Firewall policy matching method, apparatus, device, medium and product

Abstract

The application relates to a firewall policy matching method, device, equipment, medium and product. The method comprises the following steps: acquiring current policy data of a target security domain, attribute data of each terminal device in the target security domain and traffic data of each terminal device; performing redundant screening and / or conflict screening on a first policy data set in a first policy matching model according to the current policy data, so as to obtain a second policy matching model, wherein a second policy data set in the second policy matching model is a subset of the first policy data set; the first policy matching model is a machine learning model based on a kernel method; inputting each attribute data and each traffic data into the second policy matching model, so as to obtain target policy data output by the second policy matching model, wherein the target policy data is used for determining a firewall application policy of the target security domain based on the target policy data. The method can improve the efficiency of generating a firewall policy.

Description

Technical Field

[0001] This application relates to the field of network security communication technology, and in particular to a firewall policy matching method, apparatus, device, medium and product. Background Technology

[0002] Firewall policies refer to a series of rules implemented in a corresponding security domain to manage and control network traffic data entering and leaving the security domain, in order to prevent devices within the security domain from being subjected to malicious attacks or unauthorized access from outside the security domain.

[0003] The traditional firewall policy matching method is to select the corresponding firewall policy set from the firewall policy library based on the business needs in the security domain, so that the firewall device administrator can select the target firewall policy for a specific application.

[0004] However, traditional firewall policy matching methods are inefficient. Summary of the Invention

[0005] Therefore, it is necessary to provide a firewall policy matching method, apparatus, device, medium, and product that can improve the efficiency of firewall policy matching in response to the above-mentioned technical problems.

[0006] Firstly, this application provides a firewall policy matching method, the method comprising:

[0007] Obtain the current policy data of the target security domain, the attribute data of each terminal device within the target security domain, and the traffic data of each terminal device;

[0008] Based on the current policy data, redundancy screening and / or conflict screening are performed on the first policy data set in the first policy matching model to obtain the second policy matching model. The second policy data set in the second policy matching model is a subset of the first policy data set. The first policy matching model is a machine learning model based on the kernel method.

[0009] Each attribute data and each traffic data is input into the second policy matching model to obtain the target policy data output by the second policy matching model. The target policy data is used to determine the firewall application policy for the target security domain based on the target policy data.

[0010] In one embodiment, the provided firewall policy matching method further includes:

[0011] Acquire multiple historical policy data sets, as well as the historical attribute data and historical traffic data of each terminal device corresponding to each historical policy data set;

[0012] For each historical attribute data point, dimensionality reduction processing is performed on the historical attribute data to obtain low-dimensional attribute data;

[0013] For each historical traffic data point, dimensionality reduction processing is performed to obtain low-dimensional traffic data;

[0014] Each historical strategy data point is used as a sample label, and the corresponding low-dimensional attribute data and low-dimensional traffic data are used as sample data to obtain a sample dataset.

[0015] The initial policy matching model is iteratively trained based on the sample dataset to obtain the first policy matching model.

[0016] In one embodiment, the method provides a process for dimensionality reduction of historical attribute data to obtain low-dimensional attribute data, including:

[0017] The historical attribute data is processed into a covariance matrix to obtain the attribute covariance matrix;

[0018] Feature extraction is performed on the attribute covariance matrix to obtain low-dimensional attribute basis vectors;

[0019] Historical attribute data is projected onto low-dimensional attribute basis vectors to obtain low-dimensional attribute data.

[0020] In one embodiment, the method provided includes the process of iteratively training an initial policy matching model based on a sample dataset to obtain a first policy matching model, comprising:

[0021] Multiple initial individuals are obtained, and these initial individuals are used to represent the model parameters corresponding to the initial policy matching model.

[0022] For each initial individual, the initial policy matching model corresponding to the initial individual is cross-validated using the sample dataset to obtain the fitness value of the initial individual.

[0023] Based on the fitness values ​​of each initial individual, the initial population was subjected to mating and screening processes to obtain multiple intermediate individuals;

[0024] Multiple intermediate individuals are used as multiple initial individuals. The process of obtaining the fitness value of the initial individuals and obtaining multiple intermediate individuals is repeated until the preset iteration condition is met. Then, the initial individual with the largest fitness value among the initial individuals is output as the optimal individual.

[0025] Based on the optimal individual, the first strategy matching model is obtained.

[0026] In one embodiment, the method provides a process of performing mating and screening on the initial population based on the fitness value corresponding to each initial individual to obtain multiple intermediate individuals, including:

[0027] Each initial individual was mated with a male to obtain multiple initial offspring individuals;

[0028] Multiple initial offspring individuals are mutated using mutation vectors to obtain multiple mutated offspring individuals;

[0029] Multiple mutated offspring individuals and multiple initial individuals were selected according to their respective fitness values ​​to obtain multiple intermediate individuals.

[0030] In one embodiment, the process of obtaining multiple initial individuals in the provided method includes:

[0031] Multiple initial individuals are obtained based on chaotic mapping.

[0032] Secondly, this application also provides a firewall policy matching device, the device comprising:

[0033] The data acquisition module is used to acquire the current policy data of the target security domain, the attribute data of each terminal device in the target security domain, and the traffic data of each terminal device;

[0034] The strategy filtering module is used to perform redundancy filtering and / or conflict filtering on the first strategy data set in the first strategy matching model based on the current strategy data to obtain the second strategy matching model. The second strategy data set in the second strategy matching model is a subset of the first strategy data set. The first strategy matching model is a machine learning model based on the kernel method.

