SD-WAN-based Internet security supervision method and system

Abstract

The invention discloses an SD-WAN-based Internet security supervision method and system, which realizes flexible traffic scheduling and unified management of security policies through an SD-WAN network architecture, formulates comprehensive security policies through an SD-WAN controller, effectively defends external threats, detects and responds to potential threats in real time by SD-WAN edge equipment, reduces attack risks, and improves the security of the security policies. Security events, traffic information and logs are reported and analyzed in a centralized mode, an administrator is helped to comprehensively grasp security conditions, the SD-WAN controller intelligently analyzes reported information, rapidly identifies threats and assesses risks, supports rapid decision making and strategy adjustment and ensures optimal network security, and the intelligent routing function of the SD-WAN controller adjusts traffic paths according to needs and optimizes performance. And if threats occur, a security path or encryption processing is automatically guided, so that the service continuity is guaranteed, the operation and maintenance efficiency is improved by a centralized management and automatic response mechanism, manual errors are reduced, the cost is reduced, the SD-WAN architecture is flexible, rapid deployment and adjustment are supported, and the method adapts to the change of service requirements.

Description

Technical Field

[0001] The present invention relates to the technical field of Internet security supervision, and in particular to an Internet security supervision method and system based on SD-WAN. Background Art

[0002] With the rapid development of Internet technology, enterprise network environments are becoming increasingly complex, with branches spread all over the world, and cloud services and remote work becoming the norm. This trend places higher demands on the security and management efficiency of enterprise networks. However, traditional network architecture and security supervision methods are unable to cope with these challenges.

[0003] First, the decentralized nature of traditional network architecture leads to inefficient management. The networks of different branches and departments are often independent of each other and lack effective centralized management methods, which makes network configuration adjustment, security policy deployment and troubleshooting complicated and time-consuming.

[0004] Secondly, static security strategies are difficult to cope with ever-changing network threats. Traditional network security equipment mostly performs security detection based on preset rules and lacks the ability to update and adjust in real time. As network attack methods continue to evolve and upgrade, this static defense method has gradually revealed its limitations and is difficult to effectively resist emerging network threats.

[0005] Furthermore, traffic management and bandwidth utilization are not efficient enough. In a complex network environment, traffic management and bandwidth allocation become a daunting task. Traditional network equipment often lacks intelligent traffic scheduling and optimization capabilities, resulting in the inability to fully utilize network bandwidth and even network congestion and delay problems. Summary of the invention

[0006] In view of this, the present invention proposes an Internet security supervision method and system based on SD-WAN, which can solve the defects of the prior art such as low network management efficiency, difficulty in coping with changing network threats, and inefficient traffic management and bandwidth utilization.

[0007] The technical solution of the present invention is achieved in this way:

[0008] An Internet security supervision method based on SD-WAN, specifically including:

[0009] Build an SD-WAN network architecture, deploy an SD-WAN controller and multiple SD-WAN edge devices. The SD-WAN controller is responsible for the global management of the network and the formulation of security policies. The SD-WAN edge devices are deployed at the edge of the enterprise network and are responsible for executing security policies.

[0010] The SD-WAN controller sends the formulated security policies to each SD-WAN edge device;

[0011] In the process of executing security policies, SD-WAN edge devices record relevant security events, traffic statistics, and system logs, and report this information to the SD-WAN controller;

[0012] The SD-WAN controller centrally processes and analyzes the reported information, identifies potential security threats, assesses security risks, and generates corresponding security reports and warning information;

[0013] Adjust the security policy of the SD-WAN controller and optimize the network configuration based on security reports and warning information.

[0014] As a further optional solution of the SD-WAN-based Internet security supervision method, the SD-WAN controller formulates a security policy, specifically including:

[0015] The SD-WAN controller evaluates the enterprise's current network environment, including network topology, bandwidth requirements, application priorities, and security requirements;

[0016] Based on the evaluation results, the SD-WAN controller defines the objectives of the security policy, which include protecting critical data, preventing unauthorized access, and ensuring the continuity of network services;

[0017] According to the goal of the security policy, the SD-WAN controller formulates several security rules, including traffic filtering security rules, access control security rules, data encryption security rules, and threat detection and response security rules;

[0018] The SD-WAN controller configures the priorities of different security rules.

