Data security policy automatic adjustment system and method

Abstract

The invention discloses a data security policy automatic adjustment system and method. The system comprises a data acquisition module (DCM), a data analysis module (DAE), a security policy adjustment module (SPAM), a monitoring feedback module (MFM) and a training data module (TDR). The DCM collects key data such as user access records, network traffic and system logs. The DAE analyzes these data and generates security event alerts and risk assessments in combination with a risk knowledge base. And the SPAM formulates or updates security parameters according to the evaluation result, and generates and pushes a new security policy to the cloud environment. And the MFM monitors network flow and user behaviors, compares the network flow and the user behaviors with a preset baseline, and feeds back when abnormity is found. The TDR uses historical data to carry out scene simulation training, a data analysis model is optimized, and the safety performance of the system is improved.

Description

Technical Field

[0001] The present invention relates to the technical field of data processing, and in particular to a data security policy automatic adjustment system and method. Background Art

[0002] With the increasing popularity of cloud computing technology, enterprises and organizations are increasingly relying on cloud services to carry key businesses and store sensitive data, and this centralized data storage and processing method has also brought new security challenges. First, although traditional security mechanisms such as firewalls, intrusion detection systems and anti-virus software can provide protection to a certain extent, they can usually only deal with known security threats and require manual intervention to update rules or handle security incidents, which is often slow and inefficient in a dynamically changing network environment. Second, with the continuous changes in regulations, such as the implementation of the EU General Data Protection Regulation (GDPR), cloud service providers need to ensure that their services can not only resist cyber attacks, but also comply with data protection regulations in various countries and regions. Third, compliance checks often involve a lot of manual audit work, which brings additional complexity and cost to the management of cloud services. Fourth, when faced with major system failures or catastrophic events, the lack of an effective automated disaster recovery plan may lead to long-term business interruption and data loss, causing serious economic losses and brand reputation damage to the company. Summary of the invention

[0003] The main purpose of the embodiments of the present invention is to provide a system and method for automatically adjusting data security policies in order to solve at least one problem of the prior art. The present invention can efficiently realize automatic adjustment of data security policies.

[0004] To achieve the above-mentioned purpose, an embodiment of the present invention provides a data security policy automatic adjustment system in one aspect, including a system including a data acquisition module, a data analysis module, a security policy adjustment module, a monitoring feedback module, a training data module, a policy database module and a user interface module;

[0005] The data acquisition module is used to continuously collect key data from the cloud environment based on a preset data acquisition device, and perform preprocessing operations on the key data; transmit the key data after the preprocessing operation to the data analysis module and the monitoring feedback module; the key data includes user access records, network traffic information and system logs;

[0006] The monitoring feedback module is used to obtain risk data through a preset monitoring method based on the key data transmitted by the data acquisition module; and transmit the risk data to the data analysis module;

[0007] The data analysis module is used to perform risk analysis based on the key data transmitted by the data acquisition module through a pre-trained machine learning model to obtain risk assessment results; transmit the risk assessment results to the security policy adjustment module; and transmit the risk data transmitted by the monitoring feedback module to the training data module;

[0008] The training data module is used to perform scenario simulation training on the machine learning model of the data analysis module according to the risk data, and then adjust the network parameters of the machine learning model according to the results of the scenario simulation training;

[0009] A policy database module is used to organize and output security policy tuning information based on the security policy configuration file obtained by the preset policy database device; and transmit the security policy tuning information to the security policy adjustment module;

[0010] A security policy adjustment module is used to generate security policy adjustment information based on risk assessment results, and then generate a security adjustment policy in combination with the security policy tuning information; and transmit the security adjustment policy to a target security component of the cloud environment;

[0011] The user interface module is used to modify the data information of the data acquisition module, the data analysis module, the security policy adjustment module, the monitoring feedback module, the training data module and the policy database module in response to the modification instruction; and to visualize the data information.

[0012] In some embodiments, the data collection device includes a network sniffer and a log analysis tool deployed and integrated on a cloud platform in a cloud environment;

[0013] Network sniffers and log analysis tools are used to monitor and intercept the original network data packets and operation logs flowing through the nodes corresponding to the cloud platform in real time, filter and format data according to preset data rules, and generate user access records, network traffic information and system logs.

[0014] In some embodiments, the risk data includes at least one of abnormal traffic, abnormal behavior, user behavior deviation, and abnormal log; and the monitoring feedback module includes at least one of the following:

[0015] Traffic analysis tools are used to monitor and analyze network traffic information and obtain abnormal traffic;

[0016] Intrusion detection system, used to capture illegal access and malicious behavior based on user access records and obtain abnormal behavior;

[0017] A user and entity behavior analysis device, used to identify user behavior deviations based on user access records through user and entity behavior analysis technology;

[0018] Log management tool, used to track exceptions based on system logs and obtain exception logs.

[0019] In some embodiments, the data analysis module includes:

[0020] A model training device, used to train and adjust parameters of a preset neural network based on a training set labeled with risk assessment results to obtain a machine learning model;

[0021] The model running device is used to perform risk analysis on the key data transmitted by the data acquisition module according to the machine learning model to obtain risk assessment results.

[0022] In some embodiments, the model training device is specifically used to:

[0023] Based on the type of security threat to be identified, organize the corresponding type of data sets that have been annotated with risk assessment results, and divide the data sets into training sets, validation sets, and test sets;

[0024] Configure recurrent neural networks based on long short-term memory artificial neural networks or gated recurrent units;

[0025] Using the training set, the recursive neural network is iteratively trained using the cross entropy loss function and the root mean square loss function combined with the pre-configured optimizer, and the hyperparameters of the recursive neural network are adjusted according to the training results of each round of iterative training. Then, the performance of the recursive neural network after the hyperparameter adjustment is verified according to the validation set to obtain the model performance after each round of iterative training;

[0026] When the difference in model performance between two consecutive rounds of iterative training is less than the preset performance threshold, the recurrent neural network after the last round of hyperparameter adjustment is used as the target network;

[0027] According to the test set, the target network model is evaluated using the confusion matrix and preset evaluation indicators to obtain the test results; based on the test results, the model architecture or hyperparameters of the target network are adjusted within the preset adjustment range to obtain a machine learning model.

[0028] In some embodiments, the security policy adjustment module is specifically used to:

[0029] Determine the security threat level facing the cloud environment based on the risk assessment results;

[0030] Determine the corresponding security parameters based on the security threat level, and generate security policy adjustment information based on the security parameters; wherein the security parameters include firewall rule sets, intrusion detection system parameters and access control lists;

[0031] The security policy adjustment information is parameter-modified based on the security specification specified in the security policy configuration file included in the security policy tuning information to obtain a security adjustment policy.

[0032] In some embodiments, the system further comprises:

[0033] The basic data module is used to provide basic data services to the data security policy automatic adjustment system;

[0034] The auxiliary decision-making module is used to automatically adjust all data information in the system according to the security policy, and generate security policy auxiliary suggestions through preset policy analysis methods.

[0035] To achieve the above object, another aspect of an embodiment of the present invention provides a method for automatically adjusting a data security policy, comprising the following steps:

[0036] The data acquisition module continuously collects key data from the cloud environment based on the preset data acquisition device, and performs preprocessing operations on the key data; the key data after the preprocessing operation is transmitted to the data analysis module and the monitoring feedback module; the key data includes user access records, network traffic information and system logs;

[0037] The monitoring feedback module obtains risk data through a preset monitoring method based on the key data transmitted by the data acquisition module; and transmits the risk data to the data analysis module;

[0038] The data analysis module uses the pre-trained machine learning model to perform risk analysis based on the key data transmitted by the data acquisition module to obtain risk assessment results; the risk assessment results are transmitted to the security policy adjustment module; and the risk data transmitted by the monitoring feedback module is transmitted to the training data module;

[0039] Through the training data module, the machine learning model of the data analysis module is trained by scenario simulation according to the risk data, and then the network parameters of the machine learning model are adjusted according to the results of the scenario simulation training;

[0040] The policy database module organizes and outputs security policy tuning information based on the security policy configuration file obtained by the preset policy database device; and transmits the security policy tuning information to the security policy adjustment module;

[0041] Generate security policy adjustment information based on risk assessment results through the security policy adjustment module, and then generate a security adjustment policy in combination with the security policy tuning information; transmit the security adjustment policy to the target security component of the cloud environment;

[0042] The data information of the data acquisition module, the data analysis module, the security policy adjustment module, the monitoring feedback module, the training data module and the policy database module are modified and changed in response to the modification instruction through the user interface module; and the data information is visualized.

