and scope. Therefore, if these modifications and variations fall within the scope of the claims of this invention and their equivalents, this invention also intends to include these modifications and variations.

Claims

1. A firewall policy management method based on artificial intelligence, characterized in that, The method includes: Step S1: Collect multidimensional heterogeneous data in the industrial control network. The multidimensional heterogeneous data is the network traffic data of the multi-layer network in the industrial control network, which includes backbone network nodes, user network and user terminals. Step S2: Determine the time-series data of each network traffic data within the time window, and perform anomaly detection on the time-series data through a classification model, dividing the time-series data into abnormal data and normal data, and extracting multi-dimensional security events from the time-series data; Step S3: Construct a data context feature set based on the abnormal data and the normal data; construct an intelligent diagnostic prediction model based on wavelet packet analysis and two-dimensional matrix; train the intelligent diagnostic prediction model based on the multi-dimensional security events and the data context feature set; and perform intelligent diagnosis and prediction of security threats to the industrial control network based on the trained intelligent diagnostic prediction model. Step S2 further includes: For backbone network nodes, based on a multidimensional entropy approximation algorithm, common features of network traffic data are determined. Based on the correlation between entropy sequences of network traffic data, the multidimensional entropy sequences of each time window are arranged into detection vectors. The detection vectors are classified using a single-class support vector machine detection vector classification algorithm. For detection vectors with a misclassification ratio greater than a preset ratio threshold, a precision optimization algorithm is used to perform comprehensive detection at multiple subsequent time points.

2. The firewall policy management method based on artificial intelligence according to claim 1, characterized in that, In step S2, the multidimensional entropy sequence includes one or more of the following: source IP entropy sequence, destination IP entropy sequence, source port entropy sequence, destination port entropy sequence, and IP packet length entropy sequence.

3. The firewall policy management method based on artificial intelligence according to claim 1, characterized in that, Step S1 specifically includes: Multidimensional heterogeneous data from industrial control networks is collected based on IPv4 / IPv6 and Modbus / S7 industrial protocols. Based on a pre-determined extraction and format conversion rule base, data is automatically extracted in a multi-threaded manner and then converted and processed according to Hadoop big data methods to unify the data format.

4. The firewall policy management method based on artificial intelligence according to claim 1, characterized in that, In step S2, the classification model includes a random forest classifier and an SVM classifier; Anomaly detection is performed on the time-series data using a classification model, specifically including: A detection engine is constructed, which includes multiple anomaly detection systems. The detection statistics of each anomaly detection system are modeled based on support vector regression machine to predict the optimal detection threshold. The detection capability of the detection statistics is determined based on the information gain method, and the detection capability is used as the weight of each anomaly detection system. The time-series data is initially classified and feature-combined based on a random forest classifier, and then the combined features are further classified based on a support vector machine classifier. The combined features are then input into the detection engine based on the weights of the anomaly detection system.

5. The firewall policy management method based on artificial intelligence according to claim 4, characterized in that, The multi-dimensional security events include one or more of the following: abnormal network connections, botnet behavior, Trojan horse backlinks, unauthorized downloads, brute-force attacks, WebShell, distributed denial-of-service attacks, worm viruses, and unknown threats.

6. The firewall policy management method based on artificial intelligence according to claim 1, characterized in that, A data context feature set is constructed based on the abnormal data and the normal data, specifically including: A latent feature vector learning mechanism based on gradient descent is proposed, and a transformation mechanism for latent feature vectors is determined based on the initialized feature vectors to generate a data context feature set for multi-dimensional security events in a multi-layer network.

7. A firewall policy management system based on artificial intelligence, characterized in that, include: The data acquisition module collects multidimensional heterogeneous data from the industrial control network. The multidimensional heterogeneous data is network traffic data of a multi-layer network in the industrial control network, which includes backbone network nodes, user networks, and user terminals. The classifier module determines the time-series data of each network traffic data within a time window, performs anomaly detection on the time-series data through a classification model, divides the time-series data into abnormal data and normal data, and extracts multi-dimensional security events from the time-series data. For backbone network nodes, based on a multidimensional entropy approximation algorithm, the common characteristics of network traffic data are determined. Based on the correlation between the entropy sequences of network traffic data, the multidimensional entropy sequences of each time window are arranged into detection vectors. The detection vectors are classified based on a single-class support vector machine detection vector classification algorithm. For detection vectors with a misclassification ratio greater than a preset ratio threshold, a precision optimization algorithm is used to perform comprehensive detection at multiple subsequent time points. The anomaly detection module employs a latent feature vector learning mechanism based on gradient descent and determines the transformation mechanism of latent feature vectors based on initialized feature vectors to generate a complete feature set of multi-dimensional security events for multi-layer networks. It constructs an intelligent diagnostic prediction model based on wavelet packet analysis and two-dimensional matrices, trains the intelligent diagnostic prediction model based on the multi-dimensional security events and the complete feature set, and uses the trained intelligent diagnostic prediction model to intelligently diagnose and predict security threats to industrial control networks.

8. An electronic device, characterized in that, include: Memory, used to store computer software programs; A processor is configured to read and execute the computer software program, thereby implementing the artificial intelligence-based firewall policy management method according to any one of claims 1-6.

9. A non-transitory computer-readable storage medium, characterized in that, The storage medium stores a computer software program for implementing the artificial intelligence-based firewall policy management method according to any one of claims 1-6.

Images