Network configuration strategy adjusting method and device and computer readable storage medium

Abstract

The invention discloses a network configuration strategy adjusting method and device and a computer readable storage medium. The method is applied to a power monitoring system, and comprises the following steps: acquiring a network configuration strategy set of network equipment in the power monitoring system; a target network configuration strategy is extracted from the network configuration strategy set, and the target network configuration strategy is used for indicating the network configuration strategy with the use frequency lower than the frequency threshold value in the network configuration strategy set; on the basis of the strategy verification rule, abnormal network configuration strategies in the target network configuration strategies are identified, and the abnormal network configuration strategies are used for at least indicating the network configuration strategies with security vulnerabilities; and adjusting abnormal configuration information of the abnormal network configuration strategy based on the strategy verification rule. According to the invention, the technical problem that the network configuration strategy in the power monitoring system cannot be effectively and comprehensively verified and adjusted is solved.

Description

Technical Field

[0001] The present invention relates to the field of network security technology, and in particular to a method, device and computer-readable storage medium for adjusting a network configuration strategy. Background Art

[0002] At present, when conducting policy audits on network devices in power monitoring systems, the focus is mainly on general firewall devices and switch devices, and effective and invalid policies are judged by monitoring and analyzing the log data in the firewall devices and switch devices. Due to the huge amount of log data, a large amount of computing resources are required, and the data processing efficiency is low. In addition, this method mainly targets firewall devices and switch devices in the network, ignoring the vertical encryption devices in the power monitoring system. There is a technical problem that the network configuration policy of the network devices in the power monitoring system cannot be effectively verified and adjusted.

[0003] With respect to the above-mentioned technical problem that the network configuration strategy of the network equipment in the power monitoring system cannot be effectively and comprehensively verified and adjusted, no effective solution has been proposed yet. Summary of the invention

[0004] The embodiments of the present invention provide a method, an apparatus and a computer-readable storage medium for adjusting a network configuration policy, so as to at least solve the technical problem that the network configuration policy of a network device in a power monitoring system cannot be effectively and comprehensively verified and adjusted.

[0005] According to one aspect of an embodiment of the present invention, a method for adjusting a network configuration policy is provided, which is applied to a power monitoring system. The method may include: obtaining a network configuration policy set of a network device in the power monitoring system, wherein the network configuration policy in the network configuration policy set is used to represent a rule for securely transmitting data in the power monitoring system in the network device; extracting a target network configuration policy from the network configuration policy set, wherein the target network configuration policy is used to indicate a network configuration policy in the network configuration policy set whose use frequency is lower than a frequency threshold; based on a policy verification rule, identifying an abnormal network configuration policy in the target network configuration policy, wherein the policy verification rule is used to indicate a rule for verifying the network configuration policy, and the abnormal network configuration policy is used to at least indicate a network configuration policy with a security vulnerability; based on the policy verification rule, adjusting the abnormal configuration information of the abnormal network configuration policy.

[0006] Optionally, extracting a target network configuration policy from a network configuration policy set includes: acquiring network traffic data in a power monitoring system; extracting policy configuration information associated with the network configuration policy from the network traffic data; determining all network configuration policies associated with the network traffic data based on the policy configuration information; determining the number of times each network configuration policy is used within a preset time period based on the network traffic data; and extracting a target network configuration policy from all network configuration policies based on the number of times used.

[0007] Optionally, based on the number of uses, a target network configuration policy is extracted from all network configuration policies, including: extracting a network configuration policy whose number of uses is less than a number threshold from all network configuration policies; and determining the extracted network configuration policy as the target network configuration policy.

[0008] Optionally, based on the policy verification rules, abnormal network configuration policies in the target network configuration policy are identified, including: based on the policy verification rules, determining the matching degree between the configuration rules of each network configuration policy in the target network configuration policy and the policy verification rules; and determining the network configuration policy whose matching degree is less than the matching threshold as an abnormal network configuration policy.

