Security policy automatic arrangement and optimization method based on multi-dimensional evaluation model

Abstract

The invention discloses a security policy automatic arrangement and optimization method based on a multi-dimensional evaluation model, and relates to the technical field of network security. The method comprises the following steps: collecting security monitoring data of network security equipment in different service systems; performing multi-dimensional monitoring on the security monitoring data, calculating a single score of each dimension and a network security situation assessment value by using a multi-dimensional assessment model, and judging a system security level according to the network security situation assessment value; according to security level requirements of different service systems, a security policy automatic arrangement and optimization scheme is formulated, and according to the security policy automatic arrangement and optimization scheme and the network security situation assessment value, whether automatic policy optimization is started is determined; determining a dimension item which needs strategy optimization according to each dimension single item score, and executing a corresponding automatic strategy arrangement optimization action; and automatically issuing the optimized security policy to a corresponding network security device. According to the invention, dynamic arrangement and optimization of the security policy are realized, and the response speed and accuracy are improved.

Description

Technical Field

[0001] The present invention relates to the field of network security technology, and in particular to a method for automatically arranging and optimizing security policies based on a multi-dimensional evaluation model. Background Art

[0002] As cyberattacks continue to evolve, traditional security policy management methods have become difficult to adapt to rapidly changing security threats. Although existing security policy orchestration methods have achieved automation to a certain extent, they still have problems such as policy conflicts, delayed responses, and high resource consumption. Therefore, it is necessary to develop a method that can more efficiently and intelligently orchestrate and optimize security policies. Summary of the invention

[0003] The present invention provides a method for automatically arranging and optimizing security policies based on a multi-dimensional evaluation model, comprising:

[0004] Step S1, collecting security monitoring data of network security devices in different business systems and preprocessing the security monitoring data;

[0005] Step S2: Perform multi-dimensional monitoring on the pre-processed security monitoring data, use a multi-dimensional evaluation model to calculate the individual scores of each dimension and the network security situation evaluation value, and determine the system security level according to the network security situation evaluation value;

[0006] Step S3: formulate corresponding security policy automatic arrangement and optimization schemes according to the security level requirements of different business systems, and determine whether to start automatic policy optimization according to the security policy automatic arrangement and optimization schemes and the network security situation assessment value;

[0007] Step S4: Determine the dimension items that need to be optimized according to the individual scores of each dimension, and execute the corresponding automatic strategy arrangement optimization action;

[0008] Step S5: Automatically send the optimized security policy to the corresponding network security device, and return to execute step S1.

[0009] As described above, a method for automatic orchestration and optimization of security policies based on a multi-dimensional evaluation model is described, in which network sensors are deployed in different business systems to monitor data and collect security monitoring data of network security devices. The network sensors have a log collection function and collect data from network devices, servers, application logs, and security devices.

[0010] As described above, a method for automatic arrangement and optimization of security policies based on a multi-dimensional evaluation model is provided, wherein the security monitoring data is preprocessed, specifically, the data is cleaned and integrated, noise is removed, and useful information required subsequently is extracted.

[0011] As described above, a method for automatic orchestration and optimization of security policies based on a multi-dimensional evaluation model is described, in which multi-dimensional evaluation criteria are set according to business system attributes, including target vulnerability W, security threat status T, attack damage loss L, network traffic anomaly A, compliance and policy compliance P, user behavior analysis U, and resource and performance status value S.

[0012] The above-mentioned method for automatic arrangement and optimization of security policies based on a multidimensional evaluation model, wherein the multidimensional evaluation model is used to calculate the individual scores of each dimension and the network security situation evaluation value, specifically includes:

[0013] Evaluate the scores of each dimension;

[0014] Define the corresponding weight of each dimension;

[0015] The network security situation assessment value is calculated based on the individual scores of each dimension and their corresponding proportions.

[0016] As described above, a method for automatic arrangement and optimization of security policies based on a multi-dimensional evaluation model is provided, wherein an automatic arrangement and optimization plan for security policies is formulated according to the security level requirements of different business systems, including implementing access control, adjusting intrusion detection rules, and strengthening the prevention of abnormal behavior.

[0017] The present invention also provides a device for automatic arrangement and optimization of security policies based on a multi-dimensional evaluation model, comprising: the device executes any one of the above-mentioned methods for automatic arrangement and optimization of security policies based on a multi-dimensional evaluation model.

[0018] The present invention also provides a security policy automatic orchestration and optimization system based on a multi-dimensional evaluation model, which is characterized in that it includes the above-mentioned device and also includes network sensors and business systems. The device collects security monitoring data of different business systems through network sensors, and automatically orchestrates and optimizes security policies based on the security monitoring data.

