A firewall security assessment system and method

Abstract

The invention relates to the technical field of software security, and discloses a firewall security assessment system and method, wherein the firewall security assessment system comprises: a data acquisition module, which acquires source code information of firewall software each time the firewall software is updated; a structured module, which generates a first two-dimensional structure data; and a security assessment module, which inputs the first two-dimensional structure data into a firewall risk assessment model, and the firewall risk assessment model outputs a result indicating the firewall risk level and a result indicating the weight of a node of a source code abstract syntax tree affecting the firewall risk. The invention performs pattern recognition by identifying source code association information of historical firewall updates, and is no longer limited to analyzing firewall configuration rules, and can discover potential risks of firewalls, and can identify risks at the software level and the rule level.

Description

Technical Field

[0001] The present invention relates to the technical field of software security, and more specifically, to a firewall security assessment system and method. Background Art

[0002] Firewall is a very important basic protection facility in network security, which is mainly used to control network access, filter malicious traffic and prevent attack behaviors. It plays a key role in protecting internal networks from external threats. However, existing firewall security assessment methods mainly rely on analyzing firewall configuration rules, which makes it difficult to discover risks caused by hidden attack patterns. Summary of the invention

[0003] The present invention provides a firewall security assessment system and method, which solves the technical problem that the existing firewall security assessment method in the related art mainly relies on analyzing firewall configuration rules and is difficult to discover the risks caused by hidden attack modes.

[0004] The present invention provides a firewall security assessment system, comprising:

[0005] A data collection module collects source code information of the firewall software each time the firewall software is updated, wherein the source code information includes a source code abstract syntax tree and semantic information associated with nodes of the source code abstract syntax tree;

[0006] A structuring module generates a No. 1 two-dimensional structure data, the No. 1 two-dimensional structure data includes a No. 1 data matrix and a No. 1 relationship matrix, a unit of the No. 1 data matrix represents a No. 1 one-dimensional structure data of an independent object, the independent object includes a node in the source code abstract syntax tree, and a unit of the No. 1 data matrix representing the independent object only includes the semantic information of the independent object;

[0007] The element in the i-th row and j-th column of the No. 1 relationship matrix represents the association between the i-th unit of the No. 1 data matrix and the independent object represented by the j-th unit. If there is an association, the value of this element of the No. 1 relationship matrix is ​​1, otherwise it is 0;

[0008] There is an association between nodes, which means that the nodes are connected to each other in the source code abstract syntax tree;

[0009] A number one one-dimensional structure data includes n data items sorted by time, and the tth data item represents the source code information of the corresponding independent object collected at the tth update;

[0010] A security assessment module inputs a number one two-dimensional structure data into a firewall risk assessment model, wherein the firewall risk assessment model comprises a first intermediate layer, a second intermediate layer, a first output layer and a second output layer, wherein the first intermediate layer inputs a number one one-dimensional structure data, outputs first intermediate representation data to the second intermediate layer, the second intermediate layer also inputs a number one relationship matrix, the second intermediate layer outputs second intermediate representation data to the first output layer and the second output layer, the first output layer outputs a result representing the firewall risk level, and the second output layer outputs a weight representing the node of the source code abstract syntax tree affecting the firewall risk.

[0011] Furthermore, the semantic information associated with the nodes of the source code abstract syntax tree includes source code fragments and function description texts.

[0012] Furthermore, a higher firewall risk level indicates a greater firewall risk.

[0013] Furthermore, a greater weight of a node in the source code abstract syntax tree affecting the firewall risk indicates a greater association between the node and the firewall risk.

[0014] Furthermore, the calculation formula of the first intermediate layer is as follows:

[0015]

[0016] in Represents the tth first intermediate representation data output by the first intermediate layer, represents the t-1th first intermediate representation data, Represents the tth data item of the one-dimensional structure data. and are the first and second weight parameters, is the first bias parameter and tanh is the hyperbolic tangent function.

[0017] Furthermore, the calculation formula of the second intermediate layer is as follows:

[0018]

[0019] in The second intermediate representation data of the vth unit of the data matrix No. 1, is the set of cells associated with the vth cell of data matrix 1, The nth first intermediate representation data output when the one-dimensional structure data No. 1 of the vth unit of the data matrix No. 1 is input into the first intermediate layer, is a normalizing constant, is the sigmoid function, represents the third weight parameter, is the second bias parameter.

