A method for combing and strengthening the attack surface of a firewall

Abstract

The present application provides a method for combing and strengthening the security of firewall attack surfaces, including: protecting sensitive data at each link of data flow in the identified supply chain, deploying a data leakage prevention gateway on the data flow link, using content-aware deep packet inspection to achieve visualization and security audit of data flow behavior, and blocking and alerting abnormal data flow; building a security policy configuration knowledge base, mapping business descriptions to security policy components, using a policy generation engine based on a combination of rules and deep learning, automatically generating fine-grained security policies that match business semantics, and using the constructed knowledge graph reasoning to achieve cross-scenario policy conflict detection and correction.

Description

Technical Field

[0001] The present invention relates to the field of information technology, and in particular to a method for combing and securing a firewall's attack surface. Background Art

[0002] As enterprises accelerate digital transformation, traditional network boundaries are broken, and the original firewall deployment and strategy are difficult to meet the security needs under the hybrid business model. When enterprises adopt innovative hybrid business models, the traditional business line division becomes blurred, making it difficult to define and implement security policies. In this case, building a flexible security policy framework faces many technical challenges. First, the security needs in different business scenarios vary greatly. For example, online business focuses on data security and privacy protection, while offline business focuses more on physical security and access control. Secondly, under the hybrid business model, various business links are closely related, and security issues may spread and evolve between different business scenarios, making security risk assessment and prevention more complicated. Furthermore, the uncertainty brought about by business innovation makes it possible that the original security strategies and technical means may not be fully applicable and need to be continuously updated and optimized. At the same time, new technology environments such as virtualization and cloud computing have also brought more complexity to the deployment and configuration of firewalls. Finally, when achieving seamless security management and control across scenarios, it is also necessary to consider the compatibility and interoperability of different business systems and security mechanisms to avoid management blind spots and protection gaps. In short, building a security policy framework that adapts to the hybrid business model requires a comprehensive use of multiple technical means based on a deep understanding of business scenarios and security requirements to provide a set of flexible, intelligent, and scalable solutions that effectively balance security, availability, and cost-effectiveness. Enterprises need to re-examine traditional firewall deployment strategies, upgrade and transform existing security architectures, and establish a comprehensive, dynamically adaptive security protection system to protect hybrid business models. Summary of the invention

[0003] The present invention provides a method for sorting out and securing attack surfaces of a firewall, which mainly includes:

[0004] Step 1: According to the business process of online and offline integration of the enterprise, obtain the identity information, behavior data and business operation logs of users in different scenarios, as well as the network traffic data of the firewall, conduct correlation analysis on multi-source heterogeneous data, build a user portrait knowledge graph, characterize the behavior patterns and business semantics of users and networks, generate multi-dimensional user identity authentication strategies and implement them through firewall policy rules, and manage identities across scenarios in a unified manner;

[0005] Step 2: Based on the user portrait knowledge graph constructed in step 1, obtain the environmental perception data in the hybrid business scenario. The environmental perception data includes the user's geographic location, network status, and device fingerprint. Profiling the access environment, characterizing the risk level of different environments, dynamically adjusting the authentication strength and permission granularity according to environmental risks, generating a secure access policy that is adapted to the environment, and incorporating environmental perception information into the user behavior audit log;

[0006] Step 3: Aiming at the business collaboration scenario of upstream and downstream supply chains, adopt federated learning technology to share the user identity, behavior and transaction data generated in steps 1 and 2 among hybrid business entities in a privacy-protected manner, jointly build a cross-entity identity authentication and behavior analysis model, and identify abnormal behaviors and risk events in the supply chain;

[0007] Step 4: Protect sensitive data at each link of data flow in the supply chain identified in step 3, deploy data leakage prevention gateways on the data flow links, use content-aware deep packet inspection to visualize and audit data flow behaviors, and block and warn of abnormal data flows;

[0008] Step 5: Build a security policy configuration knowledge base, map business descriptions to security policy components, and use a policy generation engine based on rules and deep learning to automatically generate fine-grained security policies that match business semantics. Use the knowledge graph reasoning built in step 1 to achieve cross-scenario policy conflict detection and correction.

[0009] Step 6: Integrate the multi-dimensional risk data generated in steps 1 to 5, including abnormal user behavior, environmental mutation events, product safety accidents, data leakage events, and firewall security events and alarm data, map various risk data to a unified feature space, use twin neural networks to implement cross-scenario risk factor correlation analysis, conduct quantitative assessment of the security risks faced by the business, and generate an explainable business security situation analysis report;

[0010] Step 7. For the risk factors identified in step 6, use adaptive game theory and reinforcement learning to independently decide on the optimal combination of defense strategies and coordinate the deployment of security defense measures. Security defense measures include identity authentication, access control, data protection, and behavioral auditing. Through adversarial sample generation, the defense model is continuously optimized to enhance the system's adaptive defense capabilities in the face of unknown risks.

[0011] The technical solution provided by the embodiment of the present invention may have the following beneficial effects:

[0012] The present invention discloses a method for combing and strengthening the attack surface of a firewall. The present invention first constructs a user portrait knowledge graph to achieve unified identity management across scenarios. Then, environmental perception data is obtained to dynamically adjust the authentication strategy. For supply chain collaboration scenarios, federated learning technology is used to securely share data among multiple parties and build a cross-subject identity authentication and behavior analysis model. An anti-leakage gateway is deployed on the data flow link to achieve visual presentation and security auditing. The present invention also constructs a security policy configuration knowledge base to automatically generate fine-grained security policies that match business semantics. Multi-dimensional risk data is integrated, and a twin neural network is used to achieve cross-scenario risk association analysis and generate an interpretable security situation report. Finally, adaptive game theory and reinforcement learning are used to autonomously decide on the optimal defense strategy combination and collaboratively deploy security defense measures. Through multi-dimensional data fusion and intelligent analysis, the present invention realizes adaptive security protection in supply chain collaboration scenarios, effectively improving the system's defense capabilities against unknown risks. BRIEF DESCRIPTION OF THE DRAWINGS

[0013] Figure 1 The present invention is a flowchart of a method for combing and securing a firewall attack surface.

[0014] Figure 2 The present invention is a schematic diagram of a method for combing and strengthening the attack surface of a firewall.

[0015] Figure 3 This is another schematic diagram of a method for combing and strengthening the security of a firewall attack surface of the present invention. DETAILED DESCRIPTION

[0016] In order to enable those skilled in the art to better understand the technical solutions in this specification, the technical solutions in the embodiments of this specification will be clearly and completely described below in conjunction with the drawings in the embodiments of this specification. Obviously, the described embodiments are only part of the embodiments of this specification, not all of the embodiments. Based on the embodiments in this specification, all other embodiments obtained by ordinary technicians in this field without creative work should fall within the scope of protection of this specification.