[0019] As a further optional solution of the SD-WAN-based Internet security supervision method, the SD-WAN controller sends the formulated security policy to each SD-WAN edge device, specifically including:

[0020] The SD-WAN controller first encapsulates the formulated security policy into a data packet and encrypts the encapsulated data packet;

[0021] Evaluate the status of each SD-WAN edge device, including device performance, load, and connection quality;

[0022] Based on the status assessment results of the SD-WAN edge devices, the SD-WAN controller will intelligently select the distribution time and method;

[0023] Before the SD-WAN edge device receives a security policy and attempts to execute it, the SD-WAN controller requires the SD-WAN edge device to perform policy validation.

[0024] As a further optional solution of the SD-WAN-based Internet security supervision method, the SD-WAN edge device records relevant security events, traffic statistics and system logs during the execution of security policies, and reports this information to the SD-WAN controller, specifically including:

[0025] SD-WAN edge devices monitor network traffic and system activities in real time to capture security events that occur;

[0026] Use machine learning to intelligently classify captured security events to obtain different types of security threats;

[0027] Conduct traffic statistics based on network traffic, and conduct multi-dimensional statistical analysis based on the statistical results to obtain application layer traffic distribution information, user behavior pattern information, and traffic anomaly detection information;

[0028] Based on the application layer traffic distribution information, user behavior pattern information and traffic anomaly detection information, predictions are made to obtain future traffic trends and potential security risks;

[0029] Record detailed system logs and, when recording logs, associate different events and log entries to form a complete context chain;

[0030] Report different types of security threats, future traffic trends and potential security risks, as well as contextual chains to the SD-WAN controller.

[0031] As a further optional solution of the SD-WAN-based Internet security supervision method, the SD-WAN controller centrally processes and analyzes the reported information, identifies potential security threats, assesses security risks, and generates corresponding security reports and warning information, specifically including:

[0032] The SD-WAN controller performs potential threat analysis on the information reported from the SD-WAN edge device and obtains potential threat analysis results;

[0033] Conduct quantitative evaluation of potential threat analysis results to assess the degree of harm and impact of potential threats on the network;

[0034] Prioritize potential threats based on the degree of harm and scope of impact they may cause to the network;

[0035] Generate a detailed security report based on the potential threat analysis results and quantitative assessment results, and issue warning information to relevant personnel or systems based on priority, where the warning information includes threat type, impact scope, urgency, and response measures.

[0036] As a further optional solution of the SD-WAN-based Internet security supervision method, the SD-WAN controller performs potential threat analysis on the information reported from the SD-WAN edge device to obtain potential threat analysis results, specifically including:

[0037] The SD-WAN controller uses real-time analysis technology to process information reported from SD-WAN edge devices in real time and identify preliminary potential threats;

[0038] Conduct correlation analysis on preliminary potential threats based on data from different sources and types to obtain security risks and potential threats hidden behind the data;

[0039] Combined with external threat intelligence sources, the security risks and potential threats hidden behind the data are verified to obtain the final potential threats.

[0040] As a further optional solution of the Internet security supervision method based on SD-WAN, the security policy of the SD-WAN controller is adjusted and the network configuration is optimized according to the security report and warning information, which specifically includes:

[0041] Integrate security reports from different security devices and systems with the SD-WAN controller’s own warning information to identify common characteristics, development trends, and potential unknown threats;

[0042] Generate corresponding security policies based on the identification results and prioritize the security policies;

[0043] Push the formulated security policies to the SD-WAN controller in real time.

[0044] An Internet security supervision system based on SD-WAN, comprising:

[0045] The building module is used to build the SD-WAN network architecture and deploy the SD-WAN controller and multiple SD-WAN edge devices. The SD-WAN controller is responsible for the global management of the network and the formulation of security policies. The SD-WAN edge devices are deployed at the edge of the enterprise network and are responsible for executing security policies.