[0043] To achieve the above objective, another aspect of an embodiment of the present invention provides an electronic device, the electronic device comprising a memory and a processor, the memory storing a computer program, and the processor implementing the above method when executing the computer program.

[0044] To achieve the above objective, another aspect of an embodiment of the present invention provides a computer-readable storage medium, wherein the computer-readable storage medium stores a computer program, and when the computer program is executed by a processor, the above method is implemented.

[0045] The embodiments of the present invention include at least the following beneficial effects: the present invention provides a data security policy automatic adjustment system and method, which continuously collects key data from a cloud environment based on a preset data acquisition device through a data acquisition module, and performs preprocessing operations on the key data; transmits the key data after the preprocessing operation to a data analysis module and a monitoring feedback module; the key data includes user access records, network traffic information and system logs; the monitoring feedback module obtains risk data through a preset monitoring method based on the key data transmitted by the data acquisition module; the risk data is transmitted to the data analysis module; the data analysis module performs risk analysis through a pre-trained machine learning model based on the key data transmitted by the data acquisition module to obtain a risk assessment result; the risk assessment result is transmitted to the security policy adjustment module; the risk data transmitted by the monitoring feedback module is transmitted to the training data model block; the machine learning model of the data analysis module is trained by scenario simulation according to the risk data through the training data module, and then the network parameters of the machine learning model are adjusted according to the results of the scenario simulation training; the security policy configuration file obtained by the policy database module based on the preset policy database device is sorted and outputted; the security policy tuning information is transmitted to the security policy adjustment module; the security policy adjustment module generates security policy adjustment information based on the risk assessment results, and then generates a security adjustment policy in combination with the security policy tuning information; the security adjustment policy is transmitted to the target security component of the cloud environment; the data information of the data acquisition module, the data analysis module, the security policy adjustment module, the monitoring feedback module, the training data module and the policy database module are modified and changed in response to the modification instruction through the user interface module; and the data information is visualized. The embodiment of the present invention improves the data security management capability of the cloud service by real-time monitoring and automatic adjustment of the security policy, ensures the stable operation of the power system and the security of the data, and takes into account the compliance of regulations, so as to provide an efficient and automated data security solution for power enterprises. BRIEF DESCRIPTION OF THE DRAWINGS

[0046] Figure 1 is a schematic diagram of an architecture example of a data security policy automatic adjustment system provided by an embodiment of the present invention;

[0047] Figure 2is a schematic diagram of another architecture example of a data security policy automatic adjustment system provided by an embodiment of the present invention;

[0048] Figure 3 It is a schematic diagram of the hardware structure of an electronic device provided by an embodiment of the present invention. DETAILED DESCRIPTION

[0049] In order to make the purpose, technical solutions and advantages of the present invention more clearly understood, the present invention is further described in detail below in conjunction with the accompanying drawings and embodiments. It should be understood that the specific embodiments described herein are only used to explain the present invention and are not intended to limit the present invention. When the following description refers to the drawings, unless otherwise indicated, the same numbers in different drawings represent the same or similar elements. The embodiments described in the following exemplary embodiments do not represent all embodiments consistent with the embodiments of the present invention. They are only examples of devices and methods consistent with some aspects of the embodiments of the present invention as detailed in the attached claims.

[0050] It is understood that the terms "first", "second", etc. used in the present invention may be used herein to describe various concepts, but unless otherwise specified, these concepts are not limited by these terms. These terms are only used to distinguish one concept from another. For example, without departing from the scope of the embodiments of the present invention, the first information may also be referred to as the second information, and similarly, the second information may also be referred to as the first information. Depending on the context, the words "if" and "if" as used herein may be interpreted as "at the time of" or "when" or "in response to determining".

[0051] The terms "at least one", "multiple", "each", "any", etc. used in the present invention, at least one includes one, two or more, multiple includes two or more, each refers to each of the corresponding multiple, and any refers to any one of the multiple.

[0052] Unless otherwise defined, all technical and scientific terms used herein have the same meaning as those commonly understood by those skilled in the art to which the present invention belongs. The terms used herein are only for the purpose of describing the embodiments of the present invention and are not intended to limit the present invention.

[0053] In one aspect, an embodiment of the present invention provides a data security policy automatic adjustment system, which may include:

[0054] The data acquisition module is used to continuously collect key data from the cloud environment based on a preset data acquisition device, and perform preprocessing operations on the key data; transmit the key data after the preprocessing operation to the data analysis module and the monitoring feedback module; the key data includes user access records, network traffic information and system logs;

[0055] It should be noted that, in some embodiments, the data collection device includes a network sniffer and a log analysis tool deployed and integrated on a cloud platform in a cloud environment; the network sniffer and the log analysis tool are used to monitor and intercept the original network data packets and operation logs flowing through the nodes corresponding to the cloud platform in real time, filter and format the data through preset data rules, and generate user access records, network traffic information and system logs.

[0056] Exemplarily, in some specific implementations, the data acquisition module (DCM), as the perception layer of the system, collects key data such as user access records, network traffic information and system logs from the cloud environment in real time by connecting to the data acquisition device set up on site, and provides raw data input for the data analysis module (DAE), the security policy adjustment module (SPAM) and the monitoring feedback module (MFM).

[0057] The monitoring feedback module is used to obtain risk data through a preset monitoring method based on the key data transmitted by the data acquisition module; and transmit the risk data to the data analysis module;

[0058] It should be noted that, in some embodiments, risk data includes at least one of abnormal traffic, abnormal behavior, user behavior deviation and abnormal log; the monitoring feedback module includes at least one of the following: a traffic analysis tool, used to monitor and analyze network traffic information to obtain monitored abnormal traffic; an intrusion detection system, used to capture illegal access and malicious behavior based on user access records to obtain abnormal behavior; a user and entity behavior analysis device, used to identify user behavior deviations based on user access records through user and entity behavior analysis technology; a log management tool, used to track anomalies based on system logs to obtain abnormal logs.

[0059] Exemplarily, in some specific implementations, the monitoring feedback module uses a series of advanced monitoring tools and technologies to perform round-the-clock security monitoring of the cloud platform, and collects and analyzes key security performance indicators in real time. These indicators include response time, packet loss rate, DDoS attack detection, illegal access attempts, abnormal traffic patterns, user behavior deviations, system log anomalies, configuration changes, malware activities, and data leakage. Traffic analysis tools are used to monitor network traffic, and intrusion detection systems (IDS) are used to capture illegal access and malicious behavior. User and entity behavior analysis (UEBA) technology identifies deviations in user behavior, and log management tools track anomalies in system logs. Configuration changes and malware activities are also tracked in real time to quickly identify potential security threats. Data leakage monitoring is achieved by analyzing data transmission and access patterns. All of these monitoring activities are enhanced by automated scripts to ensure that alarms can be triggered immediately when any anomalies are detected, and these key information are fed back to the data analysis module in real time for in-depth analysis and appropriate security measures.