[0017] like Figure 1-3 In this embodiment, a method for combing and strengthening the attack surface of a firewall may specifically include:

[0018] S101. Step 1. According to the business process of the enterprise's online and offline integration, obtain the user's identity information, behavior data and business operation logs in different scenarios, as well as the firewall's network traffic data; perform correlation analysis on multi-source heterogeneous data, build a user portrait knowledge graph, characterize the user and network behavior patterns and business semantics, generate multi-dimensional user identity authentication strategies and implement them through firewall policy rules, and uniformly manage identities across scenarios.

[0019] The identity identifier generated by the user login behavior is obtained, the data format of the identity identifier is unified, and the identity mapping data table is obtained by sorting and arranging according to the timestamp; the identity identifier associated data is obtained according to the identity mapping data table, the time window is used to perform data clustering, and the behavior feature sequence is extracted from the clustered data through a convolutional neural network to obtain a user tag data set; the network session data is obtained by using a firewall, the transmission protocol type and the session duration are extracted from the network session data, and the transmission protocol type and the session duration are analyzed based on the random forest algorithm to obtain abnormal access mode data; according to the user tag data set and the abnormal access mode data, the identity mapping data table is dynamically updated to determine whether the number of authentication failures exceeds a preset threshold; if the number of authentication failures exceeds the preset threshold, the identity identifier is added to the blacklist data set, and the access rights of the identity identifier are restricted by firewall rules; if the number of authentication failures does not exceed the preset threshold, the resource access rights of the identity identifier are divided according to the user tag data set.

[0020] Exemplarily, identity identifiers, daily business operation logs and behavior records are obtained from user login behaviors, and the timestamps are sorted and organized through unified data format processing, field missing records are removed, duplicate data are removed, data identifiers generated in multiple business scenarios are mapped and associated, and an identity mapping data table is established, and user identity correspondence is stored based on the mapping table. User identity identifier associated data is clustered according to time windows, and a convolutional neural network is used to extract features from the behavior sequence, record the distribution of access time intervals, count the frequency of business operations, extract the proportion of resource access types, calculate the operation behavior sequence, generate a user label data set, construct a user behavior attribute record table, and establish a portrait data table for different users. Use a firewall to collect network session data, record access source and target address pairs, extract transmission protocol type, session duration, and data packet size, set a time window to count traffic distribution, mark transmission abnormal behavior, identify abnormal access patterns based on the random forest algorithm, set a maximum attempt threshold, limit access time intervals, divide access rights levels, and establish a blacklist data set. According to the user behavior attribute record table and portrait data table, the user identity mapping data is dynamically updated, the number of consecutive failed authentications is recorded, the authentication attempt threshold is set, the access time period is limited, the resource access rights are divided, the blacklist records are updated, and the user identity is authenticated in multiple dimensions through firewall rules. Related attribute analysis: user identity information-behavior data-business log access rights-identity authentication-user verification multi-source data-heterogeneous data-real-time traffic network behavior pattern-access frequency-time regularity identity feature value-user portrait-access trajectory data identifier-association rule-business domain value. After the user logs in to the application through the mobile terminal, the terminal device number, application account, and login time are recorded, and the three types of behavior features of the user clicking the button, filling out the form, and submitting the data in the application operation record are extracted. The number of operations is counted according to the time window of every 5 minutes to generate a user behavior sequence, and the data validity period is set to 30 days. The data beyond the time range is cleaned up, and the identity mapping relationship is established for the data generated by the user on the web and mobile terminals, and stored in the identity association data table. A convolutional neural network is used to build a recognition model. The number of input layer nodes is set to 128, the number of hidden layer nodes is set to 64, and the number of output layer nodes is set to 32. Feature extraction is performed on user behavior sequence data, and the hourly access time distribution is counted. The business operation frequency is calculated according to weekdays and holidays, and the proportion of document, picture, and video resource access types is recorded. The proportion of the four types of operations of adding, deleting, modifying, and checking in the user operation behavior sequence is extracted to generate a user portrait label data set.Obtain the network session data of the last 7 days from the firewall database, record the source IP address, target IP address, access time, extract TCP, UDP, HTTP three types of protocol data packets, count the session duration greater than 1 hour, and the data packet size greater than 1MB transmission record, calculate the traffic fluctuation value according to the 10-minute time window, train the recognition model based on the random forest algorithm, set the trigger threshold for 3 consecutive authentication failures, limit the access interval from 8:00 to 18:00 during working hours, and divide the access rights into three levels: read-only, writable, and administrator. Based on the user portrait label data set, dynamically update the user identity mapping data according to the daily update frequency, record the number of user authentication failures, set the maximum number of authentication attempts per day to 5 times, divide the access rights into two types: ordinary users and administrator users, add users who exceed the number of attempts to the blacklist, limit the access time of blacklist users to 24 hours, and realize multi-dimensional authentication of user identities through firewall rules.

[0021] S102. Step 2. Based on the user portrait knowledge graph constructed in step 1, obtain environmental perception data in hybrid business scenarios. The environmental perception data includes user geographic location, network status, and device fingerprint. Profiling the access environment, characterizing the risk levels of different environments, dynamically adjusting the authentication strength and permission granularity according to environmental risks, generating a secure access policy that is adapted to the environment, and incorporating environmental perception information into the user behavior audit log.

[0022] Acquire location coordinate data contained in the base station signal of the mobile terminal, the location coordinate data including base station positioning data and global positioning data; collect network communication parameters according to the location coordinate data, the network communication parameters including network transmission rate, network delay value, and network packet loss rate; perform standardization processing on the network communication parameters to obtain environmental risk data, and divide the environmental risk data into risk levels through the naive Bayes algorithm; establish a risk rule base using the environmental risk data, and set authentication trigger conditions according to the geographic location deviation value, network packet loss rate, and equipment load rate; determine the authentication method according to the authentication trigger conditions in the risk rule base, if the geographic location deviation value exceeds a preset threshold, face recognition authentication is triggered, if the network packet loss rate exceeds the preset threshold, SMS verification code authentication is triggered, and if the equipment load rate exceeds the preset threshold, email verification link authentication is triggered.