[0046] The delivery module is used by the SD-WAN controller to deliver the formulated security policies to each SD-WAN edge device;

[0047] The recording module is used by the SD-WAN edge device to record relevant security events, traffic statistics and system logs during the execution of security policies, and report this information to the SD-WAN controller;

[0048] The analysis module is used by the SD-WAN controller to centrally process and analyze the reported information, identify potential security threats, assess security risks, and generate corresponding security reports and warning information;

[0049] The adjustment module is used to adjust the security policy of the SD-WAN controller and optimize the network configuration based on security reports and warning information.

[0050] A computing device includes a memory, a processor, and a computer program stored in the memory and executable on the processor. When the processor executes the computer program, the steps of the above-mentioned SD-WAN-based Internet security supervision method are implemented.

[0051] A computer-readable storage medium having a computer program stored thereon, wherein the computer program, when executed by a processor, implements the steps of the above-mentioned SD-WAN-based Internet security supervision method.

[0052] The beneficial effects of the present invention are as follows: through the deployment of the SD-WAN network architecture, flexible scheduling of network traffic and unified management of security policies are achieved. The SD-WAN controller can formulate and execute comprehensive security policies to effectively prevent external threats from invading the enterprise network. The SD-WAN edge device executes security policies at the edge of the enterprise network, and can detect and respond to potential security threats in real time, reducing the risk of network attacks. The centralized reporting and analysis of security events, traffic statistics and system logs enable administrators to fully understand the security status of the network, discover and deal with potential security issues in a timely manner, and the SD-WAN controller can perform intelligent analysis based on the reported information, quickly identify potential security threats and assess their risks, which enables administrators to make decisions quickly and adjust security policies to respond to threats. The dynamic nature of security policies Dynamic adjustment and optimization can ensure that the network always remains in the best security state and effectively resist emerging threats and attack methods. Through the intelligent routing and traffic management functions of SD-WAN, the traffic path can be dynamically adjusted according to network conditions and security requirements to optimize network performance. When potential threats are identified, the SD-WAN controller can automatically guide the affected traffic to a safer path or encrypt it to reduce the impact of threats on the business. Centralized network management and security policy formulation reduce the workload of administrators and improve operation and maintenance efficiency. The flexibility of SD-WAN network architecture allows enterprises to quickly deploy and adjust the network according to business needs, reducing operation and maintenance costs. The automated security response mechanism reduces the need for manual intervention, reduces the risk of human error, and improves the speed and accuracy of security response. BRIEF DESCRIPTION OF THE DRAWINGS

[0053] In order to more clearly illustrate the embodiments of the present invention or the technical solutions in the prior art, the drawings required for use in the embodiments or the description of the prior art will be briefly introduced below. Obviously, the drawings described below are only some embodiments of the present invention. For ordinary technicians in this field, other drawings can be obtained based on these drawings without paying creative work.

[0054] Figure 1 A flowchart of an Internet security supervision method based on SD-WAN according to the present invention;

[0055] Figure 2 This is a schematic diagram of the composition of an Internet security supervision system based on SD-WAN of the present invention. DETAILED DESCRIPTION

[0056] The technical solutions in the embodiments of the present invention are described clearly and completely below. Obviously, the described embodiments are only part of the embodiments of the present invention, not all of the embodiments. Based on the embodiments of the present invention, all other embodiments obtained by ordinary technicians in this field without creative work are within the scope of protection of the present invention.

[0057] refer to Figure 1 to Figure 2 , an Internet security supervision method based on SD-WAN, specifically including:

[0058] Build an SD-WAN network architecture, deploy an SD-WAN controller and multiple SD-WAN edge devices. The SD-WAN controller is responsible for the global management of the network and the formulation of security policies. The SD-WAN edge devices are deployed at the edge of the enterprise network and are responsible for executing security policies.

[0059] The SD-WAN controller sends the formulated security policies to each SD-WAN edge device;

[0060] In the process of executing security policies, SD-WAN edge devices record relevant security events, traffic statistics, and system logs, and report this information to the SD-WAN controller;

[0061] The SD-WAN controller centrally processes and analyzes the reported information, identifies potential security threats, assesses security risks, and generates corresponding security reports and warning information;

[0062] Adjust the security policy of the SD-WAN controller and optimize the network configuration based on security reports and warning information.