[0035] The policy matching module is used to input attribute data and traffic data into the second policy matching model to obtain the target policy data output by the second policy matching model. The target policy data is used to determine the firewall application policy for the target security domain based on the target policy data.

[0036] Thirdly, this application also provides a computer device, including a memory and a processor, wherein the memory stores a computer program, and the processor executes the computer program to implement the steps of the method described in the first aspect.

[0037] Fourthly, this application also provides a computer-readable storage medium having a computer program stored thereon, which, when executed by a processor, implements the steps of the method described in the first aspect.

[0038] Fifthly, this application also provides a computer program product, including a computer program that, when executed by a processor, implements the steps of the method described in the first aspect.

[0039] The aforementioned firewall policy matching method, apparatus, device, medium, and product acquire current policy data of the target security domain, attribute data of each terminal device within the target security domain, and traffic data of each terminal device. Based on the current policy data, they perform redundancy and / or conflict filtering on the first label set in the first policy matching model to obtain a second policy matching model, where the second label set in the second policy matching model is a subset of the first label set. Based on the attribute data of each device, the traffic data, and the second policy matching model, they obtain the target policy data for the target security domain. In this application, performing redundancy and / or conflict filtering on the first label set in the first policy matching model based on the current policy data of the target security domain to obtain the second policy matching model avoids redundancy and conflict issues in the target policy data obtained from the second policy matching model during application, improving the usability of the generated target policy data. Using the attribute data and traffic data of each terminal device within the target security domain as input data for the second policy matching model facilitates real-time acquisition, reduces data acquisition complexity, and decreases the size of the label set in the second policy matching model, thereby accelerating the generation of target policy data and improving the efficiency of firewall policy generation. Attached Figure Description

[0040] To more clearly illustrate the technical solutions in the embodiments or related technologies of this application, the accompanying drawings used in the description of the embodiments or related technologies will be briefly introduced below. Obviously, the accompanying drawings described below are only some embodiments of this application. For those skilled in the art, other drawings can be obtained based on these drawings without creative effort.

[0041] Figure 1 This is an application environment diagram of a firewall policy matching method in one embodiment;

[0042] Figure 2 This is a flowchart illustrating a firewall policy matching method in one embodiment;

[0043] Figure 3 This is a flowchart illustrating the steps for obtaining the first strategy matching model in one embodiment;

[0044] Figure 4 This is a flowchart illustrating the steps for obtaining low-dimensional attribute data in one embodiment;

[0045] Figure 5 This is a flowchart illustrating the steps for obtaining the first strategy matching model in one embodiment;

[0046] Figure 6 This is a flowchart illustrating the steps for obtaining multiple intermediate individuals in one embodiment;

[0047] Figure 7 This is a flowchart illustrating the firewall policy matching method in another embodiment;

[0048] Figure 8 This is a structural block diagram of a firewall policy matching device in one embodiment;

[0049] Figure 9 This is an internal structural diagram of a computer device in one embodiment. Detailed Implementation

[0050] To make the objectives, technical solutions, and advantages of this application clearer, the following detailed description is provided in conjunction with the accompanying drawings and embodiments. It should be understood that the specific embodiments described herein are merely illustrative and not intended to limit the scope of this application.

[0051] The firewall policy matching method provided in this application embodiment can be applied to, for example, Figure 1 In the application environment shown, there is at least one security domain in the network, which is a logical or physical area defined in the network. Each security domain includes at least one terminal device 102, and the terminal devices 102 in each security domain share a firewall policy, such as... Figure 1 Firewall policies 1, 2, and 3 are shown. Terminal device 102 communicates with server 104 via a network. Terminal device 102 can be, but is not limited to, various personal computers, laptops, smartphones, tablets, IoT devices, and portable wearable devices. IoT devices can include smart speakers, smart TVs, smart air conditioners, smart in-vehicle devices, etc. Portable wearable devices can include smartwatches, smart bracelets, head-mounted devices, etc. Server 104 can be implemented using a standalone server or a server cluster consisting of multiple servers.

[0052] In one exemplary embodiment, such as Figure 2 As shown, a firewall policy matching method is provided, which is applied to... Figure 1 Taking server 104 as an example, the explanation includes the following steps 202 to 206. Wherein:

[0053] Step 202: Obtain the current policy data of the target security domain, the attribute data of each terminal device in the target security domain, and the traffic data of each terminal device.

[0054] For example, the current policy data could be the firewall policies being applied to the target security domain, which are retrieved periodically at preset time intervals. Alternatively, the current policy data could be the firewall policies being retrieved at the specified time based on a received data retrieval command.

[0055] For example, firewall policies may include access control lists, which determine which network traffic is allowed to pass through the firewall and which is blocked based on predefined rules.

[0056] For example, firewall policies can include port filtering rules that control access permissions to different services on the network by restricting traffic on specific ports. For instance, port filtering rules can be configured to block remote logins to a particular web server.

[0057] For example, firewall policies may also include application layer gateways, user authentication and access control, traffic monitoring and logging, etc.

[0058] The attribute data of each terminal device is obtained at the time of acquiring the current policy data, based on the application status of each terminal device and the data fields in the firewall log records. The application status of each terminal device and the data fields in the firewall log records can be retrieved from the corresponding storage of each terminal device.

[0059] For example, the application status of each terminal device may include a running status during normal operation, a standby status when idle and unused, a shutdown status when unable to respond to any commands, a sleep status with low power consumption and wake-up capability, and a fault status with a fault alarm. The data fields in the firewall log record may include the device load status, policy hit rate, current date, current time, communication protocol and other attribute data of each terminal device.