[0060] Specifically, the monitoring feedback module (MFM) is as follows: Real-time data collection and monitoring, MFM collects key data such as network traffic, user behavior, system logs, and security incident response time in real time. These data are captured by monitoring devices deployed at key nodes of the network and transmitted to the centralized system through secure encrypted channels. Performance indicator monitoring, the key performance indicators monitored by MFM include response time, packet loss rate, DDoS attack detection, illegal access attempts, abnormal traffic patterns, user behavior deviations, system log anomalies, configuration changes, malware activities, and data leakage. Preset performance baselines, the data analysis module (DAE) presets performance baselines, which define the expected behavior and performance indicators of the system under normal operating conditions. Comparative analysis, MFM compares the real-time collected data with the preset performance baseline to evaluate the effectiveness of the current security policy and system performance. Statistical methods and machine learning algorithms, such as anomaly detection models, are used to identify abnormal patterns in the data. Abnormal behavior generation, once abnormal behavior is found, MFM generates detailed monitoring feedback results. These results include the type, time, scope of impact, and possible causes of the abnormal behavior. Scenario simulation training: Feedback monitoring feedback results to the data analysis module (DAE) for scenario simulation training. Using historical security event data and real-time monitoring data, DAE performs self-optimization through machine learning models to improve the accuracy and efficiency of data analysis models. Security policy adjustment suggestions: MFM provides security policy adjustment suggestions to the security policy adjustment module (SPAM) based on feedback data and abnormal behavior analysis results. These suggestions may include adjusting firewall rules, updating intrusion detection system parameters, or modifying access control lists. Implementation steps: Configure NetFlow on network devices, set the appropriate version, and specify data flows to data collection devices. The data collection module pre-processes the data stream, including data cleaning, deduplication, formatting, and feature extraction. Use traffic analysis tools to monitor network traffic and capture illegal access and malicious behavior through intrusion detection systems. User and entity behavior analysis (UEBA) technology identifies deviations in user behavior, and log management tools track anomalies in system logs. Use anomaly detection algorithms to evaluate security performance indicators in real time and compare them with preset baselines to quickly identify potential abnormal behaviors or security threats. Once an anomaly is detected, detailed monitoring feedback results are generated, and instant notifications and alerts are sent to system administrators through the user interface module and mobile terminals. Monitoring feedback results and security policy adjustment suggestions are provided to the Security Policy Adjustment Module (SPAM), which automatically generates or updates security policies based on this information. The policy execution effect is monitored and feedback information is collected for continuous optimization of the policy.Through these refined and automated processes, the Monitoring Feedback Module (MFM) can not only achieve comprehensive monitoring and analysis of cloud environment security, but also adapt to rapidly changing security threats and regulatory requirements, providing enterprises with an efficient, intelligent and compliant cloud data security management solution.

[0061] The data analysis module is used to perform risk analysis based on the key data transmitted by the data acquisition module through a pre-trained machine learning model to obtain risk assessment results; transmit the risk assessment results to the security policy adjustment module; and transmit the risk data transmitted by the monitoring feedback module to the training data module;

[0062] It should be noted that, in some embodiments, the data analysis module includes: a model training device, which is used to train and adjust parameters of a preset neural network according to a training set that has been labeled with risk assessment results to obtain a machine learning model; and a model running device, which is used to perform risk analysis on key data transmitted by the data acquisition module according to the machine learning model to obtain risk assessment results.

[0063] In some embodiments, the model training device is specifically used for:

[0064] Based on the type of security threat to be identified, organize the corresponding type of data sets that have been annotated with risk assessment results, and divide the data sets into training sets, validation sets, and test sets;

[0065] Configure recurrent neural networks based on long short-term memory artificial neural networks or gated recurrent units;

[0066] Using the training set, the recursive neural network is iteratively trained using the cross entropy loss function and the root mean square loss function combined with the pre-configured optimizer, and the hyperparameters of the recursive neural network are adjusted according to the training results of each round of iterative training. Then, the performance of the recursive neural network after the hyperparameter adjustment is verified according to the validation set to obtain the model performance after each round of iterative training;

[0067] When the difference in model performance between two consecutive rounds of iterative training is less than the preset performance threshold, the recurrent neural network after the last round of hyperparameter adjustment is used as the target network;

[0068] According to the test set, the target network model is evaluated using the confusion matrix and preset evaluation indicators to obtain the test results; based on the test results, the model architecture or hyperparameters of the target network are adjusted within the preset adjustment range to obtain a machine learning model.

[0069] Exemplarily, in some specific implementations, the data analysis module (DAE) involves data processing steps such as data reception, data cleaning, and data preprocessing, and also includes machine learning models such as convolutional neural networks or recursive neural networks. It uses deep learning algorithms to mine potential security threats from complex network traffic and system logs, extracts and analyzes features, compares the discovered abnormal data with risk thresholds, generates security event alerts and risk assessment results, and transmits them to the security policy adjustment module (SPAM); at the same time, the behavior analysis model is used to learn user behavior patterns, and the new risk data identified in the monitoring feedback results transmitted back from the monitoring feedback module (MFM) is fed back to the training data storage module (TDR), and scenario simulation training is automatically performed to optimize and improve the data analysis model.

[0070] Specifically, the data analysis module uses advanced machine learning algorithms, such as convolutional neural networks (CNN) and recurrent neural networks (RNN), to conduct in-depth analysis of the processed data and identify potential security threats and abnormal behavior patterns. The specific steps are as follows:

[0071] 1. Problem definition and data collection: Determine the types of security threats that the model needs to identify, such as phishing attacks, intrusion attempts, or data leaks. Collect labeled data, including normal traffic and various types of abnormal traffic data.

[0072] 2. Data preprocessing: Clean the data and remove records with incorrect formats or incomplete records. Perform normalization, such as converting the traffic size to kilobytes per second (KB / s). Feature engineering, such as extracting features such as timestamps, source and destination IP addresses, and protocol types from the original logs.

[0073] 3. Model architecture selection: For user behavior sequences, design an RNN model containing LSTM (Long Short-Term Memory Artificial Neural Network) or GRU (Gated Recurrent Unit) to handle time dependencies.

[0074] 4. Training / validation / test set division: The dataset is divided into training set (70%), validation set (15%) and test set (15%).

[0075] 5. Loss function and optimizer configuration: For classification problems, use the cross entropy loss function; for regression problems, use the mean square error loss function. Select the Adam optimizer and set the initial learning rate, for example, 0.001.

[0076] 6. Model training: Use the training set data to train the model, record the loss value and accuracy. Implement the early stopping method, that is, stop training when the performance on the validation set no longer improves to avoid overfitting.

[0077] 7 Hyperparameter Tuning: Test different learning rates, batch sizes, number of convolution kernels, and number of hidden layer neurons on the validation set.

[0078] 8. Regularization and optimization: Apply dropout regularization in CNN, such as adding a dropout layer after the fully connected layer, with a ratio of 0.5. Use L2 regularization for RNN, and set the regularization coefficient, such as 0.01.

[0079] 9. Model evaluation: Evaluate the model performance on the test set, using metrics such as confusion matrix, ROC curve, and AUC value.

[0080] 10. Model fine-tuning: Based on the test results, fine-tune the model architecture or hyperparameters, such as increasing the depth of the convolutional layer or adjusting the number of LSTM units.

[0081] 11. Model deployment: Deploy the trained model to the production environment and integrate it into the data analysis process for real-time threat detection.

[0082] 12. Continuous monitoring and model updates: Monitor the performance of the model in actual operation, collect new data, and regularly retrain the model to adapt to emerging threat patterns.

[0083] Through these specific steps, the data analysis module is able to train a machine learning model that can accurately identify potential security threats in the cloud environment and maintain its efficient threat detection capabilities through continuous monitoring and updates.

[0084] The training data module is used to perform scenario simulation training on the machine learning model of the data analysis module according to the risk data, and then adjust the network parameters of the machine learning model according to the results of the scenario simulation training;

[0085] A policy database module is used to organize and output security policy tuning information based on the security policy configuration file obtained by the preset policy database device; and transmit the security policy tuning information to the security policy adjustment module;

[0086] For example, in some specific implementations, the policy database module (PDB) obtains information such as security-related laws and regulations through external connections and refreshes the security policy configuration file in real time. Specifically, the policy database module synchronizes the latest security-related laws, regulations and policy documents in real time, and provides compliance support and policy tuning suggestions for the security policy adjustment module through intelligent association and analysis.

[0087] A security policy adjustment module is used to generate security policy adjustment information based on risk assessment results, and then generate a security adjustment policy in combination with the security policy tuning information; and transmit the security adjustment policy to a target security component of the cloud environment;

[0088] It should be noted that, in some embodiments, the security policy adjustment module is specifically used to:

[0089] Determine the security threat level facing the cloud environment based on the risk assessment results;

[0090] Determine the corresponding security parameters based on the security threat level, and generate security policy adjustment information based on the security parameters; wherein the security parameters include firewall rule sets, intrusion detection system parameters and access control lists;

[0091] The security policy adjustment information is parameter-modified based on the security specification specified in the security policy configuration file included in the security policy tuning information to obtain a security adjustment policy.