[0063] In this embodiment, through the deployment of the SD-WAN network architecture, flexible scheduling of network traffic and unified management of security policies are achieved. The SD-WAN controller can formulate and execute comprehensive security policies to effectively prevent external threats from invading the enterprise network. The SD-WAN edge device executes security policies at the edge of the enterprise network and can detect and respond to potential security threats in real time to reduce the risk of network attacks. The centralized reporting and analysis of security events, traffic statistics and system logs enable administrators to fully understand the security status of the network and promptly discover and deal with potential security issues. The SD-WAN controller can perform intelligent analysis based on the reported information, quickly identify potential security threats and assess their risks, which enables administrators to make decisions quickly and adjust security policies to respond to threats. The dynamic adjustment of security policies Integration and optimization can ensure that the network always maintains the best security state and effectively resists emerging threats and attack methods. Through the intelligent routing and traffic management functions of SD-WAN, the traffic path can be dynamically adjusted according to network conditions and security requirements to optimize network performance. When potential threats are identified, the SD-WAN controller can automatically direct the affected traffic to a safer path or encrypt it to reduce the impact of threats on the business. Centralized network management and security policy formulation reduce the workload of administrators and improve operation and maintenance efficiency. The flexibility of SD-WAN network architecture allows enterprises to quickly deploy and adjust the network according to business needs, reducing operation and maintenance costs. The automated security response mechanism reduces the need for manual intervention, reduces the risk of human error, and improves the speed and accuracy of security response.

[0064] Preferably, the SD-WAN controller formulates a security policy, specifically including:

[0065] The SD-WAN controller evaluates the enterprise's current network environment, including network topology, bandwidth requirements, application priorities, and security requirements;

[0066] Based on the evaluation results, the SD-WAN controller defines the objectives of the security policy, which include protecting critical data, preventing unauthorized access, and ensuring the continuity of network services;

[0067] According to the goal of the security policy, the SD-WAN controller formulates several security rules, including traffic filtering security rules, access control security rules, data encryption security rules, and threat detection and response security rules;

[0068] The SD-WAN controller configures the priorities of different security rules.

[0069] In this embodiment, the SD-WAN controller first evaluates the enterprise's current network environment, including key factors such as network topology, bandwidth requirements, application priorities, and security requirements. This comprehensive evaluation ensures that the security policy can accurately adapt to the actual situation of the enterprise and avoids the inadaptability and resource waste that may be caused by a one-size-fits-all security solution. Based on the evaluation results, the SD-WAN controller clarifies the goals of the security policy, such as protecting key data, preventing unauthorized access, and ensuring the continuity of network services. These specific and clear goals provide clear guidance for the formulation of security rules and ensure the effectiveness and pertinence of the security policy. The SD-WAN controller formulates multiple security rules based on the goals of the security policy, including traffic filtering, access control, data encryption, etc. These rules together constitute a comprehensive security protection system in terms of encryption, threat detection and response, which can effectively resist various network threats and attack methods; the SD-WAN controller is also configured with the priority of different security rules to meet the security needs in different situations. This flexible and adjustable priority configuration enables the security policy to be dynamically adjusted according to the severity of the actual threat and the network status, ensuring rapid response and effective response in emergency situations; through the implementation of the above technical solutions, the SD-WAN controller can formulate security policies that are both in line with the actual situation of the enterprise and comprehensive and effective. The implementation of these policies will greatly improve the security of the enterprise network, protect key data from being leaked, prevent unauthorized access, and ensure the continuity and stability of network services.

[0070] Preferably, the SD-WAN controller sends the formulated security policy to each SD-WAN edge device, specifically including:

[0071] The SD-WAN controller first encapsulates the formulated security policy into a data packet and encrypts the encapsulated data packet;

[0072] Evaluate the status of each SD-WAN edge device, including device performance, load, and connection quality;

[0073] Based on the status assessment results of the SD-WAN edge devices, the SD-WAN controller will intelligently select the distribution time and method;

[0074] Before the SD-WAN edge device receives a security policy and attempts to execute it, the SD-WAN controller requires the SD-WAN edge device to perform policy validation.