[0060] For example, the data fields from the application status and firewall logs of each terminal device are organized according to preset format rules or subjected to data collection and mining processing to obtain the attribute data of each terminal device. The data collection and mining processing may include data retrieval processing of the data fields from the application status and firewall logs of each terminal device to compress the data volume.

[0061] The traffic data of each terminal device is obtained by performing real-time port scanning on the ports of each terminal device when acquiring the current policy data, and the scan results are organized according to preset format rules.

[0062] For example, according to preset format rules, the scan results can be converted from XML data obtained from port scanning using the third-party Python module python-nmap into JSON format and exported to obtain traffic data of each terminal device.

[0063] For example, the traffic data of each terminal device may include traffic alarm logs, network traffic packets, traffic source address, traffic source communication port, traffic destination address, traffic destination communication port, etc.

[0064] Step 204: Based on the current policy data, perform redundancy screening and / or conflict screening on the first policy data set in the first policy matching model to obtain the second policy matching model. The second policy data set in the second policy matching model is a subset of the first policy data set. The first policy matching model is a machine learning model based on the kernel method.

[0065] The first policy matching model is a kernel-based machine learning model. For example, it uses a kernel function to map the input data into a high-dimensional space, thus enabling it to handle non-linear classification problems. The first policy matching model is used to find policy data that matches the input data from a first policy data set. For example, the first policy data set can be a collection of policy data that has been applied and / or is currently being applied in various security domains within the network.

[0066] In this embodiment, the first strategy data set is subjected to redundancy screening and / or conflict screening based on the current strategy data to obtain the second strategy data set, and then the second strategy matching model is obtained; wherein, the model parameters of the second strategy matching model are the same as those of the first strategy matching model, only the strategy data set used for classification is different; the second strategy data set is used for the second strategy matching model to select strategy data as target strategy data from the second strategy data set based on each attribute data and each traffic data.

[0067] Specifically, the information in the current strategy data is used as a filtering condition to filter each strategy data in the first strategy data set. If there is strategy data that is mutually exclusive with the filtering condition, the strategy data is judged as conflicting, and all strategy data that meets the filtering condition is retained as elements in the second strategy data set. If there are multiple strategy data that meet the filtering condition, the strategy data with lower priority is considered redundant, and the strategy data with the highest priority is retained as an element in the second strategy data set.

[0068] For example, if during the filtering process there is policy data that is obviously mutually exclusive with the admission conditions of source IP, destination IP, source port, destination port or protocol in the current policy data, that is, a conflicting policy has occurred, and all conflicting policies are filtered out; if during the filtering process there is multiple policy data with the same admission conditions of source IP, destination IP, source port, destination port and protocol, that is, a redundant policy has occurred, and the policy data with the highest priority is retained.

[0069] For example, the first policy matching model can be a machine learning model based on support vector machines or kernel Bayesian classifiers; the kernel function can be a linear kernel, a multinomial kernel, a radial basis function kernel, etc.

[0070] In this step, the first policy data set in the first policy matching model is subjected to redundancy screening and / or conflict screening based on the current policy data of the target security domain, resulting in a second policy matching model that includes the second policy data set. This avoids redundancy and conflict issues in the target policy data generated by the second policy matching model during application, thereby improving the usability of the generated target policy data. The second policy matching model uses the filtered data set to classify the input attribute data and traffic data, which can reduce computational complexity and improve model computational efficiency.

[0071] Step 206: Input the attribute data and traffic data into the second policy matching model to obtain the target policy data output by the second policy matching model. The target policy data is used to determine the firewall application policy of the target security domain based on the target policy data.

[0072] The second strategy matching model is used to classify and process the input attribute data and traffic data to obtain the target strategy data. The second strategy data set in the second strategy matching model is obtained by redundancy filtering and / or conflict filtering of the first strategy data set in the first strategy matching model.

[0073] In one possible implementation, the firewall policy matching method further includes selecting from the obtained target policy data according to a policy recommendation algorithm to obtain the firewall application policy for the target security domain.

[0074] For example, the policy recommendation algorithm may include: not recommending policy data that has already been recommended and adopted by the terminal device in the target policy data; using logistic regression to sort the target policy data based on the features of the terminal device's policy data to obtain a target policy recommendation sequence; modifying the target policy recommendation sequence according to a preset sorting rule to obtain an application policy recommendation sequence; customizing the policy data in the application policy recommendation sequence according to business rules; and adjusting the format of the policy data processed by the policy recommendation algorithm to obtain a firewall application policy adapted to the target security domain.

[0075] The aforementioned firewall policy matching method acquires the current policy data of the target security domain, the attribute data of each terminal device within the target security domain, and the traffic data of each terminal device. Based on the current policy data, it performs redundancy and / or conflict filtering on the first label set in the first policy matching model to obtain a second policy matching model. The second label set in the second policy matching model is a subset of the first label set. Based on the attribute data of each device, the traffic data, and the second policy matching model, it obtains the target policy data for the target security domain. In this embodiment, using the filtered data set to classify the input attribute data and policy data avoids redundancy and conflict issues in the target policy data obtained by the second policy matching model during application, improving the usability of the generated target policy data. Using the attribute data and traffic data of each terminal device within the target security domain as input data for the second policy matching model facilitates real-time acquisition, reduces the complexity of data acquisition, and decreases the size of the policy data set of the second policy matching model, thus accelerating the generation of target policy data and improving the efficiency of firewall policy generation.

[0076] In one exemplary embodiment, such as Figure 3 As shown, the firewall policy matching method provided also includes steps 302 to 310.

[0077] Step 302: Obtain multiple historical policy data and the historical attribute data and historical traffic data of each terminal device corresponding to each historical policy data.