[0092] For example, in some specific implementations, the training data module (TDR) is used to optimize and improve the data analysis model through scenario simulation training based on historical security data information, and the policy database module (PDB) is used to perform compliance checks and disaster recovery drills for national security-related laws and regulations through externally connected policy database devices to provide security policy tuning suggestions. These two key components of high availability and scalability support the storage and rapid retrieval of large-scale data, optimize machine learning models by regularly collecting and classifying and marking data in the cloud environment; record security policy history, compliance operation logs, and detailed logs of disaster recovery operations, and use redundant storage and failover technology to ensure data reliability; also provide powerful data retrieval capabilities to accelerate troubleshooting and security analysis, ensure the efficiency and reliability of the entire system in data-driven security operations, and integrate with existing IT management tools and cloud service platforms through APIs to automatically handle security management tasks, and are easy to expand to meet the needs of cloud services of different scales.

[0093] Specifically, the security policy adjustment module dynamically adjusts security policies based on the insights provided by the data analysis module, such as updating the firewall rule set (FRS), intrusion detection system parameters (IPSP), and access control list (ACL) in real time to cope with ever-changing security threats.

[0094] The user interface module is used to modify the data information of the data acquisition module, the data analysis module, the security policy adjustment module, the monitoring feedback module, the training data module and the policy database module in response to the modification instruction; and to visualize the data information.

[0095] Exemplarily, in some specific implementations, a user interface module (UI) is connected to a mobile terminal to provide an interactive interface for system administrators to display the system's security posture, compliance information, and a workflow for approving or modifying security policy changes.

[0096] Specifically, the user interface module dynamically displays the security situation map of the cloud environment through a high-resolution display screen, including key information such as security event distribution, risk assessment and trend prediction, to provide decision support for administrators.

[0097] Among them, in some embodiments, a security policy automatic adjustment system based on the same inventive concept includes one or more computer devices and one or more mobile terminals connected to the computer devices, the computer devices are connected to an on-site policy database device, and a data security policy automatic adjustment system is required to be deployed in the computer devices.

[0098] In some specific application scenarios, the system may also include:

[0099] The basic data module is used to provide basic data services to the data security policy automatic adjustment system;

[0100] The auxiliary decision-making module is used to automatically adjust all data information in the system according to the security policy, and generate security policy auxiliary suggestions through preset policy analysis methods.

[0101] Exemplarily, in some specific implementations, the basic data management module is used to provide basic data services to the data security policy automatic adjustment device; the auxiliary decision management module is used to obtain all data and generate a security adjustment policy for the system.

[0102] On the other hand, an embodiment of the present invention provides a method for automatically adjusting a data security policy, which may include but is not limited to steps S100 to S700.

[0103] S100, continuously collecting key data from the cloud environment through the data collection module based on the preset data collection device, and performing preprocessing operations on the key data; transmitting the key data after the preprocessing operation to the data analysis module and the monitoring feedback module; the key data includes user access records, network traffic information and system logs;

[0104] S200, obtaining risk data through a preset monitoring method according to the key data transmitted by the data acquisition module through the monitoring feedback module; and transmitting the risk data to the data analysis module;

[0105] S300, the data analysis module performs risk analysis based on the key data transmitted by the data acquisition module through the pre-trained machine learning model to obtain a risk assessment result; the risk assessment result is transmitted to the security policy adjustment module; and the risk data transmitted by the monitoring feedback module is transmitted to the training data module;

[0106] S400, performing scenario simulation training on the machine learning model of the data analysis module according to the risk data through the training data module, and then adjusting the network parameters of the machine learning model according to the results of the scenario simulation training;

[0107] S500, arranging and outputting security policy tuning information based on the security policy configuration file obtained by the policy database module based on the preset policy database device; transmitting the security policy tuning information to the security policy adjustment module;

[0108] S600, generating security policy adjustment information based on the risk assessment result through the security policy adjustment module, and then generating a security adjustment policy in combination with the security policy tuning information; transmitting the security adjustment policy to the target security component of the cloud environment;

[0109] S700, modifying and changing the data information of the data acquisition module, the data analysis module, the security policy adjustment module, the monitoring feedback module, the training data module and the policy database module in response to the modification instruction through the user interface module; and visualizing the data information.

[0110] The data security policy automatic adjustment method provided by the embodiment of the present invention relates to the field of data processing technology. The data security policy automatic adjustment method provided by the embodiment of the present invention can be applied to a terminal, can also be applied to a server, and can also be software running in a terminal or a server. In some embodiments, the terminal can be a smart phone, a tablet computer, a laptop computer, a desktop computer, a smart speaker, a smart watch, and a car terminal, etc., but is not limited to this; the server side can be configured as an independent physical server, or it can be configured as a server cluster or a distributed system composed of multiple physical servers, and can also be configured as a cloud server that provides basic cloud computing services such as cloud services, cloud databases, cloud computing, cloud functions, cloud storage, network services, cloud communications, middleware services, domain name services, security services, CDN, and big data and artificial intelligence platforms. The server can also be a node server in a blockchain network; the software can be an application that implements the data security policy automatic adjustment method, etc., but is not limited to the above forms.

[0111] The present invention can be used in many general or special computer system environments or configurations. For example: personal computers, server computers, handheld or portable devices, tablet devices, multiprocessor systems, microprocessor-based systems, set-top boxes, programmable consumer electronic devices, network PCs, minicomputers, mainframe computers, distributed computing environments including any of the above systems or devices, etc. The present invention can be described in the general context of computer-executable instructions executed by a computer, such as program modules. Generally, program modules include routines, programs, objects, components, data structures, etc. that perform specific tasks or implement specific abstract data types. The present invention can also be practiced in distributed computing environments, in which tasks are performed by remote processing devices connected through a communication network. In a distributed computing environment, program modules can be located in local and remote computer storage media including storage devices.

[0112] Exemplarily, in some specific embodiments, the present invention also provides a method for automatic adjustment of data security policies based on artificial intelligence, including using a data acquisition module to collect key data, a data analysis module to generate security event alarms and risk assessment results, a security policy adjustment module to formulate or update security parameters, a monitoring feedback module to generate monitoring feedback results, a training data module to optimize the data analysis model, and a policy database module to refresh the security policy configuration file in real time.

[0113] In one of the embodiments, the present invention provides an artificial intelligence-based data security policy automatic adjustment system in a cloud environment, which can monitor and analyze key data such as network traffic, user behavior, and system logs in real time, and automatically adjust security policies to respond to potential security threats.

[0114] In one embodiment, the method further comprises the following steps:

[0115] a. The data collection module (DCM) obtains key data such as user access records, network traffic information and system logs by connecting to the data collection device set up on site;

[0116] b. The data analysis module (DAE) uses machine learning models such as convolutional neural networks or recurrent neural networks to mine potential security threats from complex network traffic and system logs;

[0117] c. The Security Policy Adjustment Module (SPAM) determines the security threat level facing the current cloud environment and automatically generates or updates security policies;

[0118] d. The Monitoring Feedback Module (MFM) collects real-time data related to cloud environment security and evaluates the effectiveness of current security policies and system performance;

[0119] e. The user interface module (UI) allows administrators to access historical security events and log information, adjust system settings, and respond to security alerts.

[0120] In one embodiment, the system further includes a basic data management module and an auxiliary decision management module connected to the security policy automatic adjustment device, wherein:

[0121] f. The basic data management module provides basic data services to the data security policy automatic adjustment device;

[0122] g. The auxiliary decision management module obtains data from all modules and generates security adjustment strategies for the system.

[0123] In order to explain the principle of the technical solution of the present invention in detail, the system architecture of the present invention and the overall process of its implementation are described below in combination with some specific embodiments. It is easy to understand that the following is an explanation of the technical principle of the present invention and cannot be regarded as a limitation of the present invention.