[0023] Exemplarily, the location data is obtained by using the mobile terminal base station signal, the base station positioning error range is set to 500 meters, the global positioning accuracy is recorded within 10 meters, the location drift distance is greater than 1 km, the moving speed exceeds 200 kilometers per hour, the location update interval is set to 1 minute, the transmission rate, network delay, and packet loss rate are obtained from the network layer, the CPU occupancy rate is collected every 5 seconds, the memory usage rate is collected every 10 seconds, the disk read and write rate is collected every 30 seconds, and the network throughput is collected every minute. The hardware alarm threshold is set to 80% occupancy rate, and the data is normalized and added to the user portrait database. Risk classification is performed based on the standardized environmental data, the deviation value between the current position and the original trajectory is obtained from the geographic location, and the position deviation exceeds 5 kilometers, which is classified as high risk, the packet loss rate and network delay are obtained from the network communication, and the packet loss rate exceeds 5% and is classified as medium risk, the hardware occupancy rate and the number of concurrent connections are obtained from the equipment operation, and the equipment load exceeds 90% and is classified as high risk, and the response delay exceeds 2 seconds and is classified as medium risk, and the naive Bayes algorithm is used to classify the combination of environmental data features. A risk level rule base is established based on the environmental risk classification results. If the geographic location deviation exceeds 5 kilometers, face recognition is triggered, and the face recognition matching threshold is 85%. If the network packet loss rate is higher than 5%, the data transmission rate is limited to no more than 1MB per second. If the device load exceeds 90%, the number of concurrent connections is limited to no more than 1000. The rule parameters are optimized through the random forest algorithm to generate an authentication rule set corresponding to the risk level. The authentication mechanism is adjusted according to the risk level rule base. The SMS verification code is valid for 5 minutes, the email verification link is valid for 30 minutes, the fingerprint recognition error is limited to 3 times, and the password error is limited to 5 times. The user access rights are subdivided into application access rights, data access rights, and functional operation rights. The environmental change data and authentication adjustment information are recorded in the audit log, including the environmental anomaly type, trigger time, adjustment rules, and authentication method in the audit database. In the office area of ​​Shanghai, mobile terminals obtain location data through China Mobile base stations. The base station positioning error is controlled within 500 meters, and the satellite positioning accuracy is within 10 meters. The user's location trajectory from Jing'an District to Pudong New Area is recorded, and the distance between moving trajectory points is recorded every 200 meters. The user's moving speed increases from 40 kilometers per hour to 210 kilometers per hour, triggering an abnormality. The data transmission rate through the telecommunications 4G network is 10MB per second, the network delay fluctuation range is 20-50 milliseconds, the packet loss rate is between 0.1%-0.5%, the server processor occupancy rate is 75%, the memory utilization rate is 65%, the disk read and write rate is 500MB per second, and the network throughput is 8GB per hour.The user's geographic location deviation from Shanghai to Hangzhou reaches 175 kilometers, triggering the location risk level to be high, the network signal changes from 4G to 2G, the transmission rate drops to 56KB per second, the packet loss rate rises to 6.5%, triggering the network risk level to be medium, the server load suddenly increases to 95%, the number of concurrent connections reaches 1200, the response delay exceeds 3 seconds, triggering the device risk level to be high, and the naive Bayes algorithm calculates the risk probabilities of the three feature combinations to be 85%, 60%, and 90% respectively. After the high-risk rule is triggered, face recognition is started, and the number of facial feature point matches is set to be more than 150 and the recognition similarity is greater than 85% to pass, the network transmission rate is limited to 512KB per second, and the number of concurrent connections is adjusted to 800. The random forest algorithm iteratively optimizes the three threshold parameters 1000 times, and outputs the risk threshold parameters: location deviation 4.8 kilometers, packet loss rate 4.8%, and load threshold 92%. The authentication mechanism is dynamically adjusted according to the optimized threshold parameters. A 6-digit verification code is sent to the mobile phone 13812345678. The verification code is valid for 300 seconds. A verification link is sent to the email address user@company.com. The link is valid for 1800 seconds. The number of fingerprint entry is limited to 3 times, and the login password is limited to 5 times. The subdivided permissions include order query permissions, file download permissions, and approval operation permissions. The risk event number RK202401280001, trigger time 2024-01-2810:30:45, authentication method two-factor authentication, and environmental data location drift of 176 kilometers are recorded.

[0024] S103. Step 3. Aiming at the business collaboration scenario of upstream and downstream supply chains, adopt federated learning technology to share the user identity, behavior and transaction data generated in steps 1 and 2 among hybrid business entities in a privacy-preserving manner, jointly build a cross-entity identity authentication and behavior analysis model, and identify abnormal behaviors and risk events in the supply chain.

[0025] Acquire shared data between supply chain entities, perform desensitization processing on user identity identifiers based on the shared data to obtain an encrypted data set, wherein the desensitization processing includes retaining the last four digits of the mobile phone number, retaining the last six digits of the ID number, and converting the name into a random string; establish a user identity mapping table for the encrypted data set, use a support vector machine algorithm to extract behavioral features from the encrypted data set, calculate the identity identifier similarity based on the behavioral features to obtain an identity mapping association; construct a user behavior map based on the identity mapping association, set supplier permissions, manufacturer permissions, and dealer permissions for the user behavior map, and divide user operation sequences based on the permissions; train a deep neural network model using a cross-validation method, the deep neural network model receives the user operation sequence, and constructs a behavior feature vector based on geographic location information, access time, and operation resources; if the behavior feature vector deviation value exceeds a preset threshold, obtain the risk propagation path in the user behavior map, limit user operation permissions based on the risk propagation path, and lock the account of users whose risk level exceeds a preset value.