[0078] Among them, multiple historical policy data refers to firewall policies that have been applied to the target security domain at multiple pre-selected historical moments.

[0079] Among them, the historical attribute data of each terminal device refers to the data obtained by the target security domain based on the application status of each terminal device at a historical moment and the data fields in the firewall log records. The application status of each terminal device at a historical moment and the data fields in the firewall log records can be queried from the corresponding storage of each terminal device.

[0080] Among them, the historical traffic data of each terminal device refers to the data obtained by the target security domain based on the port scan data of each terminal device at a historical time, which can be obtained from the scan result database corresponding to each port.

[0081] Step 304: For each historical attribute data, perform dimensionality reduction processing on the historical attribute data to obtain low-dimensional attribute data.

[0082] Dimensionality reduction can extract the essential structure of data, reduce errors caused by redundant and noisy information, and improve accuracy in applications.

[0083] For example, dimensionality reduction of historical attribute data can be achieved using methods such as principal component analysis, isometric mapping, and local linear embedding.

[0084] Step 306: For each historical traffic data point, perform dimensionality reduction processing on the historical traffic data to obtain low-dimensional traffic data.

[0085] For example, dimensionality reduction of historical traffic data can be achieved using methods such as principal component analysis, isometric mapping, and local linear embedding.

[0086] Step 308: Use each historical strategy data as a sample label, and use the corresponding low-dimensional attribute data and low-dimensional traffic data as sample data to obtain a sample dataset.

[0087] The sample dataset includes at least one historical strategy data serving as a sample label, as well as sample data corresponding to each sample label, namely, the low-dimensional attribute data and low-dimensional traffic data corresponding to the historical strategy data.

[0088] Step 310: Iteratively train the initial policy matching model based on the sample dataset to obtain the first policy matching model.

[0089] For example, the initial policy matching model is a kernel-based machine model, and its parameters are randomly initialized. The sample dataset is divided into a training set and a test set. The training set is input into the initial policy matching model for iterative training. When the iteration termination condition is met, the first policy matching model is obtained.

[0090] In this embodiment, by using each historical policy data as a sample label in the sample dataset, and using the data obtained after dimensionality reduction of historical attribute data and historical traffic data as sample data in the sample dataset, the real-time performance of data acquisition can be improved by using data with low acquisition complexity as input data for the initial policy matching model. At the same time, dimensionality reduction of the acquired data reduces the scale of the input data for the initial policy matching model, which can speed up the training speed of the model and enable the model to quickly achieve high-accuracy classification results, thereby improving the efficiency of generating firewall policies.

[0091] In one exemplary embodiment, such as Figure 4 As shown, the method described above performs dimensionality reduction on historical attribute data to obtain low-dimensional attribute data, including steps 402 to 406. Wherein:

[0092] Step 402: Perform covariance matrix processing on the historical attribute data to obtain the attribute covariance matrix.

[0093] Among them, the attribute covariance matrix is ​​the covariance matrix obtained by solving the matrix form of historical attribute data.

[0094] For example, if historical attribute data includes 10 dimensions such as date, time, communication protocol, source address, source communication port, destination address, and destination communication port, then the historical attribute data can be written as a 10*m matrix X.

[0095] Each element x in matrix X ij After decentralization, we obtain matrix X′, where each element x' in matrix X′ is a matrix. ij It is represented as: Where, x i Let represent the mean of the i-th historical attribute data, where i ranges from [1, 10] and j ranges from [1, m].

[0096] The attribute covariance matrix C can be represented as:

[0097]

[0098] Step 404: Perform feature extraction on the attribute covariance matrix to obtain low-dimensional attribute basis vectors.

[0099] Among them, the low-dimensional attribute basis vector is the eigenvector corresponding to the larger eigenvalue selected based on the magnitude of the eigenvalues ​​of the attribute covariance matrix.

[0100] For example, if the dimension of the low-dimensional attribute data is preset to 4, it is necessary to obtain 4 low-dimensional attribute basis vectors. That is, select the first 4 eigenvalues ​​of the attribute covariance matrix in order of size, and obtain the eigenvectors corresponding to the first 4 eigenvalues ​​as low-dimensional attribute basis vectors.

[0101] Step 406: Project the historical attribute data through low-dimensional attribute basis vectors to obtain low-dimensional attribute data.

[0102] The process of projecting historical attribute data onto low-dimensional attribute basis vectors involves multiplying the low-dimensional attribute basis vectors with the historical attribute data, and the resulting matrix is ​​the low-dimensional attribute data.

[0103] For example, assuming the low-dimensional attribute data has a 4-dimensional dimension, the low-dimensional attribute basis vector P in matrix form can be represented as:

[0104] P = [p1, p2, p3, p4] T ,

[0105] Low-dimensional attribute data Y in matrix form can be represented as: Y = P × X.

[0106] In this embodiment, historical attribute data is dimensionality reduced to obtain low-dimensional attribute data. This reduces storage space and computational efficiency while retaining key data information, thereby improving the efficiency of generating firewall policies.

[0107] In one exemplary embodiment, such as Figure 5 As shown, the method provided iteratively trains the initial policy matching model based on the sample dataset to obtain the first policy matching model, including steps 502 to 510. Wherein:

[0108] Step 502: Obtain multiple initial individuals. The initial individuals are used to represent the model parameters corresponding to the initial strategy matching model.

[0109] Each initial individual may include a set of hyperparameters, which represent a combination of parameters used to construct the initial policy matching model.

[0110] For example, the initial policy matching model can be a support vector machine model, and the hyperparameters can include penalty parameters and kernel parameters.