[0124] (I) Detailed explanation of system layout and composition:

[0125] like Figure 1 As shown, in the core area of ​​the cloud platform, a dedicated computer room is configured to deploy the core components of the cloud environment data security policy automatic adjustment system. The internal layout of the computer room is as follows:

[0126] 1. Data collection device 10: deployed at key nodes of the cloud network, responsible for capturing raw data such as network traffic, user behavior and system logs in real time, and transmitting them to the data processing center through a high-speed network interface.

[0127] 2. Data acquisition module 20: As the data input layer of the system, it receives data from the data acquisition device 10, performs preliminary cleaning, verification and formatting to ensure the quality and consistency of the data and provide standardized input for subsequent analysis.

[0128] 3. Management and control system servers 1 and 2: Install system server software to carry key functions such as business logic processing, data storage, and communication with data acquisition module 20 and other modules. Hot standby is achieved between servers through high-availability cluster technology to ensure the stability and reliability of the system.

[0129] Implementing high-availability cluster technology in a cloud environment usually involves a series of complex components and strategies to ensure the continuous operation of the system and the consistency of data. By using hardware or software load balancers, such as Nginx or HAProxy, network traffic is intelligently distributed to reduce the load on a single server and improve response speed. At the same time, a heartbeat detection mechanism, such as Keepalived, is used to monitor the server status in real time. Once a failure is detected, failover is automatically performed to switch the service to the backup server to minimize service interruption. In terms of data synchronization, the cluster may use a shared storage solution or a distributed file system, such as GlusterFS or Ceph, to ensure that data on all servers remains consistent. In addition, communication between servers is usually achieved through high-speed network technologies, such as InfiniBand or 10GbE, and dedicated cluster communication protocols, such as Corosync or DRBD, to achieve fast and reliable data exchange. Fault detection is usually the responsibility of monitoring systems such as Nagios or Zabbix, which can monitor the key performance indicators of the server in real time and issue alarms when the indicators exceed the preset thresholds. To shorten the recovery time, automated scripts and tools such as Ansible or Puppet are used to quickly restore services, while regular disaster recovery drills ensure rapid response capabilities when real failures occur. The redundant design of the cluster includes backups of key components such as network switches, power supplies, and storage systems, as well as the configuration of active-active data centers to achieve seamless service switching when the primary data center fails. Cluster management software, such as Red Hat Cluster Suite or Oracle Clusterware, provides graphical interfaces and command-line tools for cluster configuration, monitoring, and management. The implementation of security measures, such as encrypted communication between nodes and regular security updates, ensures the data security of the cluster. The formulation of log management and audit strategies, through the use of tools such as ELK Stack, centrally collects and manages logs to record key operations and changes for easy problem tracking and analysis. Performance optimization strategies, such as using Redis or Memcached as a cache layer, reduce direct access to the backend database and improve the overall performance of the system. Finally, a detailed disaster recovery plan, including data backup, system mirroring, and rapid recovery strategies, as well as regular testing, ensures that business can be quickly restored in the face of unforeseen disasters.

[0130] Deployment in the control center:

[0131] 1. User Interface Module 80 Computer Workstation: Equipped with a high-performance graphics workstation, installed with client software, providing an intuitive user interface that enables administrators to perform complex interactive operations, monitor security status in real time, view early warning information, and make policy adjustments.

[0132] 2. Mobile Terminal 90: Equip administrators with customized mobile terminals with mobile terminal APP software installed to support remote access to the system, enabling mobile approval of security policies and emergency response.

[0133] Each department office 1…N configures the corresponding user interface module 80 and mobile terminal 90 according to business needs to achieve customized security policy management, including personalized customization of security policies, allowing department administrators to define and implement security rules according to business characteristics; detailed permission management to ensure that only authorized users can access sensitive data; customized interface layout, allowing users to adjust the interface according to workflow and preferences. The personalized dashboard displays key performance indicators and real-time data, and the mobile terminal supports push notifications to ensure that administrators can respond to security incidents in a timely manner even remotely. The system also records the change history of all security policies, provides easy-to-use audit log viewing functions, and supports multi-factor authentication to enhance security. The user interface and mobile terminal are designed to work across platforms, ensuring real-time synchronization of data, and built-in interactive help and documentation to support users to quickly learn and use. Customized reporting and analysis functions support decision-making, and emergency response and disaster recovery processes ensure rapid and consistent responses in the face of security threats. These customized functions not only improve the flexibility and convenience of operations, but also strengthen communication and collaboration across departments, and improve the security policy management and coordination efficiency of the entire organization.

[0134] Key node settings:

[0135] 1. Data center area: Deploy core data processing modules, including data collection module 20, monitoring feedback module 30, data analysis module 40, etc., which constitute the brain of cloud environment security protection. Monitoring feedback module 30 is a real-time monitoring component in the cloud environment security protection system. It captures key data such as network traffic, user behavior and system logs through devices deployed at key nodes of the network. Using advanced anomaly detection algorithms, it evaluates security performance indicators in real time and compares them with preset baselines to quickly identify potential abnormal behaviors or security threats. Once an anomaly is detected, it immediately generates detailed monitoring feedback results and sends instant notifications and alerts to system administrators through user interface module 80 and mobile terminal 90 to ensure that response measures can be taken quickly. Data analysis module 40 is responsible for in-depth analysis of the data provided by monitoring feedback module 30, using machine learning models such as CNN and RNN to mine potential security threats and abnormal behavior patterns from large amounts of data. Through data preprocessing, feature extraction and risk assessment, a detailed security report is generated to clearly indicate the nature, scope of impact and possible sources of the threat. The module can also provide customized security recommendations and policy optimization solutions based on the analysis results to help system administrators improve the security and stability of the cloud environment. Through this data-driven analysis method, the data analysis module 40 provides powerful decision support for the security management of the cloud environment.

[0136] 2. Network edge nodes: deploy auxiliary monitoring and data collection devices to enhance the comprehensiveness and real-time nature of data and improve the breadth and depth of security monitoring. Usually deployed at the periphery of the network, close to users and Internet connection points, to enhance the comprehensiveness and real-time nature of data, thereby improving the breadth and depth of the entire network security monitoring. Network edge nodes may deploy a variety of monitoring and data collection devices, including but not limited to intrusion detection systems / intrusion prevention systems (IDS / IPS), traffic analyzers, network sniffers, firewalls, etc. The main functions are: traffic monitoring, monitoring network traffic, analyzing traffic patterns, and ensuring that there is no abnormal traffic or potential denial of service attacks (DDoS). Threat detection, using signature libraries and anomaly detection technology to identify and warn potential network attacks and malicious behaviors in real time. Packet capture, capturing data packets passing through the network, providing raw data for in-depth analysis and post-investigation. Access control: Implement access control policies to ensure that only authorized traffic and users can enter the internal network. Network edge nodes are usually located at the entry and exit points of the cloud environment and are the first contact point for internal and external network traffic. They can promptly detect and prevent external threats from entering the internal network. They are responsible for monitoring outbound traffic to identify possible data leaks or internal threats. They work in conjunction with components such as the monitoring feedback module 30 and the data analysis module 40 of the core data center to achieve rapid response and effective defense against security threats.

[0137] (II) Data collection and monitoring feedback process:

[0138] Step S1: The data acquisition device 10 configures NetFlow on the network device, sets the appropriate version and specifies the data flow direction. The data acquisition device 10 captures the header information of the data packets passing through the network device in real time according to the rules defined by the security policy, including the source and destination IP addresses, port numbers and protocol types. This information is transmitted to the centralized system through a secure encrypted channel to ensure the security and integrity of the data during transmission. The data acquisition device 10 also verifies the accuracy of the data through the serial number and timestamp, and balances the representativeness of the data and system performance by setting the sampling rate. The captured NetFlow data is used for in-depth analysis to identify abnormal patterns or potential threats in network traffic, providing a real-time and accurate data basis for the data security policy automatic adjustment system of the cloud environment.