[0020] Furthermore, the calculation formula of the first output layer is as follows:

[0021]

[0022] in represents the first output vector, whose cth component value represents the probability value of the cth firewall risk level, and the firewall risk level with the largest probability value is selected as the output. The second intermediate representation data of the vth unit of the data matrix No. 1, represents the set of all cells of data matrix number one, is the first output weight parameter, is the first output bias parameter, Represents the sigmoid function.

[0023] Furthermore, the calculation formula of the second output layer is as follows:

[0024]

[0025] in It represents the weight value of the vth unit of the data matrix No. 1 that affects the firewall risk. The second intermediate representation data of the vth unit of the data matrix No. 1, is the second output weight parameter, is the second output bias parameter, Represents the sigmoid function.

[0026] The present invention provides a firewall security assessment method, comprising the following steps:

[0027] Step 100, collecting source code information of the firewall software each time the firewall software is updated, the source code information including a source code abstract syntax tree and semantic information associated with nodes of the source code abstract syntax tree;

[0028] Step 200, generating No. 1 two-dimensional structure data, the No. 1 two-dimensional structure data includes No. 1 data matrix and No. 1 relationship matrix, one unit of the No. 1 data matrix represents No. 1 one-dimensional structure data of an independent object, the independent object includes a node in the source code abstract syntax tree, and one unit of the No. 1 data matrix representing the independent object only includes the semantic information of the independent object;

[0029] The element in the i-th row and j-th column of the No. 1 relationship matrix represents the association between the i-th unit of the No. 1 data matrix and the independent object represented by the j-th unit. If there is an association, the value of this element of the No. 1 relationship matrix is ​​1, otherwise it is 0;

[0030] There is an association between nodes, which means that the nodes are connected to each other in the source code abstract syntax tree;

[0031] A number one one-dimensional structure data includes n data items sorted by time, and the tth data item represents the source code information of the corresponding independent object collected at the tth update;

[0032] Step 300, inputting the first two-dimensional structure data into the firewall risk assessment model, the firewall risk assessment model includes a first intermediate layer, a second intermediate layer, a first output layer and a second output layer, wherein the first intermediate layer inputs the first one-dimensional structure data, outputs the first intermediate representation data to the second intermediate layer, the second intermediate layer also inputs the first relationship matrix, the second intermediate layer outputs the second intermediate representation data to the first output layer and the second output layer, the first output layer outputs a result representing the firewall risk level, the higher the firewall risk level, the greater the firewall risk, the second output layer outputs a weight representing the node of the source code abstract syntax tree affecting the firewall risk, the greater the weight, the greater the correlation with the firewall risk;

[0033] Step 400, when the firewall risk level is greater than the set risk threshold, a risk alert is sent, and the weights affecting the firewall risk are sorted from large to small, and the first R source code abstract syntax tree nodes are sent to the operation and maintenance personnel.

[0034] The present invention provides a computer storage medium, which is used to store computer-readable instructions. When the computer-readable instructions are read, the aforementioned firewall security assessment method can be executed.

[0035] The beneficial effects of the present invention are:

[0036] The present invention performs pattern recognition by identifying source code association information of historical firewall updates. It is no longer limited to analyzing firewall configuration rules, and can discover potential risks of firewalls and identify risks at the software level and the rule level. BRIEF DESCRIPTION OF THE DRAWINGS

[0037] Figure 1 It is a module schematic diagram of a firewall security assessment system of the present invention. DETAILED DESCRIPTION

[0038] The subject matter described herein will now be discussed with reference to example implementations. It should be understood that the discussion of these implementations is only to enable those skilled in the art to better understand and implement the subject matter described herein, and the functions and arrangements of the elements discussed may be changed without departing from the scope of protection of the present specification. Various examples may omit, replace, or add various processes or components as needed. In addition, the features described in some examples may also be combined in other examples.

[0039] At least one embodiment of the present invention discloses a firewall security assessment system. Figure 1 As shown, including:

[0040] The data collection module 101 collects source code information of the firewall software each time the firewall software is updated, wherein the source code information includes a source code abstract syntax tree and semantic information associated with nodes of the source code abstract syntax tree;

[0041] The semantic information associated with the nodes of the source code abstract syntax tree includes source code fragments, function description texts, etc.