[0075] In this embodiment, the SD-WAN controller encapsulates the security policy into a data packet and encrypts it, ensuring the confidentiality and integrity of the security policy during transmission, which prevents sensitive security policy information from being intercepted or tampered with during transmission, thereby enhancing the security of data transmission; before distributing the security policy, the SD-WAN controller will evaluate the status of each SD-WAN edge device, including factors such as device performance, load conditions, and connection quality. Based on these evaluation results, the SD-WAN controller can intelligently select the distribution time and distribution method to ensure that the security policy can be efficiently and stably deployed on each edge device. This intelligent distribution strategy improves the distribution efficiency and success rate, and reduces distribution failures or delays caused by poor device status; before the SD-WAN edge device receives the security policy and attempts to execute it, the SD-WAN controller will require policy verification. This step ensures that the edge device has fully verified and tested the policy before formally executing it, thereby avoiding network failures caused by policy errors or incompatibilities. In the event of network failure or security issues, policy verification ensures the correctness of policy execution and improves the stability and reliability of the entire system. Through the intelligent distribution strategy and policy verification mechanism, the SD-WAN controller can reasonably schedule and allocate network resources to ensure policy distribution and execution when the device is in good condition, which helps to optimize resource utilization and avoid unnecessary operations when the device is overloaded or the connection quality is poor, thereby improving the performance and efficiency of the entire network. For example, for edge devices with heavy loads, the controller may choose to distribute policies during off-peak hours or adopt batch distribution to reduce the impact on device performance. At the same time, the intelligent distribution and policy verification mechanism in this technical solution enables the SD-WAN system to flexibly adapt to network environments of different scales and complexities. As the enterprise network develops and changes, the SD-WAN controller can adjust the distribution strategy and verification mechanism according to actual needs to meet new security requirements and network conditions. This flexibility and scalability enable the SD-WAN system to maintain efficient and stable operation for a long time.

[0076] Preferably, the SD-WAN edge device records relevant security events, traffic statistics and system logs during the execution of security policies, and reports this information to the SD-WAN controller, specifically including:

[0077] SD-WAN edge devices monitor network traffic and system activities in real time to capture security events that occur;

[0078] Use machine learning to intelligently classify captured security events to obtain different types of security threats;

[0079] Conduct traffic statistics based on network traffic, and conduct multi-dimensional statistical analysis based on the statistical results to obtain application layer traffic distribution information, user behavior pattern information, and traffic anomaly detection information;

[0080] Based on the application layer traffic distribution information, user behavior pattern information and traffic anomaly detection information, predictions are made to obtain future traffic trends and potential security risks;

[0081] Record detailed system logs and, when recording logs, associate different events and log entries to form a complete context chain;

[0082] Report different types of security threats, future traffic trends and potential security risks, as well as contextual chains to the SD-WAN controller.

[0083] In this embodiment, the SD-WAN edge device can monitor network traffic and system activities in real time, and capture security incidents in a timely manner. This real-time monitoring capability enables the system to detect potential security threats in the first place and reduce the impact of security incidents on the network. By using machine learning algorithms to intelligently classify captured security incidents, different types of security threats can be accurately identified. This intelligent classification not only improves the efficiency of identifying security incidents, but also enables the system to take more accurate and effective countermeasures against different types of security threats. Based on multi-dimensional statistical analysis of network traffic, application layer traffic distribution information, user behavior pattern information, and traffic anomaly detection information can be obtained. This information helps administrators to gain an in-depth understanding of network usage and potential security risks. By analyzing traffic data, future traffic trends and potential security risks can be predicted. This predictive capability enables the system to prepare in advance, take corresponding preventive measures, and reduce security incidents. The SD-WAN edge device records detailed system logs, including various events and log entries. These logs provide administrators with a rich source of information, helping them understand the operating status and potential problems of the system. When recording logs, the system associates different events and log entries to form a complete context chain. This association enables administrators to track and locate problems more easily, improving the efficiency of troubleshooting and processing. The SD-WAN edge device reports different types of security threats, future traffic trends and potential security risks, as well as context chains to the SD-WAN controller, which enables the SD-WAN controller to centrally manage and process this information, providing more comprehensive and effective security protection for the entire network. Based on the reported information, the SD-WAN controller can optimize and adjust security policies, for example, adjust bandwidth allocation and routing policies according to traffic trends and security risks to improve network performance and security.