[0019] The present invention also provides a computer storage medium, comprising: at least one memory and at least one processor;

[0020] The memory is used to store one or more program instructions;

[0021] A processor is used to run one or more program instructions to execute any of the above-mentioned methods for automatic arrangement and optimization of security policies based on a multi-dimensional evaluation model.

[0022] The beneficial effects achieved by the present invention are as follows:

[0023] (1) Realize dynamic orchestration and optimization of security policies to improve response speed and accuracy.

[0024] (2) Reduce false positives and false negatives and improve the efficiency of security policy execution.

[0025] (3) Reduce system resource consumption and extend the service life of security equipment. BRIEF DESCRIPTION OF THE DRAWINGS

[0026] In order to more clearly illustrate the embodiments of the present invention or the technical solutions in the prior art, the drawings required for use in the embodiments or the description of the prior art will be briefly introduced below. Obviously, the drawings described below are only some embodiments recorded in the present invention. For ordinary technicians in this field, other drawings can also be obtained based on these drawings.

[0027] Figure 1 This is a flow chart of a method for automatic arrangement and optimization of security policies based on a multi-dimensional evaluation model provided in Example 1 of the present application. DETAILED DESCRIPTION

[0028] The following is a clear and complete description of the technical solutions in the embodiments of the present invention in conjunction with the drawings in the embodiments of the present invention. Obviously, the described embodiments are part of the embodiments of the present invention, not all of the embodiments. Based on the embodiments of the present invention, all other embodiments obtained by those skilled in the art without creative work are within the scope of protection of the present invention.

[0029] Embodiment 1

[0030] like Figure 1 As shown, the first embodiment of the present application provides a method for automatic arrangement and optimization of security policies based on a multi-dimensional evaluation model, including:

[0031] Step 110: Collect security monitoring data of network security devices in different business systems and pre-process the security monitoring data;

[0032] Specifically, network sensors are deployed in different business systems to monitor data and collect security monitoring data of network security devices. Different business systems include, for example, security monitoring and auditing systems, intrusion detection systems, user Internet behavior auditing systems, etc.

[0033] Network sensors have log collection capabilities, such as host guard software, host hardening software, etc., which collect data from network devices, servers, application logs, security devices and other sources.

[0034] Preprocess the safety monitoring data, specifically cleaning and integrating the data, removing noise, and extracting useful information needed subsequently.

[0035] Step 120: Perform multi-dimensional monitoring on the pre-processed security monitoring data, use a multi-dimensional evaluation model to calculate the individual scores of each dimension and the network security situation evaluation value, and determine the system security level according to the network security situation evaluation value;

[0036] In the embodiment of the present application, multi-dimensional evaluation criteria are set according to the business system attributes, including target vulnerability W, security threat status T, attack damage loss L, network traffic anomaly A, compliance and policy compliance P, user behavior analysis U, resource and performance status value S. After defining multiple dimensions, a multi-dimensional evaluation model is constructed to quantify the indicators of each dimension and calculate the overall situation.

[0037] Among them, a multi-dimensional evaluation model is used to calculate the individual scores of each dimension and the network security situation assessment value, including:

[0038] Step 121, evaluate the individual scores of each dimension;

[0039] Specifically, the individual scores of each dimension are evaluated, including:

[0040] ① Evaluate the weaknesses of network systems, applications, and hardware devices, determine the target vulnerability, and obtain a single-dimensional score for the target vulnerability;

[0041] The target vulnerability is determined by evaluating the weaknesses of the network system, application program, and hardware device, such as evaluating the unpatched vulnerabilities, weak passwords, and insecure configurations in the network system, application program, and hardware device. The target vulnerability of the assessment can be manually set according to the current system state, or the assessment value can be pre-set for different system states. The predetermined target vulnerability is determined according to the current system state, and the corresponding target vulnerability single dimension score Sw is set.

[0042] ② Identify and classify active internal and external threats, determine the security threat status value, and obtain the single-dimensional score of the security threat status;

[0043] The security threat status value is determined by identifying and classifying active internal and external threats, such as evaluating malware, phishing, DDoS attacks, etc. The assessed security threat status value can be manually set according to the current internal and external threat situation, or the assessment value can be pre-set for different internal and external threat situations. The predetermined security threat status value is determined according to the current internal and external threat situation, and the corresponding security threat status single dimension score St is set.