[0009] Optionally, the method for adjusting the network configuration policy also includes: in the same business environment, comparing the abnormal network configuration policy and the normal network configuration policy to obtain a policy comparison result, wherein the normal network configuration policy is used to indicate a network configuration policy whose usage frequency is higher than a frequency threshold, and the policy comparison result is used to indicate the configuration difference between the abnormal network configuration policy and the normal network configuration policy; based on the policy comparison result, adjusting the abnormal configuration information of the abnormal network configuration policy.

[0010] Optionally, the policy verification rules include at least one of the following: address information, port information, protocol information, access mode information, and communication volume information, the address information includes at least a source address and a destination address whose usage frequency is greater than a first frequency threshold, the port information includes at least a network port whose usage frequency is greater than a second frequency threshold, the access mode information includes at least access time distribution information of the network configuration policy, and the communication volume information includes at least a communication volume range of the network configuration policy, wherein the first frequency threshold is the same as or different from the second frequency threshold.

[0011] Optionally, based on the policy verification rules, adjusting the abnormal configuration information of the abnormal network configuration policy includes: generating policy adjustment information of the abnormal network configuration policy based on the policy verification rules, wherein the policy adjustment information is used to adjust the abnormal configuration information in the abnormal network configuration policy; adjusting the abnormal configuration information of the abnormal network configuration policy based on the policy adjustment information.

[0012] Optionally, the network device includes at least one of the following: a vertical encryption device, a firewall device and a switch device.

[0013] According to another aspect of an embodiment of the present invention, there is also provided a device for adjusting a network configuration policy, which is applied to a power monitoring system. The device may include: an acquisition unit, which is used to acquire a network configuration policy set of a network device in the power monitoring system, wherein the network configuration policy in the network configuration policy set is used to represent a rule for securely transmitting data in the power monitoring system in the network device; an extraction unit, which is used to extract a target network configuration policy from the network configuration policy set, wherein the target network configuration policy is used to indicate a network configuration policy in the network configuration policy set whose usage frequency is lower than a frequency threshold; an identification unit, which is used to identify an abnormal network configuration policy in the target network configuration policy based on a policy verification rule, wherein the policy verification rule is used to indicate a rule for verifying a network configuration policy, and an abnormal network configuration policy is used to at least indicate a network configuration policy with a security vulnerability; an adjustment unit, which is used to adjust abnormal configuration information of the abnormal network configuration policy based on the policy verification rule.

[0014] According to another aspect of an embodiment of the present invention, a computer-readable storage medium is also provided, the computer-readable storage medium including a stored program, wherein when the program is executed by a processor, the device where the storage medium is located is controlled to execute the method for adjusting the network configuration policy in an embodiment of the present invention.

[0015] According to another aspect of an embodiment of the present invention, a processor is provided, which is used to run a program, wherein the method for adjusting the network configuration policy in an embodiment of the present invention is executed when the program is run.

[0016] According to another aspect of the embodiment of the present invention, a computer program product is provided, which includes computer instructions, and when the computer instructions are executed by a processor, the method for adjusting the network configuration policy in the embodiment of the present invention is implemented.

[0017] In an embodiment of the present invention, a network configuration policy set of a network device in a power monitoring system is obtained, wherein the network configuration policies in the network configuration policy set are used to represent rules for securely transmitting data in the power monitoring system in the network devices; a target network configuration policy is extracted from the network configuration policy set, wherein the target network configuration policy is used to indicate a network configuration policy in the network configuration policy set whose usage frequency is lower than a frequency threshold; based on a policy verification rule, an abnormal network configuration policy in the target network configuration policy is identified, wherein the policy verification rule is used to indicate a rule for verifying the network configuration policy, and the abnormal network configuration policy is used to at least indicate a network configuration policy with a security vulnerability; based on the policy verification rule, the abnormal configuration information of the abnormal network configuration policy is adjusted. That is to say, in the embodiment of the present invention, since there is a greater possibility that network configuration policies that are less frequently used in the power monitoring system are abnormal, based on this, through the policy verification rules, the network configuration policies of all network devices in the power monitoring system that are less frequently used are verified, and the abnormal network configuration policies can be quickly determined, and the abnormal configuration information in the abnormal network configuration policies can be adjusted to achieve the purpose of optimizing the network performance in the power monitoring system, and then achieve the technical effect of effectively verifying and adjusting the network configuration policies in the power monitoring system, thereby solving the technical problem of being unable to effectively verify and adjust the network configuration policies in the power monitoring system. BRIEF DESCRIPTION OF THE DRAWINGS