[0026] For example, the encryption parameter length of 2048 bits is used to encrypt and transmit shared data between upstream and downstream entities in the supply chain. The last four digits of the mobile phone number and the last six digits of the ID number in the user identity data are retained, and the name is converted to a random string. The address information retains the province, city, and district, and the timestamp is converted to a time period. The business data is encrypted in groups, the transmission data compression ratio is 75%, the encryption key update cycle is 24 hours, and the data shard size is 1MB, and a standard encrypted data set is generated. The encrypted data set is obtained from suppliers to dealers, and a mapping table is established for the same user identity. The support vector machine algorithm is used to extract features from the behavior data. The behavior sequence length is set to 256, the operation interval time threshold is 10 seconds, the upper limit of the number of access resources is 1000, and the behavior feature dimension is set to 128. Based on differential privacy, random noise with an amplitude less than 0.1 is added, and the identity similarity is calculated. For users with a similarity greater than 0.85, an identity mapping association is established. According to the identity mapping association, the user behavior map is constructed, and three types of roles are set: supplier authority, manufacturer authority, and dealer authority. The deep neural network is trained on the user identity authentication records by cross-validation. The input layer has 256 nodes, the hidden layer has 4 layers with 128 nodes per layer, and the output layer has 32 nodes. The behavior feature vector is constructed based on the three types of data: geographic location information, access time, and operation resources, and the user cross-role operation sequence is generated. The user's cross-role operation is scored, the number of authentication failures is limited to 10 times, the operation frequency is capped at 100 times per minute, the sequence deviation threshold is set to 0.9, the behavior score range is 0-100, and the risk level is divided into three levels: low, medium, and high. The risk propagation path is obtained from the user behavior map, the operation authority of high-risk users is restricted, and high-frequency and high-risk operations between different roles are blocked. Users with scores below 60 points will be locked for 24 hours. In the automotive manufacturing supply chain scenario, the parts supplier desensitizes the order number M202401280001, mobile phone number 1381**678, and ID number 4201****2288 in the user order data, encrypts the purchase quantity 4586 pieces, unit price 876 yuan, and delivery date 2024-01-28, and uses a 2048-bit key to encrypt the generated encrypted data packet size of 950KB, and the compressed data size is 721KB. The data is sharded according to the size of 1MB. The encryption key is updated at zero o'clock every day, and the data is transmitted to the automobile manufacturer and dealer nodes. The automobile manufacturer collects order data, establishes a mapping relationship for user M202401280001 in the parts supplier data, extracts the user's order frequency 3 times a week, the purchase amount volatility is 15%, and the delivery date interval is 7 days to form behavioral features, adds a random noise amplitude of 0.08, matches the user's order record at the dealer to obtain a similarity of 0.92, establishes a full chain data mapping from the supplier to the dealer, and forms a behavioral training data set.The permissions for user behavior data are divided, and the permissions for spare parts query, price browsing, and inventory confirmation are set. The permissions for manufacturers of production plans, bills of materials, and quality inspection records are set, and the permissions for dealers of sales orders, distribution plans, and maintenance records are set. The four-layer structure of the deep neural network is trained, 256-dimensional behavior data is input, and 32-dimensional feature vectors are output. The sequence data of the user's procurement, production, and sales process from suppliers to dealers is extracted. It is recorded that user M202401280001 failed to authenticate 8 times in a row during 10:30-11:30 on January 28, the operation frequency reached 150 times per minute, the behavior sequence deviation value was 0.95, and the score result was 55 points, which was classified as a high-risk level. The abnormal propagation path was marked in the supply chain behavior map, and the user's permission to query orders, browse prices, and confirm inventory operations was restricted. The account was locked until 10:30 on January 29.

[0027] S104. Step 4. In each link of the data flow in the supply chain identified in step 3, protect sensitive data, deploy a data leakage prevention gateway on the data flow link, use content-aware deep packet inspection to achieve visualization and security audit of data flow behavior, and block and alert abnormal data flow.

[0028] Acquire the data packets sent by the data transmission nodes in the supply chain, add invisible character tags and check codes according to the data packets, and the check codes are used to identify the sensitivity of the data packets; use an anti-leakage gateway to capture the data packet payload content, and extract the characteristic values ​​of the data packet payload content through a convolutional neural network, the characteristic values ​​include data packet size, transmission time interval, and target address; establish a baseline database based on the characteristic values, the baseline database records the baseline value of the data packet size, the baseline value of the transmission time interval, and the target address whitelist, and if the data packet transmission volume exceeds the transmission threshold, the data packet collection is triggered; use the baseline database to calculate the characteristics of the data packet, and use the decision tree algorithm to determine whether the data packet is abnormal. If the data packet size exceeds the baseline value or the transmission interval is less than the time threshold, the data packet is determined to be an abnormal data packet; generate an abnormal event number for the abnormal data packet, calculate the flow score according to the transmission source address, target address, and transmission frequency of the abnormal data packet, generate a data flow situation diagram through the flow score, and disconnect the abnormal transmission connection according to the data flow situation diagram.

[0029] For example, sensitive data is marked at the data transmission nodes of the supply chain, invisible characters are added to text data, checksums are embedded in digital information, steganographic information is embedded in images, metadata tags are added to documents, and timestamps are marked on data packets. The data packet size is limited to 10MB, the transmission interval is 5 seconds, the target address whitelist is verified, the protocol type is limited to TCP / UDP, and the transmission port range is 1024-65535. Anti-leakage gateways are deployed at the network boundary for data packet filtering. The data packet payload content is captured from the gateway, and the data flow features are extracted using a convolutional neural network. The input layer is set to 64 nodes, the hidden layer is set to 128 nodes, and the output layer is set to 32 nodes. The baseline value of the data packet size is 5MB, the transmission interval is 3 seconds, and the target address list is counted. A baseline database is built to record normal data flow behavior. Data packet collection is triggered when the transmission data volume exceeds 100MB per second. The data packet feature values ​​are calculated based on the baseline database. Data packets with a size exceeding 2 times the baseline, a transmission interval less than 1 second, more than 100 consecutive transmissions, a target address not in the whitelist, and a transmission rate exceeding 100MB per second are marked as abnormal. The decision tree algorithm is used to classify abnormal data packets, and the number of leaf nodes is set to 32, the tree depth is 8 layers, and the split threshold is 0.1. The data transmission trajectory is tracked in real time. The data flow behavior is scored, the abnormal event number is DLP202401280001, the abnormal type is data transmission, the trigger time is 2024-01-2815:30:45, the transmission source is 192.168.1.100, and the target address is 205.185.125.60. The number of transmission anomalies is recorded, the transmission frequency is greater than 10 times per second, and the flow trajectory deviates from the baseline by 0.8. A data flow situation diagram is generated, the transmission rate is limited to 1MB per second, the abnormal transmission connection is disconnected, and the alarm information is pushed to the management platform. In the sensitive data transmission scenario of the manufacturing enterprise supply chain, the invisible character 0x00 is inserted into the order detail text data interval, the MD5 checksum d41d3cd98f00b204e9800998ecf8427e is calculated for the digital information of the product price, the product image is embedded with steganographic watermark information, the contract document is marked with metadata, the data packet is timestamped 2024-01-2815:30:45, the data packet size is limited to 8.5MB, the transmission interval is 4.2 seconds, the protocol type is TCP, the port number is 3389, and the destination address 192.168.1.100 has been added to the whitelist. The gateway collects data packets. The convolutional neural network input layer receives 64-dimensional data features, extracts transmission features through a 128-node hidden layer, outputs a 32-dimensional behavior vector, records the data packet baseline value of 4.8MB, the transmission interval of 2.8 seconds, the target address of 192.168.1.100-192.168.1.200, and the data transmission volume reaches 112MB per second to trigger collection and capture the data packet payload content.The data packet size reached 11.2MB, which was 2.3 times higher than the baseline. The transmission interval was reduced to 0.8 seconds, and the transmission was continuous for 156 times. The target address 205.185.125.60 was not in the whitelist, and the transmission rate reached 156MB per second. The decision tree divided the anomalies into three categories: data outbound transmission, fast transmission, and address anomalies. The 32 leaf nodes corresponded to different anomaly types, and the tree depth of 8 layers distinguished the anomaly levels. The data transmission source 192.168.1.100 was located in real time. The abnormal event number DLP202401280001 was generated, the data outbound transmission type was marked, 15 transmission anomalies were recorded, the transmission frequency was 12 times per second, and the trajectory deviated from the baseline by 0.85. The abnormal transmission path was marked on the data flow situation diagram, the transmission rate was forced to drop to 512KB per second, and the connection with 205.185.125.60 was disconnected. The alarm information including the event number, anomaly type, time, source address, and target address was pushed to the management platform.