[0111] Step 504: For each initial individual, cross-validate the initial policy matching model corresponding to the initial individual using the sample dataset to obtain the fitness value corresponding to the initial individual.

[0112] Cross-validation refers to dividing the sample dataset into K similarly sized subsets, selecting one subset as the test set in turn, and using the remaining subsets as the training set. The dataset is then trained based on the initial policy matching model corresponding to the initial individual, tested on the test set, and the test results are obtained. The mean value of the results of the K tests is calculated to obtain the cross-validation result.

[0113] For example, for each initial individual, the initial policy matching model corresponding to the initial individual is subjected to 10-fold cross-validation, that is, the sample dataset is divided into 10 similar-sized subsets, and the initial policy matching model is trained and tested 10 times. The accuracy of each test is used as the test result, and the accuracy of the 10 tests is used as the fitness value corresponding to the initial individual.

[0114] Step 506: Based on the fitness value of each initial individual, the initial population is subjected to mating and screening processes to obtain multiple intermediate individuals.

[0115] Among them, multiple intermediate individuals are formed by sorting female and male individuals from each initial individual according to their fitness values. Female and male individuals with the same fitness value ranking are paired to produce multiple offspring individuals that are linearly related to the initial individuals. Based on the preset scale, the offspring individuals and the initial individuals are screened according to their fitness values, and individuals with poor fitness values ​​are removed. The remaining individuals are used as intermediate individuals.

[0116] For example, female and male individuals with the same fitness ranking are paired up to produce two offspring individuals that are linearly related to the initial individuals. The fitness value of the offspring individuals can be obtained by calculating the average fitness value of the female and male individuals.

[0117] Step 508: Take multiple intermediate individuals as multiple initial individuals, and repeat the process of obtaining the fitness value corresponding to the initial individuals and obtaining multiple intermediate individuals until the preset iteration condition is reached. Then, output the initial individual with the largest fitness value among the initial individuals as the optimal individual.

[0118] The preset iteration condition can be a set number of iterations or the loss value of the initial policy matching model being less than a set threshold.

[0119] Step 510: Based on the optimal individual, obtain the first strategy matching model.

[0120] Among them, the model parameters of the first strategy matching model are the parameter combinations represented by the hyperparameters of the optimal individual representation.

[0121] In this embodiment, the fitness value of the initial individual is obtained by cross-validating the initial policy matching model corresponding to the initial individual using the sample dataset. This reduces the evaluation bias caused by randomness in the training process, thereby more comprehensively and accurately evaluating the performance of the initial policy matching model. The fitness value of each initial individual is optimized and filtered, thereby guiding the search process more specifically, enabling the algorithm to converge to the optimal solution faster and improving the search efficiency.

[0122] In one exemplary embodiment, such as Figure 6 As shown, the method provided involves performing mating and screening processes on the initial population based on the fitness values ​​of each initial individual to obtain multiple intermediate individuals. This process includes:

[0123] Step 602: Mating each initial individual with males and females to obtain multiple initial offspring individuals.

[0124] For example, based on the position M of the male individuals and the position F of the female individuals in the initial population, the positions O1 and O2 of the initial offspring individuals can be represented as:

[0125] O1=L×M+(1-L)×F,

[0126] O2=L×F+(1-L)×M,

[0127] Where L is a random number within a specific range, and the initial velocity of the initial offspring individuals is 0.

[0128] Step 604: Use the mutation vector to mutate multiple initial offspring individuals to obtain multiple mutated offspring individuals.

[0129] The mutation vector can be selected based on different mutation algorithms.

[0130] For example, the mutation vector can be obtained from Gaussian mutation, t-distribution perturbation mutation, Cauchy mutation, or difference mutation.

[0131] For example, Gaussian mutation is used to mutate multiple initial offspring individuals, and the mutation vector V is obtained by randomly sampling from a Gaussian distribution N(0, σ2) with a mean of 0 and a variance of σ2. G The positions O1' and O2' of the mutated offspring can be represented as:

[0132] O1' = O1 + V G ,

[0133] O2' = O2 + V G .

[0134] Step 606: Select multiple mutated offspring individuals and multiple initial individuals according to their respective fitness values ​​to obtain multiple intermediate individuals.

[0135] In order to control the number of individuals, multiple mutated offspring individuals and multiple initial individuals are sorted according to their fitness values. Individuals with better fitness values ​​are retained according to the preset number of individuals, while individuals with poor fitness values ​​are removed.

[0136] In this embodiment, by performing mutation processing on multiple initial offspring individuals, the diversity of individuals can be increased, and the model parameters corresponding to the best individual obtained can be prevented from getting trapped in local optima. This increases the ability to search for the global optimal solution of the model parameters, thereby improving the classification performance of the first strategy matching model.

[0137] In one exemplary embodiment, the process of obtaining multiple initial individuals in the provided method includes: obtaining multiple initial individuals based on a chaotic mapping.

[0138] Among them, the chaotic mapping method is an initialization method that obtains an initial individual with randomness based on chaotic mapping parameters. The chaotic mapping method has the characteristics of being disordered, unpredictable and highly sensitive.

[0139] For example, chaotic mapping functions such as the Logistic mapping, Tent mapping, and Henon mapping can be selected to determine the chaotic mapping parameters.

[0140] In this embodiment, the chaotic mapping method is used to obtain the initial individuals, which can effectively improve the randomness and diversity of the initial individuals, thereby obtaining the model parameters of the first policy matching model with better performance and improving the generalization ability of the first policy matching model.