[0139] Step S2: The data acquisition module 20 performs a series of sophisticated preprocessing operations on the data stream received by the data acquisition device 10. It removes invalid or erroneous data points, such as information that does not meet the protocol standard, through a data cleaning algorithm, and corrects outliers caused by equipment failure or configuration errors. The deduplication algorithm ensures the uniqueness of each record and avoids duplicates in the data set. The data formatting step converts the information into a unified format, standardizes the timestamp and IP address representation, and makes the data consistent, which is convenient for processing by analysis tools. Feature extraction technology identifies key features from the raw data, such as traffic size and connection frequency, which are crucial for subsequent security analysis. Data normalization and transformation technology further optimizes the data to eliminate deviations and identify periodic patterns. Data reduction technology reduces the size of the data set while retaining important information and improving processing efficiency. If the data comes from multiple sources, the data acquisition module 20 will perform data integration to ensure the consistency and integrity of the data. These preprocessing steps not only improve the quality of data analysis and enhance processing efficiency, but also optimize the performance of the machine learning model, providing the data analysis module 40 with accurate, consistent and suitable data for in-depth analysis.

[0140] Step S3: The monitoring feedback module 30 uses a series of advanced monitoring tools and technologies to monitor the cloud platform around the clock, and collects and analyzes key security performance indicators in real time. These indicators include response time, packet loss rate, DDoS attack detection, illegal access attempts, abnormal traffic patterns, user behavior deviations, system log anomalies, configuration changes, malware activities, and data leakage. Traffic analysis tools are used to monitor network traffic, intrusion detection systems (IDS) are used to capture illegal access and malicious behavior, user and entity behavior analysis (UEBA) technology identifies deviations in user behavior, and log management tools track anomalies in system logs. Configuration changes and malware activities are also tracked in real time to quickly identify potential security threats. Data leakage monitoring is achieved by analyzing data transmission and access patterns. All of these monitoring activities are enhanced by automated scripts to ensure that alarms can be triggered immediately when any anomalies are detected, and these key information are fed back to the data analysis module 40 in real time for in-depth analysis and appropriate security measures.

[0141] (III) Data analysis and security strategy adjustment process:

[0142] Step S4: The data analysis module 40 uses advanced machine learning algorithms, such as convolutional neural networks (CNN) and recurrent neural networks (RNN), to conduct in-depth analysis of the processed data to identify potential security threats and abnormal behavior patterns. The specific steps are as follows:

[0143] S401. Problem definition and data collection: Determine the types of security threats that the model needs to identify, such as phishing attacks, intrusion attempts, or data leaks. Collect labeled data, including normal traffic and various types of abnormal traffic data.

[0144] S402. Data preprocessing: Clean the data and remove records with incorrect formats or incomplete records. Perform normalization, such as converting the traffic size to kilobytes per second (KB / s). Feature engineering, such as extracting features such as timestamps, source and destination IP addresses, and protocol types from the original logs.

[0145] S403. Model architecture selection: For user behavior sequences, design an RNN model containing LSTM (Long Short-Term Memory Artificial Neural Network) or GRU (Gated Recurrent Unit) to handle time dependency.

[0146] S404. Training / validation / test set division: Divide the dataset into a training set (70%), a validation set (15%), and a test set (15%).

[0147] S405. Loss function and optimizer configuration: For classification problems, use the cross entropy loss function; for regression problems, use the mean square error loss function. Select the Adam optimizer and set the initial learning rate, for example, 0.001.

[0148] S406. Model training: Use the training set data to train the model, record the loss value and accuracy. Implement the early stopping method, that is, stop training when the performance on the validation set no longer improves to avoid overfitting.

[0149] S407 Hyperparameter Tuning: Test different learning rates, batch sizes, number of convolution kernels, and number of hidden layer neurons on the validation set.

[0150] S408. Regularization and optimization: Apply dropout regularization in CNN, such as adding a dropout layer after the fully connected layer, with a ratio of 0.5. Use L2 regularization for RNN, and set the regularization coefficient, such as 0.01.

[0151] S409. Model evaluation: Evaluate model performance on the test set, using metrics such as confusion matrix, ROC curve, and AUC value.

[0152] S410. Model fine-tuning: Based on the test results, fine-tune the model architecture or hyperparameters, such as increasing the depth of the convolutional layer or adjusting the number of LSTM units.

[0153] S411. Model deployment: Deploy the trained model to the production environment and integrate it into the data analysis process for real-time threat detection.

[0154] S412. Continuous monitoring and model updating: Monitor the performance of the model in actual operation, collect new data, and regularly retrain the model to adapt to emerging threat patterns.

[0155] Through these specific steps, the data analysis module 40 is able to train a machine learning model that can accurately identify potential security threats in the cloud environment, and maintain its efficient threat detection capabilities through continuous monitoring and updating.

[0156] Step S5: The security policy adjustment module 60 dynamically adjusts the security policy based on the insights provided by the data analysis module 40, such as updating the firewall rule set (FRS), intrusion detection system parameters (IPSP) and access control list (ACL) in real time to cope with the ever-changing security threats.

[0157] (IV) Training and strategy optimization process:

[0158] Step S6: The training data module 50 uses historical security event data to continuously train and optimize the data analysis module 40 to improve its ability and accuracy in identifying emerging threats.

[0159] Step S7: The policy database module 70 synchronizes the latest security-related laws, regulations and policy documents in real time, and provides compliance support and policy tuning suggestions for the security policy adjustment module 60 through intelligent association and analysis.

[0160] (V) User interface display and mobile terminal linkage process:

[0161] Step S8: The user interface module 80 dynamically displays the security situation map of the cloud environment through a high-resolution display screen, including key information such as security event distribution, risk assessment and trend prediction, to provide decision support for administrators.

[0162] Step S9: The administrator uses the mobile terminal 90 to seamlessly connect to the user interface module 80 using a secure wireless network connection, and receives push notifications of security policy adjustments through a dedicated application. After logging in through a strong authentication mechanism, the administrator can view a real-time updated security situation map, which contains key information such as security event distribution, risk assessment, and trend forecasting. In an emergency, the mobile terminal 90 supports push notifications to ensure that the administrator can respond in a timely manner, such as remotely isolating infected areas or updating firewall rules. In addition, the administrator can also access audit logs to track security policy changes and user activities, as well as remotely configure security settings, submit feedback, or generate security incident reports. This allows administrators to maintain real-time monitoring and control of cloud environment security no matter where they are, improving response speed and processing efficiency.

[0163] (VI) Decision-making support and basic data service process:

[0164] Among them, some specific application scenarios, such as Figure 2 As shown, the system may further include a basic data module 100 and an auxiliary decision module 110. The basic data management module 100 is used to provide basic data services to the data security policy automatic adjustment device; the auxiliary decision management module 110 is used to obtain all data and generate a security adjustment policy for the system.

[0165] Step S10: The basic data module 100 serves as the data support layer of the system and provides comprehensive basic data services, including device status, user behavior patterns, security event records, etc., providing a solid data foundation for data analysis and decision-making.

[0166] Step S11: The decision-making support module 110 plays a vital role. It provides administrators with accurate security policy adjustment suggestions by comprehensively analyzing data from different modules in the cloud environment and applying advanced analysis methods such as decision trees and random forests. The module first integrates and cleans the data collected from the data acquisition module 20, the monitoring feedback module 30, and the data analysis module 40, and then extracts key features through feature engineering to prepare for model training. Next, the data is divided into training sets and test sets, and the decision-making support module 110 uses these data to train decision trees and random forest models, which can identify patterns in the data and predict potential security threats. Decision trees recursively classify data through a series of logical judgments and finally make decisions on leaf nodes, while random forests improve overall accuracy and robustness by building multiple decision trees and combining their prediction results. After the model training is completed, the decision-making support module 110 evaluates the model performance to ensure that it can effectively identify security threats and abnormal behaviors. Based on the output of the model, the module generates a series of security policy adjustment suggestions, such as adjusting network monitoring thresholds, updating access control rules, or modifying the parameters of the intrusion detection system. These suggestions are evaluated by the risk assessment algorithm to determine their potential impact on the overall security situation. Before implementation, the effects of the proposed security policy adjustments are evaluated through simulation technology to ensure that there will be no negative impact on the existing system. The administrator will then receive these suggestions and conduct manual review and necessary adjustments based on his or her own experience and current security situation. After the review is passed, the suggestions are converted into specific security policies and implemented in the cloud environment through the automation system or user interface module 80. After implementation, the auxiliary decision module 110 continues to monitor the effects of policy adjustments and uses the feedback information loop for further optimization of the model, forming a closed loop of continuous improvement. In this way, the auxiliary decision module 110 not only improves the scientificity and accuracy of security policy adjustments, but also improves the administrator's responsiveness and decision-making efficiency to complex security environments.