[0042] The structuring module 102 generates a first two-dimensional structure data, the first two-dimensional structure data includes a first data matrix and a first relationship matrix, one unit of the first data matrix represents a first one-dimensional structure data of an independent object, the independent object includes a node in the source code abstract syntax tree, and one unit of the first data matrix representing the independent object only includes the semantic information of the independent object;

[0043] The element in the i-th row and j-th column of the No. 1 relationship matrix represents the association between the i-th unit of the No. 1 data matrix and the independent object represented by the j-th unit. If there is an association, the value of this element of the No. 1 relationship matrix is ​​1, otherwise it is 0;

[0044] There is an association between nodes, which means that the nodes are connected to each other in the source code abstract syntax tree;

[0045] A number one one-dimensional structure data includes n data items sorted by time, and the tth data item represents the source code information of the corresponding independent object collected at the tth update;

[0046] The security assessment module 103 inputs the first two-dimensional structure data into the firewall risk assessment model. The firewall risk assessment model includes a first intermediate layer, a second intermediate layer, a first output layer and a second output layer. The first intermediate layer inputs the first one-dimensional structure data and outputs the first intermediate representation data to the second intermediate layer. The second intermediate layer also inputs the first relationship matrix. The second intermediate layer outputs the second intermediate representation data to the first output layer and the second output layer. The first output layer outputs a result representing the firewall risk level. The higher the firewall risk level, the greater the firewall risk. The second output layer outputs a weight representing the node of the source code abstract syntax tree affecting the firewall risk. The greater the weight, the greater the correlation with the firewall risk.

[0047] The calculation formula for the first intermediate layer of the firewall risk assessment model is as follows:

[0048]

[0049] in Represents the tth first intermediate representation data output by the first intermediate layer, represents the t-1th first intermediate representation data, Represents the tth data item of the one-dimensional structure data. and are the first and second weight parameters, is the first bias parameter and tanh is the hyperbolic tangent function.

[0050] In one embodiment of the present invention, the calculation formula of the second intermediate layer is as follows:

[0051]

[0052] in The second intermediate representation data of the vth unit of the data matrix No. 1, is the set of cells associated with the vth cell of data matrix 1, The nth first intermediate representation data output when the one-dimensional structure data No. 1 of the vth unit of the data matrix No. 1 is input into the first intermediate layer, is a normalization constant (default value is 20), is the sigmoid function, represents the third weight parameter, is the second bias parameter.

[0053] In one embodiment of the present invention, the calculation formula of the first output layer is as follows:

[0054]

[0055] in represents the first output vector, whose cth component value represents the probability value of the cth firewall risk level, and the firewall risk level with the largest probability value is selected as the output. The second intermediate representation data of the vth unit of the data matrix No. 1, represents the set of all cells of data matrix number one, is the first output weight parameter, is the first output bias parameter, Represents the sigmoid function.

[0056] The calculation formula of the second output layer is as follows:

[0057]

[0058] in It represents the weight value of the vth unit of the data matrix No. 1 that affects the firewall risk. The second intermediate representation data of the vth unit of the data matrix No. 1, is the second output weight parameter, is the second output bias parameter, Represents the sigmoid function.

[0059] At least one embodiment of the present invention discloses a firewall security assessment method, comprising the following steps:

[0060] Step 100, collecting source code information of the firewall software each time the firewall software is updated, the source code information including a source code abstract syntax tree and semantic information associated with nodes of the source code abstract syntax tree;

[0061] Step 200, generating No. 1 two-dimensional structure data, the No. 1 two-dimensional structure data includes No. 1 data matrix and No. 1 relationship matrix, one unit of the No. 1 data matrix represents No. 1 one-dimensional structure data of an independent object, the independent object includes a node in the source code abstract syntax tree, and one unit of the No. 1 data matrix representing the independent object only includes the semantic information of the independent object;

[0062] The element in the i-th row and j-th column of the No. 1 relationship matrix represents the association between the i-th unit of the No. 1 data matrix and the independent object represented by the j-th unit. If there is an association, the value of this element of the No. 1 relationship matrix is ​​1, otherwise it is 0;