[0141] In one exemplary embodiment, such as Figure 7 As shown, a firewall policy matching method is provided, including:

[0142] Step 702: Obtain multiple historical policy data, as well as the historical attribute data and historical traffic data of each terminal device corresponding to each historical policy data.

[0143] Step 704: For each historical attribute data, perform dimensionality reduction processing on the historical attribute data to obtain low-dimensional attribute data.

[0144] Optionally, the historical attribute data can be dimensionality reduced, including: performing covariance matrix processing on the historical attribute data to obtain an attribute covariance matrix; performing feature extraction processing on the attribute covariance matrix to obtain a low-dimensional attribute basis vector; and projecting the historical attribute data through the low-dimensional attribute basis vector to obtain low-dimensional attribute data.

[0145] Step 706: For each historical traffic data point, perform dimensionality reduction processing on the historical traffic data to obtain low-dimensional traffic data.

[0146] Step 708: Use each historical strategy data as a sample label, and use the corresponding low-dimensional attribute data and low-dimensional traffic data as sample data to obtain a sample dataset.

[0147] Step 710: Obtain multiple initial individuals based on chaotic mapping. The initial individuals are used to represent the model parameters corresponding to the initial policy matching model.

[0148] Step 712: For each initial individual, cross-validate the initial policy matching model corresponding to the initial individual using the sample dataset to obtain the fitness value corresponding to the initial individual.

[0149] Step 714: Based on the fitness value of each initial individual, the initial population is subjected to mating and screening processes to obtain multiple intermediate individuals.

[0150] Optionally, the initial population may undergo mating and screening processes, including: mating each initial individual to obtain multiple initial offspring individuals; using mutation vectors to mutate the multiple initial offspring individuals to obtain multiple mutated offspring individuals; and screening the multiple mutated offspring individuals and multiple initial individuals according to their respective fitness values ​​to obtain multiple intermediate individuals.

[0151] Step 716: Take multiple intermediate individuals as multiple initial individuals, and repeat the process of obtaining the fitness value corresponding to the initial individuals and obtaining multiple intermediate individuals until the preset iteration condition is reached. Then, output the initial individual with the largest fitness value among the initial individuals as the optimal individual.

[0152] Step 718: Based on the optimal individual, obtain the first strategy matching model.

[0153] Step 720: Obtain the current policy data of the target security domain, the attribute data of each terminal device in the target security domain, and the traffic data of each terminal device.

[0154] Step 722: Based on the current policy data, perform redundancy screening and / or conflict screening on the first policy data set in the first policy matching model to obtain the second policy matching model. The second policy data set in the second policy matching model is a subset of the first policy data set. The first policy matching model is a machine learning model based on the kernel method.

[0155] Step 724: Input the attribute data and traffic data into the second policy matching model to obtain the target policy data output by the second policy matching model. The target policy data is used to determine the firewall application policy of the target security domain based on the target policy data.

[0156] In one possible implementation, the firewall application policy for the target security domain is determined based on the target policy data. After the firewall application policy is sent to the target security domain, it is modified according to the operation instructions issued by the administrator before being applied in the target security domain.

[0157] It should be understood that although the steps in the flowcharts of the embodiments described above are shown sequentially according to the arrows, these steps are not necessarily executed in the order indicated by the arrows. Unless explicitly stated herein, there is no strict order restriction on the execution of these steps, and they can be executed in other orders. Moreover, at least some steps in the flowcharts of the embodiments described above may include multiple steps or multiple stages. These steps or stages are not necessarily completed at the same time, but can be executed at different times. The execution order of these steps or stages is not necessarily sequential, but can be performed alternately or in turn with other steps or at least some of the steps or stages of other steps.

[0158] Based on the same inventive concept, this application also provides a firewall policy matching apparatus for implementing the firewall policy matching method described above. The solution provided by this apparatus is similar to the implementation described in the above method; therefore, the specific limitations in one or more firewall policy matching apparatus embodiments provided below can be found in the limitations of the firewall policy matching method described above, and will not be repeated here.

[0159] In one exemplary embodiment, such as Figure 8 As shown, a firewall policy matching device is provided, including: a data acquisition module 802, a policy filtering module 804, and a policy matching module 806, wherein:

[0160] The data acquisition module 802 is used to acquire the current policy data of the target security domain, the attribute data of each terminal device in the target security domain, and the traffic data of each terminal device.

[0161] The strategy filtering module 804 is used to perform redundancy filtering and / or conflict filtering on the first strategy data set in the first strategy matching model based on the current strategy data to obtain the second strategy matching model. The second strategy data set in the second strategy matching model is a subset of the first strategy data set. The first strategy matching model is a machine learning model based on the kernel method.

[0162] The policy matching module 806 is used to input attribute data and traffic data into the second policy matching model to obtain the target policy data output by the second policy matching model. The target policy data is used to determine the firewall application policy of the target security domain based on the target policy data.

[0163] In one embodiment, the apparatus further includes a model training module for acquiring multiple historical policy data and historical attribute data and historical traffic data of each terminal device corresponding to each historical policy data; and for each historical attribute data, performing dimensionality reduction processing on the historical attribute data to obtain low-dimensional attribute data.

[0164] For each historical traffic data point, dimensionality reduction is performed to obtain low-dimensional traffic data. Each historical policy data point is used as a sample label, and the corresponding low-dimensional attribute data and low-dimensional traffic data are used as sample data to obtain a sample dataset. The initial policy matching model is iteratively trained based on the sample dataset to obtain the first policy matching model.

[0165] In one embodiment, the model training module is further used to perform covariance matrix processing on historical attribute data to obtain an attribute covariance matrix; to perform feature extraction processing on the attribute covariance matrix to obtain a low-dimensional attribute basis vector; and to project the historical attribute data through the low-dimensional attribute basis vector to obtain low-dimensional attribute data.