[0030] S105. Step 5. Build a security policy configuration knowledge base, map business descriptions to security policy components, use a policy generation engine based on rules and deep learning to automatically generate fine-grained security policies that match business semantics, and use the knowledge graph reasoning built in step 1 to achieve cross-scenario policy conflict detection and correction.

[0031] Receive input content with business scenario description information, wherein the business description information includes verb, noun and adjective information; perform word segmentation and tagging using a part-of-speech tagging processor according to the business description information to obtain a semantic component with part-of-speech tagging, wherein the semantic component includes an operation type, a resource object and a restriction condition; set a rule priority parameter for the semantic component, extract a rule feature vector through a convolutional neural network, and obtain a rule set with a hierarchical relationship; obtain rule attribute information in the rule set, use a support vector machine classifier to identify rule time overlap, resource mutual exclusivity, operation sequence contradictions, and subject identity conflicts, and obtain rule conflict identification information; prioritize the rules according to the rule conflict identification information, perform scenario splitting and rule merging for rules with the same priority in the rule set, and obtain supplementary rules from the knowledge graph to construct a complete rule list.

[0032] Exemplarily, access control descriptions are obtained from business scenarios, verbs are extracted to generate operation types, nouns are used to obtain resource objects, adjectives are used to construct limiting conditions, sentences are used to form logical relationships, and time words are used to determine execution cycles. Each resource identifier, operation name, and permission attribute is stored in a structured manner. A part-of-speech tagging processor is used to segment and tag business descriptions, an operation mapping dictionary is constructed, and converted into rule semantic components, and a unique identifier is added to each rule component. A rule set is generated based on the rule semantic components, and the priority of user identity rules is set to 80-100, the priority of environment rules to 60-79, the priority of behavior rules to 40-59, the priority of combination rules to 20-39, and the priority of basic rules to 1-19. A convolutional neural network is used to extract 256-dimensional feature vectors from the rules, and a rule mapping hierarchical relationship is generated based on rule semantics to construct a fine-grained access control rule set. Extract cross-scenario rules from the corresponding nodes of the knowledge graph, calculate the time overlap, resource mutual exclusivity, operation sequence contradiction, subject identity conflict, and environmental condition compatibility between rules, identify the rules with time overlap exceeding 50%, resource access rights mutual exclusivity, operation sequence logical contradiction, subject identity conflict, and incompatible environmental conditions, and use the support vector machine classifier to classify and identify rule conflicts. Perform rule processing for rule conflicts, retain rules with higher priority, split scenarios for rules with the same priority, merge conditional duplicate rules, supplement missing sub-rules, delete fully inclusive rules, obtain supplementary rules from the knowledge graph, determine the conflict between supplementary rules and existing rules, adjust the conflicting items in the rule base in order of priority, and generate the final rule list. In the sales order processing scenario, the business description includes the conversion of the verb "view" into a read operation, the conversion of the noun "order amount" into a resource object, the conversion of the adjective "paid" into a status restriction, the sentence "only allowed" to form an access control relationship, and the time word "working day" to determine the execution cycle. The resource identifier ORDER2024012800001, the operation READ, and the permission READ_ONLY are structured and stored. The part-of-speech tagging processor annotates "sales manager is only allowed to view the paid order amount" as "sales manager / n only allowed / v view / v paid / adj order amount / n", and constructs the operation mapping rule component identifier RULE20240128001. Generate order access rules, sales manager identity rule priority 95, office hours rule priority 75, query behavior rule priority 55, order status rule priority 35, basic access rule priority 15, convolutional neural network extracts 256-dimensional feature vectors, and constructs the rule hierarchy relationship: sales manager identity authentication-office time judgment-order status check-query permission control.The rules RULE20240128001 and RULE20240128002 extracted from the knowledge graph conflict, the calculation rule execution time overlap is 65%, there is a read-write conflict in the order resource access rights, the operation sequence contains query and modification contradictions, and the sales manager and financial director identity conflict. The support vector machine determines that the rule priority 95 is higher than 85, and the sales manager query rule is retained. The rule RULE20240128001 priority 95 is retained, split into workday rules and holiday rules, merge the rules with the same query conditions, supplement the order amount range rule, delete the full inclusion rule, supplement the order process rule from the knowledge graph, and judge that the supplemented rules have no conflicts. The final rule list contains three rule items: order query, amount verification, and status judgment.

[0033] S106. Step 6. Integrate the multi-dimensional risk data generated by steps 1 to 5, including abnormal user behavior, environmental mutation events, product safety accidents, data leakage events, firewall security events and alarm data, map various risk data into a unified feature space, use the twin neural network to realize cross-scenario risk factor correlation analysis, conduct quantitative assessment of the security risks faced by the business, and generate an explainable business security situation analysis report.

[0034] Obtain identity recognition results, environmental parameter change rates, and alarm levels from multi-source risk data, and generate a standardized risk attribute matrix based on risk data attributes; use the risk attribute matrix to generate feature vectors according to the preset operation sequence length and state change frequency, and encode the feature vectors through a twin neural network structure to obtain output feature data; determine the feature vector similarity value based on the output feature data, and if the feature vector similarity value is greater than a preset threshold, establish an association edge between risk nodes to obtain a risk factor association map; extract the risk propagation path based on the risk factor association map, and classify the risk nodes within the risk score range through a random forest algorithm to obtain a risk assessment data set; divide the risk assessment data set into user behavior domain, environmental perception domain, production operation domain, data asset domain, and network equipment domain, and store risk events according to time dimension, space dimension, and business dimension.