[0084] Preferably, the SD-WAN controller centrally processes and analyzes the reported information, identifies potential security threats, assesses security risks, and generates corresponding security reports and warning information, specifically including:

[0085] The SD-WAN controller performs potential threat analysis on the information reported from the SD-WAN edge device and obtains potential threat analysis results;

[0086] Conduct quantitative evaluation of potential threat analysis results to assess the degree of harm and impact of potential threats on the network;

[0087] Prioritize potential threats based on the degree of harm and scope of impact they may cause to the network;

[0088] Generate a detailed security report based on the potential threat analysis results and quantitative assessment results, and issue warning information to relevant personnel or systems based on priority, where the warning information includes threat type, impact scope, urgency, and response measures.

[0089] In this embodiment, the SD-WAN controller performs potential threat analysis on the data reported from the edge device, which usually involves in-depth mining and correlation analysis of various types of data such as security events, traffic anomalies, system logs, etc., to identify potential security threats. After identifying the potential threats, the SD-WAN controller will conduct quantitative assessments on these threats. The purpose of the assessment is to determine the specific degree of harm and possible scope of impact caused by the threats to the network, which usually requires consideration of multiple factors such as the type, scale, propagation speed, and potential losses of the threats. Based on the results of the quantitative assessment, the SD-WAN controller will prioritize the potential threats. High-priority threats usually have a higher degree of urgency and a greater potential impact, so they need to be handled first. The SD-WAN controller will generate a detailed security report based on the potential threat analysis results and the quantitative assessment results. The report should include a threat overview, impact analysis, risk assessment, recommended countermeasures, etc., so that relevant personnel can fully understand the security status and take corresponding actions. According to the priority ranking of the potential threats, the SD-WAN controller will issue warning information to relevant personnel or systems. The warning information should clearly indicate the threat type, scope of impact, urgency, and recommended countermeasures, so that relevant personnel can respond quickly and reduce potential losses.

[0090] Preferably, the SD-WAN controller performs potential threat analysis on the information reported from the SD-WAN edge device to obtain a potential threat analysis result, specifically including:

[0091] The SD-WAN controller uses real-time analysis technology to process information reported from SD-WAN edge devices in real time and identify preliminary potential threats;

[0092] Conduct correlation analysis on preliminary potential threats based on data from different sources and types to obtain security risks and potential threats hidden behind the data;

[0093] Combined with external threat intelligence sources, the security risks and potential threats hidden behind the data are verified to obtain the final potential threats.

[0094] In this embodiment, the SD-WAN controller uses real-time analysis technology to quickly process data received from edge devices. This real-time performance is crucial for timely identification and processing of potential threats because it allows the controller to take action before the threat spreads. Through real-time analysis technology, the controller can identify preliminary potential threats, which are usually based on preset rules, pattern matching, or behavior analysis methods to screen out data that may indicate security issues. In order to gain a deeper understanding of potential threats, the controller will perform correlation analysis based on data from different sources and different types, including correlating multiple types of data such as security events, traffic statistics, and system logs to discover security risks and potential threats hidden behind the data. Correlation analysis helps to reveal the attacker's behavior patterns, attack paths, and potential targets. After obtaining the security risks and potential threats hidden behind the data through correlation analysis, the SD-WAN controller will verify these threats in combination with external threat intelligence sources. External threat intelligence sources may include security vulnerability databases, blacklists, information shared by security communities, etc. These intelligence sources provide detailed information about known threats, attack methods, and vulnerabilities, which helps the controller to more accurately assess the authenticity and severity of potential threats.

[0095] Preferably, adjusting the security policy of the SD-WAN controller and optimizing the network configuration according to the security report and warning information specifically includes:

[0096] Integrate security reports from different security devices and systems with the SD-WAN controller’s own warning information to identify common characteristics, development trends, and potential unknown threats;

[0097] Generate corresponding security policies based on the identification results and prioritize the security policies;

[0098] Push the formulated security policies to the SD-WAN controller in real time.