[0166] In one embodiment, the model training module is further configured to obtain multiple initial individuals, which represent the model parameters corresponding to the initial policy matching model; for each initial individual, cross-validation is performed on the initial policy matching model corresponding to the initial individual using a sample dataset to obtain the fitness value corresponding to the initial individual; based on the fitness values ​​corresponding to each initial individual, the initial population is subjected to mating and screening processes to obtain multiple intermediate individuals; the multiple intermediate individuals are used as multiple initial individuals, and the process of obtaining the fitness values ​​corresponding to the initial individuals and obtaining the intermediate population is repeated until a preset iteration condition is reached, at which point the initial individual with the largest fitness value among the initial individuals is output as the optimal individual; based on the optimal individual, the first policy matching model is obtained.

[0167] In one embodiment, the model training module is also used to mate each initial individual with males and females to obtain multiple initial offspring individuals; to mutate the multiple initial offspring individuals using mutation vectors to obtain multiple mutated offspring individuals; and to filter the multiple mutated offspring individuals and multiple initial individuals according to their respective fitness values ​​to obtain multiple intermediate individuals.

[0168] In one embodiment, the model training module is also used to obtain multiple initial individuals based on a chaotic mapping.

[0169] Each module in the aforementioned firewall policy matching device can be implemented entirely or partially through software, hardware, or a combination thereof. These modules can be embedded in or independent of the processor in a computer device, or stored in the computer device's memory as software, so that the processor can invoke and execute the corresponding operations of each module.

[0170] In one exemplary embodiment, a computer device is provided, which may be a server, and its internal structure diagram may be as follows: Figure 9As shown, this computer device includes a processor, memory, input / output interfaces (I / O), and a communication interface. The processor, memory, and I / O interfaces are connected via a system bus, and the communication interface is also connected to the system bus via the I / O interfaces. The processor provides computational and control capabilities. The memory includes non-volatile storage media and internal memory. The non-volatile storage media stores the operating system, computer programs, and a database. The internal memory provides the environment for the operating system and computer programs stored in the non-volatile storage media. The database stores current policy data for each security domain in the network, attribute data for each terminal device, and traffic data. The I / O interfaces are used for exchanging information between the processor and external devices. The communication interface is used for communication with external terminals via a network connection. When executed by the processor, the computer program implements a firewall policy matching method.

[0171] Those skilled in the art will understand that Figure 9 The structure shown is merely a block diagram of a portion of the structure related to the present application and does not constitute a limitation on the computer device to which the present application is applied. Specific computer devices may include more or fewer components than those shown in the figure, or combine certain components, or have different component arrangements.

[0172] In one embodiment, a computer device is also provided, including a memory and a processor, wherein the memory stores a computer program, and the processor executes the computer program to implement the steps in the above method embodiments.

[0173] In one embodiment, a computer-readable storage medium is provided having a computer program stored thereon that, when executed by a processor, implements the steps in the above method embodiments.

[0174] In one embodiment, a computer program product is provided, including a computer program that, when executed by a processor, implements the steps in the above method embodiments.

[0175] It should be noted that the user information (including but not limited to user device information, user personal information, etc.) and data (including but not limited to data used for analysis, data stored, data displayed, etc.) involved in this application are all information and data authorized by the user or fully authorized by all parties, and the collection, use and processing of the relevant data must comply with relevant regulations.

[0176] Those skilled in the art will understand that all or part of the processes in the methods of the above embodiments can be implemented by a computer program instructing related hardware. The computer program can be stored in a non-volatile computer-readable storage medium, and when executed, it can include the processes of the embodiments of the above methods. Any references to memory, databases, or other media used in the embodiments provided in this application can include at least one of non-volatile and volatile memory. Non-volatile memory can include read-only memory (ROM), magnetic tape, floppy disk, flash memory, optical memory, high-density embedded non-volatile memory, resistive random access memory (ReRAM), magnetic random access memory (MRAM), ferroelectric random access memory (FRAM), phase change memory (PCM), graphene memory, etc. Volatile memory can include random access memory (RAM) or external cache memory, etc. By way of illustration and not limitation, RAM can take many forms, such as Static Random Access Memory (SRAM) or Dynamic Random Access Memory (DRAM). The databases involved in the embodiments provided in this application may include at least one type of relational database and non-relational database. Non-relational databases may include, but are not limited to, blockchain-based distributed databases. The processors involved in the embodiments provided in this application may be general-purpose processors, central processing units, graphics processing units, digital signal processors, programmable logic devices, quantum computing-based data processing logic devices, etc., and are not limited to these.

[0177] The technical features of the above embodiments can be combined in any way. For the sake of brevity, not all possible combinations of the technical features in the above embodiments are described. However, as long as there is no contradiction in the combination of these technical features, they should be considered to be within the scope of this specification.

[0178] The embodiments described above are merely illustrative of several implementation methods of this application, and while the descriptions are specific and detailed, they should not be construed as limiting the scope of this patent application. It should be noted that those skilled in the art can make various modifications and improvements without departing from the concept of this application, and these all fall within the protection scope of this application. Therefore, the protection scope of this application should be determined by the appended claims.