[0063] There is an association between nodes, which means that the nodes are connected to each other in the source code abstract syntax tree;

[0064] A number one one-dimensional structure data includes n data items sorted by time, and the tth data item represents the source code information of the corresponding independent object collected at the tth update;

[0065] Step 300, inputting the first two-dimensional structure data into the firewall risk assessment model, the firewall risk assessment model includes a first intermediate layer, a second intermediate layer, a first output layer and a second output layer, wherein the first intermediate layer inputs the first one-dimensional structure data, outputs the first intermediate representation data to the second intermediate layer, the second intermediate layer also inputs the first relationship matrix, the second intermediate layer outputs the second intermediate representation data to the first output layer and the second output layer, the first output layer outputs a result representing the firewall risk level, the higher the firewall risk level, the greater the firewall risk, the second output layer outputs a weight representing the node of the source code abstract syntax tree affecting the firewall risk, the greater the weight, the greater the correlation with the firewall risk;

[0066] Step 400: When the firewall risk level is greater than the set risk threshold, a risk alert is sent, and the weights affecting the firewall risk are sorted from large to small, and the first R source code abstract syntax tree nodes are sent to the operation and maintenance personnel, so that the operation and maintenance personnel can understand the risk factors and quickly reduce the risk.

[0067] In one embodiment of the present invention, the firewall risk level is 1 to 10, and the risk threshold is 6.

[0068] The default value of R is 5, which is proportional to the total number of nodes.

[0069] The present invention provides a computer storage medium, which is used to store computer-readable instructions. When the computer-readable instructions are read, the aforementioned firewall security assessment method can be executed.

[0070] The above describes an embodiment of the present invention, but this embodiment is not limited to the above-mentioned specific implementation mode. The above-mentioned specific implementation mode is merely illustrative and not restrictive. Under the guidance of this embodiment, ordinary technicians in this field can also make more forms of equivalent embodiments, all of which are within the protection of this embodiment.

Claims

1. A firewall security assessment system, characterized in that: include: A data collection module collects source code information of the firewall software each time the firewall software is updated, wherein the source code information includes a source code abstract syntax tree and semantic information associated with nodes of the source code abstract syntax tree; A structuring module generates a No. 1 two-dimensional structure data, the No. 1 two-dimensional structure data includes a No. 1 data matrix and a No. 1 relationship matrix, a unit of the No. 1 data matrix represents a No. 1 one-dimensional structure data of an independent object, the independent object includes a node in the source code abstract syntax tree, and a unit of the No. 1 data matrix representing the independent object only includes the semantic information of the independent object; The element in the i-th row and j-th column of the No. 1 relationship matrix represents the association between the i-th unit of the No. 1 data matrix and the independent object represented by the j-th unit. If there is an association, the value of this element of the No. 1 relationship matrix is ​​1, otherwise it is 0; There is an association between nodes, which means that the nodes are connected to each other in the source code abstract syntax tree; A number one one-dimensional structure data includes n data items sorted by time, and the tth data item represents the source code information of the corresponding independent object collected at the tth update; A security assessment module, which inputs the first two-dimensional structure data into a firewall risk assessment model, the firewall risk assessment model includes a first intermediate layer, a second intermediate layer, a first output layer and a second output layer, wherein the first intermediate layer inputs the first one-dimensional structure data and outputs the first intermediate representation data to the second intermediate layer, the second intermediate layer also inputs the first relationship matrix, the second intermediate layer outputs the second intermediate representation data to the first output layer and the second output layer, the first output layer outputs a result representing the firewall risk level, and the second output layer outputs a weight representing the node of the source code abstract syntax tree affecting the firewall risk; The calculation formula for the first intermediate layer is as follows: ； in Represents the tth first intermediate representation data output by the first intermediate layer, represents the t-1th first intermediate representation data, Represents the tth data item of the one-dimensional structure data. and are the first and second weight parameters, is the first bias parameter, tanh is the hyperbolic tangent function; The calculation formula for the second intermediate layer is as follows: ； in The second intermediate representation data of the vth unit of the data matrix No. 1, is the set of cells associated with the vth cell of data matrix 1, The nth first intermediate representation data output when the one-dimensional structure data No. 1 of the vth unit of the data matrix No. 1 is input into the first intermediate layer, is a normalizing constant, is the sigmoid function, represents the third weight parameter, is the second bias parameter.