[0167] (VII) Abnormal handling and emergency response process:

[0168] Step S12: Once the monitoring feedback module 30 detects abnormal behavior or security events, the system will automatically trigger the emergency plan generation process, first quickly assessing the nature and severity of the current threat through intelligent analysis. The specific content of the emergency plan covers a number of strategies, including immediate isolation measures to isolate the infected system from the network to prevent the spread of threats; at the same time, the notification mechanism is activated to quickly notify administrators and relevant personnel through multiple channels. The plan also includes quickly formulated response strategies, such as adjusting monitoring settings, changing access rights, updating firewall rules, etc. These measures can be automatically executed to reduce reliance on manual intervention. In addition, the plan also involves coordinating incident response teams, ensuring legal compliance, protecting critical data, backup and recovery plans, and communication strategies with stakeholders. After execution, the system will record all activities, conduct subsequent evaluations, and continuously improve the plan based on feedback. Through this series of closely coordinated measures, organizations can ensure that they can respond quickly and effectively when faced with security threats and reduce potential damage.

[0169] Step S13: the security policy adjustment module 60 quickly adjusts the security policy according to the emergency plan, such as enabling a backup firewall rule set and isolating the infected network area to curb the spread of the threat.

[0170] Step S14: The user interface module 80 and the mobile terminal 90 display emergency response information in real time, provide clear operation guides and steps, and guide administrators and operators to take corresponding measures to minimize the impact of security incidents.

[0171] In summary, the present invention proposes a data security policy automatic adjustment system in a cloud environment, which is composed of a data acquisition module (DCM), a data analysis module (DAE), a security policy adjustment module (SPAM), a monitoring feedback module (MFM) and a training data module (TDR). DCM collects key data such as user access records, network traffic and system logs. DAE analyzes these data and generates security event alerts and risk assessments in combination with the risk knowledge base. SPAM formulates or updates security parameters based on the evaluation results, generates and pushes new security policies to the cloud environment. MFM monitors network traffic and user behavior, compares them with preset baselines, and provides feedback when anomalies are found. TDR uses historical data for scenario simulation training, optimizes data analysis models, and improves system security performance. Through the above series of refined and automated processes, the data security policy automatic adjustment system for the cloud environment can not only realize comprehensive monitoring, analysis, adjustment and optimization of cloud environment security, but also adapt to rapidly changing security threats and regulatory requirements, providing enterprises with an efficient, intelligent and compliant cloud data security management solution.

[0172] The embodiment of the present invention further provides an electronic device, the electronic device includes a memory and a processor, the memory stores a computer program, and the processor implements the above-mentioned data security policy automatic adjustment method when executing the computer program. The electronic device can be any intelligent terminal including a tablet computer, a car computer, etc.

[0173] It can be understood that the contents of the above method embodiments are all applicable to the present device embodiments, the functions specifically implemented by the present device embodiments are the same as those of the above method embodiments, and the beneficial effects achieved are also the same as those achieved by the above method embodiments.

[0174] See also Figure 3 , Figure 3 The hardware structure of an electronic device 1000 of another embodiment is illustrated. The electronic device includes:

[0175] The processor 1001 may be implemented by a general-purpose CPU (Central Processing Unit), a microprocessor, an application-specific integrated circuit (Application Specific Integrated Circuit, ASIC), or one or more integrated circuits, and is used to execute relevant programs to implement the technical solutions provided in the embodiments of the present invention;

[0176] The memory 1002 can be implemented in the form of a read-only memory (ROM), a static storage device, a dynamic storage device, or a random access memory (RAM). The memory 1002 can store an operating system and other application programs. When the technical solution provided in the embodiment of this specification is implemented by software or firmware, the relevant program code is stored in the memory 1002, and the processor 1001 calls and executes the data security policy automatic adjustment method of the embodiment of the present invention;

[0177] Input / output interface 1003, used to implement information input and output;

[0178] The communication interface 1004 is used to realize the communication interaction between the device and other devices. The communication can be realized through a wired manner (such as USB, network cable, etc.) or a wireless manner (such as mobile network, WIFI, Bluetooth, etc.);

[0179] A bus 1005 , which transmits information between various components of the device (e.g., the processor 1001 , the memory 1002 , the input / output interface 1003 , and the communication interface 1004 );

[0180] The processor 1001 , the memory 1002 , the input / output interface 1003 and the communication interface 1004 are connected to each other in communication within the device via the bus 1005 .

[0181] An embodiment of the present invention further provides a computer-readable storage medium, which stores a computer program. When the computer program is executed by a processor, the above-mentioned data security policy automatic adjustment method is implemented.

[0182] It can be understood that the contents of the above method embodiments are all applicable to the present storage medium embodiments, the functions specifically implemented by the present storage medium embodiments are the same as those of the above method embodiments, and the beneficial effects achieved are also the same as those achieved by the above method embodiments.

[0183] The memory, as a non-transient computer-readable storage medium, can be used to store non-transient software programs and non-transient computer executable programs. In addition, the memory may include a high-speed random access memory, and may also include a non-transient memory, such as at least one disk storage device, a flash memory device, or other non-transient solid-state storage device. In some embodiments, the memory may optionally include a memory remotely disposed relative to the processor, and these remote memories may be connected to the processor via a network. Examples of the above-mentioned network include, but are not limited to, the Internet, an intranet, a local area network, a mobile communication network, and combinations thereof.

[0184] The embodiments described in the embodiments of the present invention are intended to more clearly illustrate the technical solutions of the embodiments of the present invention, and do not constitute a limitation on the technical solutions provided by the embodiments of the present invention. Those skilled in the art can appreciate that with the evolution of technology and the emergence of new application scenarios, the technical solutions provided by the embodiments of the present invention are also applicable to similar technical problems.

[0185] Those skilled in the art will appreciate that the technical solutions shown in the figures do not limit the embodiments of the present invention and may include more or fewer steps than shown in the figures, or a combination of certain steps, or different steps.

[0186] The device embodiments described above are merely illustrative, and the units described as separate components may or may not be physically separated, that is, they may be located in one place, or they may be distributed on multiple network units. Some or all of the modules may be selected according to actual needs to achieve the purpose of the solution of this embodiment.

[0187] Those skilled in the art will appreciate that all or some of the steps, devices, and functional modules / units in the above disclosed methods may be implemented as software, firmware, hardware, or a suitable combination thereof.

[0188] The terms "first", "second", "third", "fourth", etc. (if any) in the description of the present invention and the above-mentioned drawings are used to distinguish similar objects, and are not necessarily used to describe a specific order or sequence. It should be understood that the data used in this way can be interchanged where appropriate, so that the embodiments of the present invention described herein can be implemented in an order other than those illustrated or described herein. In addition, the terms "including" and "having" and any variations thereof are intended to cover non-exclusive inclusions, for example, a process, method, device, product or equipment that includes a series of steps or units is not necessarily limited to those steps or units that are clearly listed, but may include other steps or units that are not clearly listed or inherent to these processes, methods, products or equipment.

[0189] It should be understood that in the present invention, "at least one (item)" refers to one or more, and "plurality" refers to two or more. "And / or" is used to describe the association relationship of associated objects, indicating that three relationships may exist. For example, "A and / or B" can represent: only A exists, only B exists, and A and B exist at the same time, where A and B can be singular or plural. The character " / " generally indicates that the previous and next associated objects are in an "or" relationship. "At least one of the following items" or similar expressions refers to any combination of these items, including any combination of single items or plural items. For example, at least one of a, b or c can represent: a, b, c, "a and b", "a and c", "b and c", or "a and b and c", where a, b, c can be single or multiple.

[0190] In the several embodiments provided by the present invention, it should be understood that the disclosed devices and methods can be implemented in other ways. For example, the device embodiments described above are only schematic. For example, the division of the above units is only a logical function division. There may be other division methods in actual implementation, such as multiple units or components can be combined or integrated into another device, or some features can be ignored or not executed. Another point is that the mutual coupling or direct coupling or communication connection shown or discussed can be through some interfaces, indirect coupling or communication connection of devices or units, which can be electrical, mechanical or other forms.