Claims

1. A firewall policy matching method, characterized in that, The method includes: The system acquires the current policy data of the target security domain, the attribute data of each terminal device within the target security domain, and the traffic data of each terminal device. The traffic data is obtained by performing real-time port scanning on the ports of each terminal device, and the scan results are organized according to preset format rules. The attribute data includes the device load status, policy hit rate, current date, current time, and communication protocol of each terminal device. The first strategy data set in the first strategy matching model is subjected to redundancy screening and / or conflict screening based on the current strategy data to obtain the second strategy matching model. This includes: if, during the screening process, there is strategy data with significantly mutually exclusive access conditions (source IP, destination IP, source port, destination port, or protocol) with the current strategy data, all conflicting strategies are removed; if, during the screening process, there are multiple strategy data sets with the same access conditions (source IP, destination IP, source port, destination port, and protocol), the strategy data with the highest priority is retained; the second strategy data set in the second strategy matching model is a subset of the first strategy data set; the first strategy matching model is a kernel-based machine learning model; the kernel-based machine learning model is a support vector machine model or a kernel Bayes classifier machine learning model, and its kernel function is one of a linear kernel, a polynomial kernel, or a radial basis function kernel; The attribute data and traffic data are input into the second policy matching model to obtain the target policy data output by the second policy matching model; the target policy data is selected according to the policy recommendation algorithm to obtain the firewall application policy of the target security domain.

2. The method according to claim 1, characterized in that, The method further includes: Acquire multiple historical policy data sets, as well as the historical attribute data and historical traffic data of each terminal device corresponding to each historical policy data set; For each of the historical attribute data, dimensionality reduction processing is performed on the historical attribute data to obtain low-dimensional attribute data; For each of the historical traffic data, dimensionality reduction processing is performed to obtain low-dimensional traffic data; Each historical strategy data point is used as a sample label, and each low-dimensional attribute data and each low-dimensional traffic data corresponding to each historical strategy data point are used as sample data to obtain a sample dataset. The initial policy matching model is iteratively trained based on the sample dataset to obtain the first policy matching model.

3. The method according to claim 2, characterized in that, The step of dimensionality reduction processing of the historical attribute data to obtain low-dimensional attribute data includes: The historical attribute data is processed into a covariance matrix to obtain the attribute covariance matrix; The attribute covariance matrix is ​​subjected to feature extraction processing to obtain low-dimensional attribute basis vectors; The historical attribute data is projected through the low-dimensional attribute basis vector to obtain the low-dimensional attribute data.

4. The method according to claim 2, characterized in that, The step of iteratively training the initial policy matching model based on the sample dataset to obtain the first policy matching model includes: Multiple initial individuals are obtained, and the initial individuals are used to characterize the model parameters corresponding to the initial strategy matching model; For each initial individual, the initial policy matching model corresponding to the initial individual is cross-validated using the sample dataset to obtain the fitness value of the initial individual. Based on the fitness values ​​of each initial individual, the initial population is subjected to mating and screening processes to obtain multiple intermediate individuals. The process of obtaining the fitness value of the initial individuals and obtaining the intermediate individuals is repeated, using the multiple intermediate individuals as the multiple initial individuals, until the preset iteration condition is reached. Then, the initial individual with the largest fitness value among the initial individuals is output as the optimal individual. Based on the optimal individual, the first strategy matching model is obtained.

5. The method according to claim 4, characterized in that, The initial population is subjected to mating and screening processes based on the fitness values ​​of each initial individual to obtain multiple intermediate individuals, including: Each of the initial individuals was mated with a male to obtain multiple initial offspring individuals; The mutation vector is used to mutate the multiple initial offspring individuals to obtain multiple mutated offspring individuals; The multiple mutated offspring individuals and the multiple initial individuals are screened according to their respective fitness values ​​to obtain the multiple intermediate individuals.

6. The method according to claim 4, characterized in that, The process of obtaining multiple initial individuals includes: The multiple initial individuals are obtained based on chaotic mapping.

7. A firewall policy matching device, characterized in that, The device includes: The data acquisition module is used to acquire the current policy data of the target security domain, the attribute data of each terminal device in the target security domain, and the traffic data of each terminal device. The traffic data is obtained by performing real-time port scanning on the ports of each terminal device, and the scan results are organized according to preset format rules. The attribute data includes the device load, policy hit rate, current date, current time, and communication protocol of each terminal device. The strategy filtering module is used to perform redundancy filtering and / or conflict filtering on the first strategy data set in the first strategy matching model based on the current strategy data to obtain a second strategy matching model. This includes: if, during the filtering process, there is strategy data with significantly mutually exclusive access conditions (source IP, destination IP, source port, destination port, or protocol) with the current strategy data, all conflicting strategies are filtered out; if, during the filtering process, there are multiple strategy data with the same access conditions (source IP, destination IP, source port, destination port, and protocol), the strategy data with the highest priority is retained; the second strategy data set in the second strategy matching model is a subset of the first strategy data set; the first strategy matching model is a kernel-based machine learning model; the kernel-based machine learning model is a support vector machine model or a kernel Bayes classifier machine learning model, and its kernel function is one of a linear kernel, a polynomial kernel, or a radial basis function kernel; The policy matching module is used to input the attribute data and traffic data into the second policy matching model to obtain the target policy data output by the second policy matching model; and to select the target policy data according to the policy recommendation algorithm to obtain the firewall application policy of the target security domain.

8. A computer device comprising a memory and a processor, wherein the memory stores a computer program, characterized in that, When the processor executes the computer program, it implements the steps of the method according to any one of claims 1 to 6.

9. A computer-readable storage medium having a computer program stored thereon, characterized in that, When the computer program is executed by a processor, it implements the steps of the method according to any one of claims 1 to 6.

10. A computer program product, comprising a computer program, characterized in that, When the computer program is executed by a processor, it implements the steps of the method according to any one of claims 1 to 6.

Images