2. A firewall security assessment system according to claim 1, characterized in that: The semantic information associated with the nodes of the source code abstract syntax tree includes source code fragments and function description texts.

3. A firewall security assessment system according to claim 1, characterized in that: A higher firewall risk level indicates a greater firewall risk.

4. A firewall security assessment system according to claim 1, characterized in that: The greater the weight of a node in the source code abstract syntax tree affecting the firewall risk, the greater the association between the node and the firewall risk.

5. A firewall security assessment system according to claim 1, characterized in that: The calculation formula of the first output layer is as follows: ； in represents the first output vector, whose cth component value represents the probability value of the cth firewall risk level, and the firewall risk level with the largest probability value is selected as the output. The second intermediate representation data of the vth unit of the data matrix No. 1, represents the set of all cells of data matrix number one, is the first output weight parameter, is the first output bias parameter, Represents the sigmoid function.

6. A firewall security assessment system according to claim 1, characterized in that: The calculation formula of the second output layer is as follows: ； in It represents the weight value of the vth unit of the data matrix No. 1 that affects the firewall risk. The second intermediate representation data of the vth unit of the data matrix No. 1, is the second output weight parameter, is the second output bias parameter, Represents the sigmoid function.

7. A firewall security assessment method, characterized in that: The following steps are involved: Step 100, collecting source code information of the firewall software each time the firewall software is updated, the source code information including a source code abstract syntax tree and semantic information associated with nodes of the source code abstract syntax tree; Step 200, generating No. 1 two-dimensional structure data, the No. 1 two-dimensional structure data includes No. 1 data matrix and No. 1 relationship matrix, one unit of the No. 1 data matrix represents No. 1 one-dimensional structure data of an independent object, the independent object includes a node in the source code abstract syntax tree, and one unit of the No. 1 data matrix representing the independent object only includes the semantic information of the independent object; The element in the i-th row and j-th column of the No. 1 relationship matrix represents the association between the i-th unit of the No. 1 data matrix and the independent object represented by the j-th unit. If there is an association, the value of this element of the No. 1 relationship matrix is ​​1, otherwise it is 0; There is an association between nodes, which means that the nodes are connected to each other in the source code abstract syntax tree; A number one one-dimensional structure data includes n data items sorted by time, and the tth data item represents the source code information of the corresponding independent object collected at the tth update; Step 300, inputting the first two-dimensional structure data into the firewall risk assessment model, the firewall risk assessment model includes a first intermediate layer, a second intermediate layer, a first output layer and a second output layer, wherein the first intermediate layer inputs the first one-dimensional structure data, outputs the first intermediate representation data to the second intermediate layer, the second intermediate layer also inputs the first relationship matrix, the second intermediate layer outputs the second intermediate representation data to the first output layer and the second output layer, the first output layer outputs a result representing the firewall risk level, the higher the firewall risk level, the greater the firewall risk, the second output layer outputs a weight representing the node of the source code abstract syntax tree affecting the firewall risk, the greater the weight, the greater the correlation with the firewall risk; Step 400, when the firewall risk level is greater than the set risk threshold, a risk alert is sent, and the weights affecting the firewall risk are sorted from large to small, and the first R source code abstract syntax tree nodes are sent to the operation and maintenance personnel; The calculation formula for the first intermediate layer is as follows: ； in Represents the tth first intermediate representation data output by the first intermediate layer, represents the t-1th first intermediate representation data, Represents the tth data item of the one-dimensional structure data. and are the first and second weight parameters, is the first bias parameter, tanh is the hyperbolic tangent function; The calculation formula for the second intermediate layer is as follows: ； in The second intermediate representation data of the vth unit of the data matrix No. 1, is the set of cells associated with the vth cell of data matrix 1, The nth first intermediate representation data output when the one-dimensional structure data No. 1 of the vth unit of the data matrix No. 1 is input into the first intermediate layer, is a normalizing constant, is the sigmoid function, represents the third weight parameter, is the second bias parameter.

8. A computer storage medium, characterized in that: It is used to store computer-readable instructions, and when the computer-readable instructions are read, a firewall security assessment method as claimed in claim 7 can be executed.

Images