[0035] Exemplarily, risk data attributes are collected from multi-source risk data, the identification result is coded as 0 / 1, the environmental parameter change rate percentage, and the alarm level is coded as 1-5. The collection time window is set to 300 seconds, the data compression rate is 85%, and the attribute encoder is used to standardize user identity authentication records, user geographic location offsets, product quality anomalies, data leakage records, and firewall alarm records to generate a risk attribute matrix. According to the operation sequence length of 256, the state change frequency per second, and the alarm trigger interval of 30 seconds, the feature vector dimension 512 is generated. The twin neural network structure includes an encoding layer, a sharing layer, and a comparison layer. The input layer nodes are 512, the hidden layer nodes are 256, and the output layer nodes are 128. Based on the feature vector similarity threshold of 0.8, the cross-scenario data association analysis is performed, the risk node association edge is established, and the risk factor association map is constructed. According to the association map, the risk propagation path is extracted, and the risk nodes with high risk scores of 80-100, medium risk scores of 60-79, low risk scores of 0-59, propagation depth of 5 layers, and impact range radius of 3 hops are classified. The risk factors are graded using the random forest algorithm, and the alarm upgrade threshold is set to generate a risk assessment data set and record the disposal suggestion list. The security domain is divided according to the risk type, and the 24-hour risk event trend data is recorded. The risk events are counted according to the user behavior domain, environmental perception domain, production operation domain, data asset domain, and network equipment domain, and the risk disposal progress is counted. A risk situation analysis report is generated, and the risk data is classified and stored according to the time dimension, space dimension, and business dimension. In the supply chain environment of a manufacturing enterprise, the user 20240128001 was obtained from the identity identification record. He failed to authenticate for 5 times in a row and was marked as 1. The environmental parameters showed that the geographical location moved from Shanghai to Shenzhen with a deviation rate of 150%. The product batch P202401280001 failed the quality inspection. The database access record showed that 10MB of sensitive data was transmitted. The firewall alarm showed abnormal port 3389 connection. A 5-minute acquisition window was set, and the compression rate of the original data reached 82%. The risk matrix record R20240128001 was generated. Based on the risk matrix, the user operation sequence length was set to 256, the position drift rate was 180 kilometers per hour, and the alarm interval was 20 seconds. The twin neural network with 512 nodes in the input layer received risk data, 256 nodes in the hidden layer extracted common features, and 128 nodes in the output layer generated feature vectors. The similarity between user authentication anomalies and data transmission was calculated to be 0.85, and the similarity between position drift and port connection was 0.92. The associated subgraph containing 5 risk nodes was constructed. The risk-related subgraph nodes are scored, with a user authentication anomaly score of 85 points belonging to high risk, a location drift score of 75 points belonging to medium risk, a quality inspection anomaly score of 82 points belonging to high risk, a data transmission score of 90 points belonging to high risk, and a port anomaly score of 78 points belonging to medium risk. The random forest algorithm sets the risk propagation path to a depth of 4 layers and an impact range of 2 hops, and generates risk disposal suggestions including disconnecting abnormal connections, locking user accounts, and isolating quality inspection products.Based on the disposal recommendations, risk analysis was conducted in five security domains. Within 24 hours, 12 anomalies occurred in the user behavior domain, 8 anomalies occurred in the environmental perception domain, 5 anomalies occurred in the production operation domain, 3 anomalies occurred in the data asset domain, and 7 anomalies occurred in the network equipment domain. The risk event disposal rate was 85%, and a situation report numbered SA202401280001 was generated.

[0036] S107. Step 7. For the risk factors identified in step 6, use adaptive game theory and reinforcement learning to independently decide on the optimal combination of defense strategies and coordinate the deployment of security defense measures. The security defense measures include identity authentication, access control, data protection, and behavioral auditing. Through adversarial sample generation, the defense model is continuously optimized to enhance the system's adaptive defense capabilities in the face of unknown risks.

[0037] According to the user access records, operation timing feature data is obtained, and a game benefit matrix is ​​constructed by combining the operation timing feature data with the state transition features extracted from the environment perception parameters and the attack chain features extracted from the security events; the game benefit matrix is ​​input into the deep reinforcement learning model, and the protection measure combination score is calculated through the state transfer function, and the protection measure combination score is determined by the state space vector and the action space vector; the value function iteration operation is performed according to the protection measure combination score, and the value function iteration operation obtains a protection scheme consisting of authentication rules, access rules, protection rules and audit rules; adversarial sample data is generated for the protection scheme, and the adversarial sample data is tested through identity theft attack, unauthorized access attack, data theft attack and behavior avoidance attack scenario to obtain protection effect data; based on the protection effect data, the protection rules are optimized and combined, and the optimized combination obtains the optimal protection combination by improving authentication strength, subdividing access granularity, improving encryption strength and reducing audit intervals.

[0038] For example, a defense space is constructed for the risk identification results, with a defense effect score of 0-100, a resource consumption rate of 0-100%, and a performance overhead limit of 50%. Based on the user access records, the operation timing features are extracted, the state transition features are extracted from the environment perception parameters, and the attack chain features are extracted from the security events. A game benefit matrix is ​​constructed, with a benefit threshold of 0.8, a parameter update cycle of 1 hour, and a 256-dimensional state space vector is mapped. Deep reinforcement learning is used to train the defense space, with a 128-dimensional action space, a reward value range of -1 to 1, 1000 training rounds, and a learning rate of 0.01. A state transfer function is constructed to calculate the combined score of the protection measures, the defense benefit is evaluated through the reward function, and the protection combination is iteratively optimized based on the value function to generate four types of protection schemes: authentication rules, access rules, protection rules, and audit rules. Generate 100 sets of adversarial samples from the protection scheme, with a variation limit of 20%, attack intensity graded 1-5, 50 test rounds, and a successful breakthrough threshold of 15%. Construct identity impersonation attack, unauthorized access attack, data theft attack, and behavior avoidance attack scenarios, and record the protection effect score, resource consumption rate, and performance overhead value of the protection combination in the adversarial test. Update the protection strategy based on the adversarial test data, increase the authentication strength by 25%, subdivide the access granularity by 2 levels, increase the encryption strength by 1 bit, and reduce the audit interval by 5 seconds. Perform 10 rounds of optimization combinations on the protection rules, and generate the optimal protection combination based on the principles of priority of protection effect, minimum resource consumption, and minimum performance overhead. In the financial transaction scenario, the abnormal behavior record of user U20240128001 is obtained from risk identification. The number of transactions per day exceeds 100 times, and the score is 85 points, the memory consumption rate reaches 85%, and the response delay exceeds 2 seconds. Based on the transaction flow, the operation sequence characteristics are obtained to show short-term high-frequency transactions, the environmental parameters show uncommon IP address access, and the security log records SQL injection attacks. The game matrix is ​​constructed to calculate the defense benefit of 0.75, and the game parameters are updated every 60 minutes to generate a 256-dimensional vector to represent the current defense status. Deep reinforcement learning sets four action spaces: authentication strength, access rights, data encryption, and audit frequency. A single action space has 32 dimensions and a total of 128 dimensions. When the attack is successfully blocked, the reward value is 1, and the penalty value for attack breakthrough is -1. The training iteration is 1000 rounds. The learning rate is set to 0.01. The combined scoring of the protection measures shows that the two-factor authentication score is 0.9, the fine-grained authorization score is 0.85, the full encryption score is 0.8, and the real-time audit score is 0.75. Based on the protection score, 100 groups of variant adversarial samples were generated, including 15% account and password brute force cracking mutations, 18% privilege escalation mutations, 12% database injection mutations, and 20% abnormal behavior avoidance mutations. After 50 rounds of testing, the account breakthrough rate was 12%, the privilege escalation success rate was 8%, the injection success rate was 5%, and the avoidance success rate was 14%. During the adversarial sample attack, the peak memory usage was 90%, the maximum response delay was 2.5 seconds, and the processor utilization rate was 85%.The protection strategy combination was optimized and updated. Face recognition was added to two-factor authentication. Access granularity was broken down to field level. The encryption algorithm bit number was increased to 256 bits. The audit interval was shortened to 1 second. After 10 rounds of iterative optimization, the optimal combination achieved a 95% protection rate in the adversarial test, reduced resource usage to 65%, and controlled the response delay to 0.8 seconds.