[0018] The drawings described herein are used to provide a further understanding of the present invention and constitute a part of this application. The exemplary embodiments of the present invention and their descriptions are used to explain the present invention and do not constitute an improper limitation of the present invention. In the drawings:

[0019] Figure 1 is a flow chart of a method for adjusting a network configuration policy according to an embodiment of the present invention;

[0020] Figure 2 It is a schematic diagram of a device for adjusting a network configuration policy according to an embodiment of the present invention. DETAILED DESCRIPTION

[0021] In order to enable those skilled in the art to better understand the scheme of the present invention, the technical scheme in the embodiments of the present invention will be clearly and completely described below in conjunction with the drawings in the embodiments of the present invention. Obviously, the described embodiments are only part of the embodiments of the present invention, not all of the embodiments. Based on the embodiments of the present invention, all other embodiments obtained by ordinary technicians in this field without creative work should fall within the scope of protection of the present invention.

[0022] It should be noted that the terms "first", "second", etc. in the specification and claims of the present invention and the above-mentioned drawings are used to distinguish similar objects, and are not necessarily used to describe a specific order or sequence. It should be understood that the data used in this way can be interchanged where appropriate, so that the embodiments of the present invention described herein can be implemented in an order other than those illustrated or described herein. In addition, the terms "including" and "having" and any variations thereof are intended to cover non-exclusive inclusions, for example, a process, method, system, functional component or device that includes a series of steps or units is not necessarily limited to those steps or units clearly listed, but may include other steps or units that are not clearly listed or inherent to these processes, methods, functional components or devices.

[0023] Example 1

[0024] According to an embodiment of the present invention, an embodiment of a method for adjusting a network configuration policy is provided. It should be noted that the steps shown in the flowchart of the accompanying drawings can be executed in a computer system such as a set of computer executable instructions, and although a logical order is shown in the flowchart, in some cases, the steps shown or described can be executed in an order different from that shown here.

[0025] Figure 1 is a flow chart of a method for adjusting a network configuration policy according to an embodiment of the present invention. Figure 1 As shown, the method may include the following steps:

[0026] Step S101, obtaining a network configuration policy set of a network device in a power monitoring system.

[0027] In the technical solution provided in the above step S101 of the present invention, the network equipment may at least include a vertical encryption device, a firewall device and a switch device in the power monitoring system; the network configuration policy set may at least include: a network configuration policy in the vertical encryption device, a network configuration policy in the firewall device, and a network configuration policy in the switch device, wherein the network configuration policy is used to represent the rules for securely transmitting data in the power monitoring system in the network equipment, and the network configuration policy may be: routing information, tunnel information, policy information, etc. This is only an illustrative example and does not limit the specific content of the network configuration policy.

[0028] In this embodiment, the command line interface can be used to access the management interface of the network device in the power monitoring system, and then the network configuration policy information of the network device can be obtained through the command line tool. For example, the network configuration policies in the vertical encryption device, firewall device and switch device in the power monitoring system are collected through the command line tool, and then the collected network configuration policies are summarized to obtain the network configuration policy set of the network device in the power monitoring system.

[0029] Step S102: extracting a target network configuration policy from a network configuration policy set.

[0030] In the technical solution provided in the above step S102 of the present invention, the target network configuration policy is used to indicate a network configuration policy whose usage frequency in the network configuration policy set is lower than a frequency threshold.

[0031] In this embodiment, the target network configuration policy may be extracted according to the usage frequency of the network configuration policies included in the network configuration policy set.

[0032] For example, the network configuration strategies in the network configuration strategy set are first divided into different types, and then the usage frequency of different types of network configuration strategies is determined according to the flow data in the power monitoring system, and the usage frequency of each type of network configuration strategy is compared with the frequency threshold to obtain a comparison result.