[0099] In this embodiment, security reports from different security devices and systems are integrated with the early warning information of the SD-WAN controller itself. This comprehensive analysis of cross-source information can more comprehensively identify the common characteristics, development trends and potential unknown threats of threats. This comprehensive threat identification capability helps enterprises to more accurately grasp the network security situation and provide a solid foundation for formulating effective security strategies. Corresponding security strategies are generated based on the identification results. These strategies are highly targeted and can directly respond to identified threats. At the same time, the strategy formulation process also takes into account the priority and urgency of the threat to ensure that the most critical security issues can be dealt with first when resources are limited. Prioritization helps system administrators or security teams deal with multiple security threats in order of importance, thereby improving response efficiency and effectiveness; the formulated security policies are pushed to the SD-WAN controller in real time to ensure that the security policies can take effect immediately and protect the network. This real-time push mechanism enables the SD-WAN network to respond quickly to security threats and reduce the impact of security incidents on the network; as the network environment and threat situation continue to change, the SD-WAN controller can dynamically adjust the security policy based on new security reports and warning information. This dynamic adjustment capability enables the SD-WAN network to continue to maintain effective defense against security threats.

[0100] An Internet security supervision system based on SD-WAN, comprising:

[0101] The building module is used to build the SD-WAN network architecture and deploy the SD-WAN controller and multiple SD-WAN edge devices. The SD-WAN controller is responsible for the global management of the network and the formulation of security policies. The SD-WAN edge devices are deployed at the edge of the enterprise network and are responsible for executing security policies.

[0102] The delivery module is used by the SD-WAN controller to deliver the formulated security policies to each SD-WAN edge device;

[0103] The recording module is used by the SD-WAN edge device to record relevant security events, traffic statistics and system logs during the execution of security policies, and report this information to the SD-WAN controller;

[0104] The analysis module is used by the SD-WAN controller to centrally process and analyze the reported information, identify potential security threats, assess security risks, and generate corresponding security reports and warning information;

[0105] The adjustment module is used to adjust the security policy of the SD-WAN controller and optimize the network configuration based on security reports and warning information.

[0106] A computing device includes a memory, a processor, and a computer program stored in the memory and executable on the processor. When the processor executes the computer program, the steps of the above-mentioned SD-WAN-based Internet security supervision method are implemented.

[0107] A computer-readable storage medium having a computer program stored thereon, wherein the computer program, when executed by a processor, implements the steps of the above-mentioned SD-WAN-based Internet security supervision method.

[0108] The above description is only a preferred embodiment of the present invention and is not intended to limit the present invention. Any modifications, equivalent substitutions, improvements, etc. made within the spirit and principles of the present invention should be included in the protection scope of the present invention.

Claims

1. A method for Internet security supervision based on SD-WAN, characterized in that: Specifically include: Build an SD-WAN network architecture, deploy an SD-WAN controller and multiple SD-WAN edge devices. The SD-WAN controller is responsible for the global management of the network and the formulation of security policies. The SD-WAN edge devices are deployed at the edge of the enterprise network and are responsible for executing security policies. The SD-WAN controller sends the formulated security policies to each SD-WAN edge device; In the process of executing security policies, SD-WAN edge devices record relevant security events, traffic statistics, and system logs, and report this information to the SD-WAN controller; The SD-WAN controller centrally processes and analyzes the reported information, identifies potential security threats, assesses security risks, and generates corresponding security reports and warning information; Adjust the security policy of the SD-WAN controller and optimize the network configuration based on security reports and warning information.

2. According to the SD-WAN-based Internet security supervision method of claim 1, it is characterized in that: The SD-WAN controller formulates security policies, including: The SD-WAN controller evaluates the enterprise's current network environment, including network topology, bandwidth requirements, application priorities, and security requirements; Based on the evaluation results, the SD-WAN controller defines the objectives of the security policy, which include protecting critical data, preventing unauthorized access, and ensuring the continuity of network services; According to the goal of the security policy, the SD-WAN controller formulates several security rules, including traffic filtering security rules, access control security rules, data encryption security rules, and threat detection and response security rules; The SD-WAN controller configures the priorities of different security rules.

3. The Internet security supervision method based on SD-WAN according to claim 2 is characterized in that: The SD-WAN controller sends the formulated security policy to each SD-WAN edge device, including: The SD-WAN controller first encapsulates the formulated security policy into a data packet and encrypts the encapsulated data packet; Evaluate the status of each SD-WAN edge device, including device performance, load, and connection quality; Based on the status assessment results of the SD-WAN edge devices, the SD-WAN controller will intelligently select the distribution time and method; Before the SD-WAN edge device receives a security policy and attempts to execute it, the SD-WAN controller requires the SD-WAN edge device to perform policy validation.