[0191] The units described above as separate components may or may not be physically separated, and the components shown as units may or may not be physical units, that is, they may be located in one place or distributed on multiple network units. Some or all of the units may be selected according to actual needs to achieve the purpose of the solution of this embodiment.

[0192] In addition, each functional unit in each embodiment of the present invention may be integrated into one processing unit, or each unit may exist physically separately, or two or more units may be integrated into one unit. The above-mentioned integrated unit may be implemented in the form of hardware or in the form of software functional units.

[0193] If the integrated unit is implemented in the form of a software functional unit and sold or used as an independent product, it can be stored in a computer-readable storage medium. Based on this understanding, the technical solution of the present invention, in essence, or the part that contributes to the prior art, or all or part of the technical solution can be embodied in the form of a software product. The computer software product is stored in a storage medium, including multiple instructions for a computer device (which can be a personal computer, a server, or a network device, etc.) to perform all or part of the steps of the methods of various embodiments of the present invention. The aforementioned storage medium includes: U disk, mobile hard disk, read-only memory (ROM), random access memory (RAM), disk or optical disk, etc., various media that can store programs.

[0194] The preferred embodiments of the present invention are described above with reference to the accompanying drawings, but the scope of the rights of the embodiments of the present invention is not limited thereby. Any modification, equivalent substitution and improvement made by those skilled in the art without departing from the scope and essence of the embodiments of the present invention shall be within the scope of the rights of the embodiments of the present invention.

Claims

1. A data security policy automatic adjustment system, characterized in that: The system includes a data acquisition module, a data analysis module, a security policy adjustment module, a monitoring feedback module, a training data module, a policy database module and a user interface module; The data acquisition module is used to continuously acquire key data from the cloud environment based on a preset data acquisition device and perform preprocessing operations on the key data; Transmitting the key data after the preprocessing operation to the data analysis module and the monitoring feedback module; the key data includes user access records, network traffic information and system logs; The monitoring feedback module is used to obtain risk data through a preset monitoring method according to the key data transmitted by the data acquisition module; and transmit the risk data to the data analysis module; The data analysis module is used to perform risk analysis based on the key data transmitted by the data acquisition module through a pre-trained machine learning model to obtain a risk assessment result; and transmit the risk assessment result to the security policy adjustment module; Transmitting the risk data transmitted by the monitoring feedback module to the training data module; The training data module is used to perform scenario simulation training on the machine learning model of the data analysis module according to the risk data, and then adjust the network parameters of the machine learning model according to the results of the scenario simulation training; The policy database module is used to organize and output security policy tuning information based on the security policy configuration file obtained by the preset policy database device; Transmitting the security policy tuning information to the security policy adjustment module; The security policy adjustment module is used to generate security policy adjustment information based on the risk assessment result, and then generate a security adjustment policy in combination with the security policy tuning information; transmitting the security adjustment policy to a target security component of the cloud environment; The user interface module is used to modify and change the data information of the data acquisition module, the data analysis module, the security policy adjustment module, the monitoring feedback module, the training data module and the policy database module in response to the modification instruction; and to visualize the data information.

2. The data security policy automatic adjustment system according to claim 1, characterized in that: The data collection device includes a network sniffer and a log analysis tool deployed and integrated on a cloud platform of the cloud environment; The network sniffer and the log analysis tool are used to monitor and intercept the original network data packets and operation logs flowing through the nodes corresponding to the cloud platform in real time, filter and format the data according to preset data rules, and generate the user access records, the network traffic information and the system log.

3. The data security policy automatic adjustment system according to claim 1, characterized in that: The risk data includes at least one of abnormal traffic, abnormal behavior, user behavior deviation and abnormal log; the monitoring feedback module includes at least one of the following: A traffic analysis tool is used to monitor and analyze the network traffic information to obtain the abnormal traffic monitored; An intrusion detection system, used to capture illegal access and malicious behavior according to the user access record, and obtain the abnormal behavior; A user and entity behavior analysis device, used to identify and obtain the user behavior deviation through user and entity behavior analysis technology based on the user access record; The log management tool is used to track exceptions according to the system log and obtain the exception log.

4. The data security policy automatic adjustment system according to claim 1, characterized in that: The data analysis module includes: A model training device, used to train and adjust parameters of a preset neural network according to a training set labeled with the risk assessment result to obtain the machine learning model; A model running device is used to perform risk analysis on the key data transmitted by the data acquisition module according to the machine learning model to obtain the risk assessment result.

5. The data security policy automatic adjustment system according to claim 4, characterized in that: The model training device is specifically used for: Based on the type of security threat to be identified, the corresponding type of data set marked with the risk assessment result is sorted, and the data set is divided into the training set, the verification set and the test set; Configure recurrent neural networks based on long short-term memory artificial neural networks or gated recurrent units; Using the training set, the recursive neural network is iteratively trained using a cross entropy loss function and a root mean square loss function in combination with a preconfigured optimizer, and hyperparameters of the recursive neural network are adjusted according to the training results of each round of the iterative training, and then the performance of the recursive neural network after the hyperparameter adjustment is verified according to the verification set to obtain the model performance after each round of the iterative training; When the difference between the model performances of two consecutive rounds of iterative training is less than a preset performance threshold, the recursive neural network after the last round of hyperparameter adjustment is used as the target network; According to the test set, a confusion matrix and preset evaluation indicators are used to perform model evaluation on the target network to obtain a test result; based on the test result, the model architecture or hyperparameters of the target network are adjusted within a preset adjustment range to obtain the machine learning model.

6. The data security policy automatic adjustment system according to claim 1, characterized in that: The security policy adjustment module is specifically used for: Determining a security threat level faced by the cloud environment based on the risk assessment result; Determine corresponding security parameters based on the security threat level, and generate the security policy adjustment information according to the security parameters; wherein the security parameters include a firewall rule set, an intrusion detection system parameter, and an access control list; The security policy adjustment information is parameter-modified based on the security specification specified in the security policy configuration file included in the security policy tuning information to obtain the security adjustment policy.

7. The data security policy automatic adjustment system according to claim 1, characterized in that: The system further comprises: A basic data module, used to provide basic data services to the data security policy automatic adjustment system; The auxiliary decision-making module is used to automatically adjust all the data information in the system according to the security policy and generate security policy auxiliary suggestions through a preset policy analysis method.

8. A method for automatically adjusting data security policy, characterized in that: The following steps are involved: The data acquisition module continuously collects key data from the cloud environment based on a preset data acquisition device, and performs preprocessing operations on the key data; Transmitting the key data after the preprocessing operation to a data analysis module and a monitoring feedback module; the key data includes user access records, network traffic information and system logs; The monitoring feedback module obtains risk data through a preset monitoring method according to the key data transmitted by the data acquisition module; and transmits the risk data to the data analysis module; The data analysis module performs risk analysis based on the key data transmitted by the data acquisition module through a pre-trained machine learning model to obtain a risk assessment result; and transmits the risk assessment result to the security policy adjustment module; Transmitting the risk data transmitted by the monitoring feedback module to a training data module; Performing scenario simulation training on the machine learning model of the data analysis module according to the risk data through the training data module, and then adjusting the network parameters of the machine learning model according to the results of the scenario simulation training; The policy database module organizes and outputs security policy tuning information based on the security policy configuration files obtained by the preset policy database device; Transmitting the security policy tuning information to a security policy adjustment module; Generate security policy adjustment information based on the risk assessment result by the security policy adjustment module, and then generate a security adjustment policy in combination with the security policy tuning information; transmitting the security adjustment policy to a target security component of the cloud environment; The data information of the data acquisition module, the data analysis module, the security policy adjustment module, the monitoring feedback module, the training data module and the policy database module are modified and changed in response to modification instructions through the user interface module; and the data information is visualized.

9. An electronic device, characterized in that: The electronic device comprises a memory and a processor, wherein the memory stores a computer program, and the processor implements the method according to claim 8 when executing the computer program.

10. A computer-readable storage medium storing a computer program, characterized in that: When the computer program is executed by a processor, the method according to claim 8 is implemented.

Images