[0044] ③ Assess the damage that may be caused if an attack occurs, determine the attack damage loss, and obtain a single-dimensional score for the attack damage loss;

[0045] The attack hazard loss value is determined by evaluating the damage that may be caused once an attack occurs, such as financial loss, data leakage, reputation damage, etc. The assessed attack hazard loss value can be manually set according to the current attack hazard loss situation, or the assessment value can be pre-set for different attack hazard loss situations, and the predetermined attack hazard loss value is determined according to the current attack hazard loss situation, and the corresponding attack hazard loss single dimension score S1 is set.

[0046] ④Identify abnormal behaviors by analyzing traffic patterns, determine network traffic anomalies, and obtain a single-dimensional score for network traffic anomalies.

[0047] The network traffic anomaly value is determined by analyzing the traffic pattern to identify abnormal behavior, such as monitoring signs of intrusion, etc. The evaluated network traffic anomaly value can be manually set according to the current network traffic anomaly situation, or the evaluation value can be pre-set for different network traffic anomaly situations, and the predetermined network traffic anomaly value is determined according to the current network traffic anomaly situation, and the corresponding network traffic anomaly single dimension score Sa is set.

[0048] ⑤ Check whether network operations comply with industry standards and regulatory requirements, determine compliance and policy compliance, and obtain single-dimensional scores for compliance and policy compliance.

[0049] Compliance and policy compliance are determined by checking whether network operations comply with industry standards and regulatory requirements. The assessed compliance and policy compliance can be manually set based on the current compliance and policy compliance situation, or assessment values ​​can be pre-set for different compliance and policy compliance situations, and the predetermined compliance and policy compliance is determined based on the current compliance and policy situation, and the corresponding compliance and policy compliance single dimension score Sp is set.

[0050] ⑥ Monitor and evaluate user activities, identify potential internal threats or non-compliant behaviors, determine the user behavior analysis value, and obtain the single-dimensional score of user behavior analysis;

[0051] The user behavior analysis value is determined by monitoring and evaluating user activities to identify potential internal threats or non-compliant behaviors. The evaluated user behavior analysis value can be manually set according to the current user behavior situation, or the evaluation value can be pre-set for different user behavior situations. The predetermined user behavior analysis value is determined according to the current user behavior situation, and the corresponding user behavior analysis single dimension score Su is set.

[0052] ⑦ Evaluate the health status and availability of network resources, ensure that there are sufficient resources to deal with security performance, determine the resource and performance status, and obtain a single-dimensional score for the resource and performance status.

[0053] The resource and performance status value is determined by evaluating the health and availability of network resources to ensure that there are sufficient resources to deal with security. The resource and performance status value evaluated can be manually set according to the current resource and performance situation, or the evaluation value can be pre-set for different resource and performance situations. The predetermined resource and performance status value is determined according to the current resource and performance situation, and the corresponding resource and performance status single dimension score Ss is set.

[0054] Multiple sub-items can be set in each dimension. For dimensions with sub-items, the total score of each dimension sub-item is calculated. Svi represents the i-th sub-item of the v-th dimension, and Pvi represents the proportion of the i-th sub-item of the v-th dimension.

[0055] Step 122, defining the corresponding weight of each dimension;

[0056] The weight of each dimension can be adjusted according to different customer businesses, and the weight of each dimension is defined as follows:

[0057] Pw: The proportion of the target vulnerability dimension

[0058] Pt: The proportion of security threat status dimension

[0059] Pl: The proportion of the attack damage loss dimension

[0060] Pa: The proportion of network traffic anomaly dimension

[0061] Pp: The proportion of compliance and policy compliance

[0062] Pu: The proportion of user behavior analysis dimensions

[0063] Ps: The proportion of resource and performance status dimensions

[0064] Step 123: Calculate the network security situation assessment value based on the individual scores of each dimension and their corresponding proportions;

[0065] Specifically, the formula Calculate the network security situation assessment value, where S represents the network security situation assessment value, Pi represents the proportion of each dimension, and Si represents the individual score of each dimension.

[0066] Step 130: formulate corresponding security policy automatic arrangement and optimization schemes according to the security level requirements of different business systems, and determine whether to start automatic policy optimization according to the security policy automatic arrangement and optimization schemes and the network security situation assessment value;

[0067] According to the security level requirements of different business systems, automatic security policy orchestration and optimization plans are formulated, including but not limited to implementing access control, adjusting intrusion detection rules, and strengthening the prevention of abnormal behavior.