[0039] The above description is only a preferred embodiment of the present application and an explanation of the technical principles used. Those skilled in the art should understand that the scope of the invention involved in the present application is not limited to the technical solution formed by a specific combination of the above technical features, but should also cover other technical solutions formed by any combination of the above technical features or their equivalent features without departing from the concept of the present application. For example, the above features are replaced with the technical features with similar functions disclosed in the present application (but not limited to) to form a technical solution.

Claims

1. A method for combing and strengthening the attack surface of a firewall, characterized in that: The method comprises: Step 1: According to the business process of online and offline integration of the enterprise, obtain the identity information, behavior data and business operation logs of users in different scenarios, as well as the network traffic data of the firewall, conduct correlation analysis on multi-source heterogeneous data, build a user portrait knowledge graph, characterize the behavior patterns and business semantics of users and networks, generate multi-dimensional user identity authentication strategies and implement them through firewall policy rules, and manage identities across scenarios in a unified manner; Step 2: Based on the user portrait knowledge graph constructed in step 1, obtain the environmental perception data in the hybrid business scenario. The environmental perception data includes the user's geographic location, network status, and device fingerprint. Profiling the access environment, characterizing the risk level of different environments, dynamically adjusting the authentication strength and permission granularity according to environmental risks, generating a secure access policy that is adapted to the environment, and incorporating environmental perception information into the user behavior audit log; Step 3: Aiming at the business collaboration scenario of upstream and downstream supply chains, adopt federated learning technology to share the user identity, behavior and transaction data generated in steps 1 and 2 among hybrid business entities in a privacy-protected manner, jointly build a cross-entity identity authentication and behavior analysis model, and identify abnormal behaviors and risk events in the supply chain; Step 4: Protect sensitive data at each link of data flow in the supply chain identified in step 3, deploy data leakage prevention gateways on the data flow links, use content-aware deep packet inspection to visualize and audit data flow behaviors, and block and warn of abnormal data flows; Step 5: Build a security policy configuration knowledge base, map business descriptions to security policy components, and use a policy generation engine based on rules and deep learning to automatically generate fine-grained security policies that match business semantics. Use the knowledge graph reasoning built in step 1 to achieve cross-scenario policy conflict detection and correction. Step 6: Integrate the multi-dimensional risk data generated in steps 1 to 5, including abnormal user behavior, environmental mutation events, product safety accidents, data leakage events, and firewall security events and alarm data, map various risk data to a unified feature space, use twin neural networks to implement cross-scenario risk factor correlation analysis, conduct quantitative assessment of the security risks faced by the business, and generate an explainable business security situation analysis report; Step 7. For the risk factors identified in step 6, use adaptive game theory and reinforcement learning to independently decide on the optimal combination of defense strategies and coordinate the deployment of security defense measures. Security defense measures include identity authentication, access control, data protection, and behavioral auditing. Through adversarial sample generation, the defense model is continuously optimized to enhance the system's adaptive defense capabilities in the face of unknown risks.

2. The method according to claim 1, characterized in that The first step is to obtain the identity information, behavior data and business operation logs of users in different scenarios, as well as the network traffic data of the firewall, according to the business process of online and offline integration of the enterprise, perform correlation analysis on multi-source heterogeneous data, build a user portrait knowledge graph, characterize the behavior patterns and business semantics of users and networks, generate a multi-dimensional user identity authentication strategy and implement it through firewall policy rules, and uniformly manage identities across scenarios, including: Obtaining the identity identifier generated by the user's login behavior, performing data format unification processing on the identity identifier, and sorting and arranging according to the timestamp to obtain an identity mapping data table; Acquire identity identifier associated data according to the identity mapping data table, perform data clustering using a time window, extract behavioral feature sequences from the clustered data using a convolutional neural network, and obtain a user label data set; Using a firewall to obtain network session data, extracting the transmission protocol type and session duration from the network session data, analyzing the transmission protocol type and session duration based on a random forest algorithm to obtain abnormal access pattern data; Dynamically updating the identity mapping data table according to the user tag data set and the abnormal access mode data to determine whether the number of authentication failures exceeds a preset threshold; If the number of authentication failures exceeds a preset threshold, the identity identifier is added to a blacklist data set, and access rights to the identity identifier are restricted through firewall rules; If the number of authentication failures does not exceed a preset threshold, the resource access rights of the identity identifier are divided according to the user tag data set.

3. The method according to claim 1, characterized in that The second step is to obtain the environment perception data in the hybrid business scenario based on the user portrait knowledge graph constructed in the first step. The environment perception data includes the user's geographic location, network status, and device fingerprint. The access environment is profiled to characterize the risk level of different environments. The authentication strength and permission granularity are dynamically adjusted according to the environmental risk, and a security access policy adapted to the environment is generated. The environment perception information is incorporated into the user behavior audit log, including: Acquire location coordinate data contained in a base station signal of a mobile terminal, wherein the location coordinate data includes base station positioning data and global positioning data; Collect network communication parameters according to the position coordinate data, wherein the network communication parameters include network transmission rate, network delay value and network packet loss rate; Standardizing the network communication parameters to obtain environmental risk data, and dividing the environmental risk data into risk levels using a naive Bayes algorithm; The environmental risk data is used to establish a risk rule base, wherein the risk rule base sets authentication trigger conditions according to geographic location deviation value, network packet loss rate and device load rate; The authentication method is determined according to the authentication trigger conditions in the risk rule library. If the geographic location deviation value exceeds the preset threshold, face recognition authentication is triggered; if the network packet loss rate exceeds the preset threshold, SMS verification code authentication is triggered; if the device load rate exceeds the preset threshold, email verification link authentication is triggered.