4. The Internet security supervision method based on SD-WAN according to claim 3 is characterized in that: In the process of executing security policies, the SD-WAN edge device records relevant security events, traffic statistics and system logs, and reports this information to the SD-WAN controller, specifically including: SD-WAN edge devices monitor network traffic and system activities in real time to capture security events that occur; Use machine learning to intelligently classify captured security events to obtain different types of security threats; Conduct traffic statistics based on network traffic, and conduct multi-dimensional statistical analysis based on the statistical results to obtain application layer traffic distribution information, user behavior pattern information, and traffic anomaly detection information; Based on the application layer traffic distribution information, user behavior pattern information and traffic anomaly detection information, predictions are made to obtain future traffic trends and potential security risks; Record detailed system logs and, when recording logs, associate different events and log entries to form a complete context chain; Report different types of security threats, future traffic trends and potential security risks, as well as contextual chains to the SD-WAN controller.

5. The Internet security supervision method based on SD-WAN according to claim 4 is characterized in that: The SD-WAN controller centrally processes and analyzes the reported information, identifies potential security threats, assesses security risks, and generates corresponding security reports and warning information, including: The SD-WAN controller performs potential threat analysis on the information reported from the SD-WAN edge device and obtains potential threat analysis results; Conduct quantitative evaluation of potential threat analysis results to assess the degree of harm and scope of impact of potential threats on the network; Prioritize potential threats based on the degree of harm and scope of impact they may cause to the network; Generate a detailed security report based on the potential threat analysis results and quantitative assessment results, and issue warning information to relevant personnel or systems based on priority, where the warning information includes threat type, impact scope, urgency, and response measures.

6. The Internet security supervision method based on SD-WAN according to claim 5 is characterized in that: The SD-WAN controller performs potential threat analysis on the information reported from the SD-WAN edge device to obtain potential threat analysis results, specifically including: The SD-WAN controller uses real-time analysis technology to process information reported from SD-WAN edge devices in real time and identify preliminary potential threats; Conduct correlation analysis on preliminary potential threats based on data from different sources and types to obtain security risks and potential threats hidden behind the data; Combined with external threat intelligence sources, the security risks and potential threats hidden behind the data are verified to obtain the final potential threats.

7. The Internet security supervision method based on SD-WAN according to claim 6 is characterized in that: According to the security report and warning information, the security policy of the SD-WAN controller is adjusted and the network configuration is optimized, including: Integrate security reports from different security devices and systems with the SD-WAN controller’s own warning information to identify common characteristics, development trends, and potential unknown threats; Generate corresponding security policies based on the identification results and prioritize the security policies; Push the formulated security policies to the SD-WAN controller in real time.

8. An Internet security supervision system based on SD-WAN, characterized in that: include: The building module is used to build the SD-WAN network architecture and deploy the SD-WAN controller and multiple SD-WAN edge devices. The SD-WAN controller is responsible for the global management of the network and the formulation of security policies. The SD-WAN edge devices are deployed at the edge of the enterprise network and are responsible for executing security policies. The delivery module is used by the SD-WAN controller to deliver the formulated security policies to each SD-WAN edge device; The recording module is used by the SD-WAN edge device to record relevant security events, traffic statistics and system logs during the execution of security policies, and report this information to the SD-WAN controller; The analysis module is used by the SD-WAN controller to centrally process and analyze the reported information, identify potential security threats, assess security risks, and generate corresponding security reports and warning information; The adjustment module is used to adjust the security policy of the SD-WAN controller and optimize the network configuration based on security reports and warning information.

9. A computing device, characterized in that It includes a memory, a processor, and a computer program stored in the memory and executable on the processor. When the processor executes the computer program, it implements the steps of the SD-WAN-based Internet security supervision method described in any one of claims 1 to 7.

10. A computer-readable storage medium, characterized in that: The storage medium stores a computer program, which, when executed by a processor, implements the steps of the SD-WAN-based Internet security supervision method described in any one of claims 1 to 7.

Images