[0068] Specifically, based on the automatic orchestration and optimization solution of the security policy and the network security situation assessment value, it is determined whether to initiate automatic policy optimization, which specifically includes:

[0069] Fix the total score of the multi-dimensional evaluation model as TS:

[0070] When the evaluation score S > 0.9 * TS, the system is evaluated as secure

[0071] When the evaluation score 0.9 * TS ≥ S > 0.8 * TS, the system is evaluated as low-risk

[0072] When the evaluation score 0.8 * TS ≥ S > 0.7 * TS, the system is evaluated as medium-risk

[0073] When the evaluation score 0.7 * TS ≥ S > 0.6 * TS, the system is evaluated as high-risk

[0074] For example, if the security requirement of a certain business system is above low-risk, then when formulating the solution, as long as S is not lower than 0.8 times of TS, the automatic optimization of the security policy will not be triggered. When S is lower than 0.8 times of TS, the security policy will be automatically optimized, that is:

[0075] For a low-risk system, when:

[0076] S ≥ 0.8 * TS, do not initiate automatic policy optimization

[0077] S < 0.8 * TS, initiate automatic policy optimization

[0078] Step 140: Determine the dimension items that need policy optimization according to the single-item scores of each dimension, and execute the corresponding automatic policy orchestration and optimization actions;

[0079] When it is determined that S is lower than the required security score, then:

[0080] Calculate S1 = Min(Sw * Pw, St * Pt, Sl * Pl, Sa * Pa, Sp * Pp, Su * Pu, Ss * Ps)

[0081] Implement the corresponding automatic policy orchestration actions on the dimension to which S1 belongs. For example, if the score of the security threat status dimension St is the lowest, the system automatically searches for the currently generated security threat logs, and adjusts the access control policy according to the information such as the source IP, destination IP, source port, destination port, and service in the security threat logs.

[0082] Step 150: Automatically distribute the optimized security policy to the corresponding network security devices, and return to execute Step 110;

[0083] For example, the optimized security policy is automatically sent to the network boundary firewall, and re-evaluated according to the above process to determine the adjusted score. At this time, check whether S is greater than or equal to TS*0.8. If it is satisfied, suspend the policy adjustment. Otherwise, repeat the above process until S≥TS*0.8. Continue to monitor the security situation according to the multi-dimensional evaluation model.

[0084] Corresponding to the above embodiment, an embodiment of the present invention provides a computer storage medium, including: at least one memory and at least one processor;

[0085] The memory is used to store one or more program instructions;

[0086] The processor is used to run one or more program instructions to execute a security policy automatic arrangement and optimization method based on a multi-dimensional evaluation model.

[0087] Corresponding to the above embodiments, an embodiment of the present invention provides a computer-readable storage medium, which contains one or more program instructions, and the one or more program instructions are used by a processor to execute a method for automatic orchestration and optimization of security policies based on a multi-dimensional evaluation model.

[0088] The embodiments disclosed in the present invention provide a computer-readable storage medium, in which computer program instructions are stored. When the computer program instructions are executed on a computer, the computer executes the above-mentioned method for automatic arrangement and optimization of security policies based on a multi-dimensional evaluation model.

[0089] In the embodiment of the present invention, the processor may be an integrated circuit chip having the ability to process signals. The processor may be a general-purpose processor, a digital signal processor (DSP), an application-specific integrated circuit (ASIC), a field programmable gate array (FPGA), or other programmable logic devices, discrete gate or transistor logic devices, or discrete hardware components.

[0090] The methods, steps and logic block diagrams disclosed in the embodiments of the present invention can be implemented or executed. The general processor can be a microprocessor or the processor can also be any conventional processor, etc. The steps of the method disclosed in the embodiments of the present invention can be directly embodied as a hardware decoding processor for execution, or can be executed by a combination of hardware and software modules in the decoding processor. The software module can be located in a mature storage medium in the field such as a random access memory, a flash memory, a read-only memory, a programmable read-only memory or an electrically erasable programmable memory, a register, etc. The processor reads the information in the storage medium and completes the steps of the above method in combination with its hardware.

[0091] The storage medium may be a memory, which may be, for example, a volatile memory or a nonvolatile memory, or may include both volatile and nonvolatile memory.

[0092] Among them, the non-volatile memory can be a read-only memory (ROM), a programmable ROM (PROM), an erasable programmable read-only memory (EPROM), an electrically erasable programmable read-only memory (EEPROM), or a flash memory.