4. The method according to claim 1, characterized in that: In step 3, for the upstream and downstream business collaboration scenarios of the supply chain, federated learning technology is used to share the user identity, behavior and transaction data generated in steps 1 and 2 among hybrid business entities in a privacy-protected manner, and jointly build a cross-entity identity authentication and behavior analysis model to identify abnormal behaviors and risk events in the supply chain, including: Acquire shared data between supply chain entities, and perform desensitization processing on user identities based on the shared data to obtain an encrypted data set, wherein the desensitization processing includes retaining the last four digits of the mobile phone number, retaining the last six digits of the ID number, and converting the name into a random string; Establishing a user identity mapping table for the encrypted data set, extracting behavior features from the encrypted data set using a support vector machine algorithm, and calculating identity identifier similarity based on the behavior features to obtain identity mapping associations; Building a user behavior map based on the identity mapping association, setting supplier permissions, manufacturer permissions and dealer permissions for the user behavior map, and dividing user operation sequences based on the permissions; A deep neural network model is trained by cross-validation, wherein the deep neural network model receives the user operation sequence and constructs a behavior feature vector according to geographic location information, access time and operation resources; If the behavior feature vector deviation value exceeds a preset threshold, the risk propagation path in the user behavior map is obtained, the user operation authority is restricted according to the risk propagation path, and the account of the user whose risk level exceeds the preset value is locked.

5. The method according to claim 1, characterized in that In step 4, sensitive data is protected at each link of data flow in the supply chain identified in step 3, and a data leakage prevention gateway is deployed on the data flow link. Content-aware deep packet inspection is used to achieve visualization and security audit of data flow behavior, and abnormal data flow is blocked and alarmed, including: Obtaining a data packet sent by a supply chain data transmission node, and adding an invisible character mark and a check code according to the data packet, wherein the check code is used to identify the sensitivity of the data packet; The anti-leakage gateway is used to capture the data packet payload content, and the feature value of the data packet payload content is extracted through a convolutional neural network, wherein the feature value includes the data packet size, transmission time interval and target address; A baseline database is established according to the characteristic value, the baseline database records a baseline value of a data packet size, a baseline value of a transmission time interval, and a target address whitelist, and if the data packet transmission volume exceeds a transmission threshold, data packet collection is triggered; The baseline database is used to perform feature calculation on the data packet, and a decision tree algorithm is used to determine whether the data packet is abnormal. If the size of the data packet exceeds the baseline value or the transmission interval is less than the time threshold, the data packet is determined to be an abnormal data packet; An abnormal event number is generated for the abnormal data packet, a flow score is calculated according to the transmission source address, target address and transmission frequency of the abnormal data packet, a data flow situation diagram is generated according to the flow score, and the abnormal transmission connection is disconnected according to the data flow situation diagram.

6. The method according to claim 1, characterized in that The step 5 is to build a security policy configuration knowledge base, map the business description to the security policy component, and use a policy generation engine based on rules and deep learning to automatically generate fine-grained security policies that match the business semantics. With the help of the knowledge graph reasoning built in step 1, cross-scenario policy conflict detection and correction are realized, including: Receiving input content with business scenario description information, wherein the business description information includes verbs, nouns, and adjective information; Using a part-of-speech tagging processor to perform word segmentation tagging according to the business description information to obtain a semantic component with part-of-speech tags, wherein the semantic component includes an operation type, a resource object, and a limiting condition; Setting rule priority parameters for the semantic components, extracting rule feature vectors through a convolutional neural network, and obtaining a rule set with a hierarchical relationship; Obtaining rule attribute information in the rule set, using a support vector machine classifier to identify rule time overlap, resource mutual exclusivity, operation sequence contradictions, and subject identity conflicts, and obtaining rule conflict identification information; The rules are prioritized according to the rule conflict identification information, scenarios are split and rules are merged for the rules with the same priority in the rule set, and supplementary rules are obtained from the knowledge graph to construct a complete rule list.

7. The method according to claim 1, characterized in that Step 6: Integrate the multi-dimensional risk data generated in steps 1 to 5, including abnormal user behavior, environmental mutation events, product safety accidents, data leakage events, and firewall security events and alarm data, map various risk data to a unified feature space, use twin neural networks to implement cross-scenario risk factor correlation analysis, conduct quantitative assessment of the security risks faced by the business, and generate an explainable business security situation analysis report, including: Obtain identity recognition results, environmental parameter change rates, and alarm levels from multi-source risk data, and generate a standardized risk attribute matrix based on risk data attributes; The risk attribute matrix is ​​used to generate a feature vector according to a preset operation sequence length and state change frequency, and the feature vector is encoded through a twin neural network structure to obtain output feature data; Determine a feature vector similarity value according to the output feature data, and if the feature vector similarity value is greater than a preset threshold, establish an association edge between risk nodes to obtain a risk factor association graph; Extract the risk propagation path from the risk factor association map, and classify the risk nodes within the risk score range using a random forest algorithm to obtain a risk assessment data set; According to the risk assessment data set, the user behavior domain, environmental perception domain, production operation domain, data asset domain and network equipment domain are divided, and risk events are stored according to the time dimension, space dimension and business dimension.

8. The method according to claim 1, characterized in that In step 7, for the risk factors identified in step 6, adaptive game theory and reinforcement learning are used to independently decide on the optimal defense strategy combination and coordinate the deployment of security defense measures, including identity authentication, access control, data protection, and behavior auditing. The defense model is continuously optimized through adversarial sample generation to enhance the system's adaptive defense capabilities in the face of unknown risks, including: Acquire operation time series feature data according to user access records, and construct a game benefit matrix with the operation time series feature data, state transition features extracted from environment perception parameters, and attack chain features extracted from security events; The game payoff matrix is ​​input into a deep reinforcement learning model, and a protective measure combination score is calculated through a state transfer function, where the protective measure combination score is determined by a state space vector and an action space vector; Performing a value function iteration operation according to the combined score of the protection measures, the value function iteration operation obtaining a protection scheme consisting of authentication rules, access rules, protection rules and audit rules; Generate adversarial sample data for the protection scheme, and obtain protection effect data by testing the adversarial sample data through identity impersonation attack, unauthorized access attack, data theft attack and behavior avoidance attack scenarios; The protection rules are optimized and combined based on the protection effect data, and the optimal protection combination is obtained by improving the authentication strength, subdividing the access granularity, improving the encryption strength and reducing the audit interval.

Images