[0093] The volatile memory may be a random access memory (RAM) which is used as an external cache. By way of example and not limitation, many forms of RAM are available, such as static RAM (SRAM), dynamic RAM (DRAM), synchronous DRAM (SDRAM), double data rate synchronous DRAM (DDRSDRAM), enhanced synchronous DRAM (ESDRAM), synchronous link DRAM (SLDRAM), and direct RAM bus DRAM (DRRAM).

[0094] The storage media described in the embodiments of the present invention are intended to include, but are not limited to, these and any other suitable types of memory.

[0095] Those skilled in the art will appreciate that in one or more of the above examples, the functions described in the present invention can be implemented using a combination of hardware and software. When software is used, the corresponding functions can be stored in a computer-readable medium or transmitted as one or more instructions or codes on a computer-readable medium. Computer-readable media include computer storage media and communication media, wherein communication media include any media that facilitates the transmission of computer programs from one place to another. Storage media can be any available media that can be accessed by general or special-purpose computers.

[0096] The specific implementation methods described above further illustrate the objectives, technical solutions and beneficial effects of the present invention in detail. It should be understood that the above description is only a specific implementation method of the present invention and is not intended to limit the scope of protection of the present invention. Any modifications, equivalent substitutions, improvements, etc. made on the basis of the technical solution of the present invention should be included in the scope of protection of the present invention.

Claims

1. A security policy automatic arrangement and optimization method based on a multi-dimensional evaluation model, characterized in that: include: Step S1, collecting security monitoring data of network security devices in different business systems and preprocessing the security monitoring data; Step S2: Perform multi-dimensional monitoring on the pre-processed security monitoring data, use a multi-dimensional evaluation model to calculate the individual scores of each dimension and the network security situation evaluation value, and determine the system security level according to the network security situation evaluation value; Step S3: formulate corresponding security policy automatic arrangement and optimization schemes according to the security level requirements of different business systems, and determine whether to start automatic policy optimization according to the security policy automatic arrangement and optimization schemes and the network security situation assessment value; Step S4: Determine the dimension items that need to be optimized according to the individual scores of each dimension, and execute the corresponding automatic strategy arrangement optimization action; Step S5: Automatically send the optimized security policy to the corresponding network security device, and return to execute step S1.

2. The method for automatic arrangement and optimization of security policies based on a multi-dimensional evaluation model as claimed in claim 1, characterized in that: Network sensors are deployed in different business systems to monitor data and collect security monitoring data of network security devices. Network sensors have log collection functions and collect data from network devices, servers, application logs, and security devices.

3. The method for automatic arrangement and optimization of security policies based on a multi-dimensional evaluation model as claimed in claim 1, characterized in that: Preprocess the safety monitoring data, specifically cleaning and integrating the data, removing noise, and extracting useful information needed subsequently.

4. The method for automatic arrangement and optimization of security policies based on a multi-dimensional evaluation model as claimed in claim 1, characterized in that: Multi-dimensional evaluation criteria are set according to the attributes of the business system, including target vulnerability W, security threat status T, attack damage loss L, network traffic anomaly A, compliance and policy compliance P, user behavior analysis U, and resource and performance status value S.

5. The method for automatic arrangement and optimization of security policies based on a multi-dimensional evaluation model as claimed in claim 4, characterized in that: A multi-dimensional evaluation model is used to calculate the individual scores of each dimension and the network security situation assessment value, including: Evaluate the scores of each dimension; Define the corresponding weight of each dimension; The network security situation assessment value is calculated based on the individual scores of each dimension and their corresponding proportions.

6. The method for automatic arrangement and optimization of security policies based on a multi-dimensional evaluation model as claimed in claim 1, characterized in that: According to the security level requirements of different business systems, the security policy automatic arrangement and optimization plan is formulated, including implementing access control, adjusting intrusion detection rules, and strengthening the prevention of abnormal behavior.

7. A security policy automatic arrangement and optimization device based on a multi-dimensional evaluation model, characterized in that: include: The device executes a method for automatic arrangement and optimization of security policies based on a multi-dimensional evaluation model as described in any one of claims 1-6.

8. A security policy automatic arrangement and optimization system based on a multi-dimensional evaluation model, characterized in that: The device comprises the device described in claim 7, and also comprises a network sensor and a business system. The device collects security monitoring data of different business systems through the network sensor, and automatically arranges and optimizes security policies according to the security monitoring data.

9. A computer storage medium comprising: at least one memory and at least one processor; The memory is used to store one or more program instructions; A processor is used to run one or more program instructions to execute a security policy automatic arrangement and optimization method based on a multi-dimensional evaluation model as described in any one of claims 1 to 6.

Images