[0033] Optionally, based on the comparison result, determine the network configuration strategy with a usage frequency greater than the frequency threshold and the network configuration strategy with a usage frequency lower than the frequency threshold. Among them, the network configuration strategy with a usage frequency greater than the frequency threshold can be called the majority strategy, and the network configuration strategy with a usage frequency lower than the frequency threshold can be called the minority strategy. Among them, the majority strategy is less likely to be abnormal because it often appears in the network, while the minority strategy is rarely used in the network and may have abnormalities due to its low usage frequency. Among them, the frequency threshold can be preset, for example, it can be set to 50, which is only an illustrative example here, and the specific value of the frequency threshold is not limited.

[0034] Optionally, after determining the majority policy and the minority policy in the network configuration policy set, the minority policy may be determined as the target network configuration policy and extracted from the network configuration policy set.

[0035] Optionally, by analyzing the majority of policies, a set of configuration rules for network configuration policies can be automatically formed, which can also be called policy verification rules, wherein the majority of policies can generally include the following: common address information, common ports and protocols, typical access modes, and legal traffic. However, a few policies may contain potential security risks or configuration errors due to their low frequency of use, wherein the few policies can generally include the following: uncommon address information, uncommon port information, abnormal access modes, and traffic that exceeds the normal range.

[0036] In this step, since network configuration policies that are used less frequently in the network are more likely to have anomalies, based on this, the target network configuration policy is quickly extracted from the network configuration policy set by using frequency, which helps to improve the verification efficiency of the network configuration policy.

[0037] Step S103: identifying abnormal network configuration policies in the target network configuration policies based on the policy verification rules.

[0038] In the technical solution provided in the above step S103 of the present invention, the policy verification rule is used to indicate the rule for verifying the network configuration policy, and the policy verification rule can be generated in advance according to the network configuration policy that is used more frequently in the power monitoring system network, for example, by summarizing the configuration rules of the network configuration policy that is used more frequently in the network. The abnormal network configuration policy is used to at least indicate the network configuration policy that has a security vulnerability.

[0039] In this embodiment, the policy verification rule may at least include the following contents: common source Internet Protocol (IP) addresses and target IP addresses, common ports and protocols, typical access modes, and legal traffic, wherein common source IP addresses and target IP addresses are used to indicate the addresses of hosts or devices that are legal and frequently communicating in the network, common ports and protocols may include Hypertext Transfer Protocol (HTTP) and corresponding ports, Hypertext Transfer Protocol Secure port (HTTPS) and corresponding ports, Secure Hypertext Transfer Protocol (SSH) and corresponding ports, which are only illustrative examples, and typical access modes are used to indicate that the network configuration policy has a high access volume during the working hours and a low access volume during non-working hours, and legal traffic is used to indicate the range of traffic volume under normal circumstances determined by traffic analysis. The policy verification rule can be based on analyzing the network configuration policy that is frequently used in the network, and then forming a standard to help identify whether the network configuration policy meets the policy verification rule, if it meets, it is confirmed as a normal network configuration policy, and if it does not meet, it is confirmed as an abnormal network configuration policy.

[0040] For example, each network configuration policy in the target network configuration policy is verified through the policy verification rules, and the network configuration policies in the target network configuration policy that do not meet the policy verification rules are extracted and determined as abnormal network configuration policies, wherein the abnormal network configuration policies include abnormal configuration information.

[0041] In this step, through the policy verification rules, abnormal network configuration policies can be identified from the target network configuration policies to locate potential security risks in the network.

[0042] Step S104: adjusting the abnormal configuration information of the abnormal network configuration policy based on the policy verification rule.

[0043] In the technical solution provided in the above step S104 of the present invention, the abnormal configuration information is used to indicate the configuration information in the abnormal network configuration policy that does not satisfy the policy verification rule.

[0044] In this embodiment, after the abnormal configuration information in the abnormal network configuration policy is determined, the abnormal configuration information may be adjusted according to the policy verification rule to be adjusted to normal configuration information that satisfies the policy verification rule.

[0045] In the above steps S101 to S104, since there is a high possibility that there are abnormalities in the network configuration policies that are less frequently used in the power monitoring system, based on this, through the policy verification rules, the network configuration policies that are less frequently used in the network configuration policies of all network devices in the power monitoring system are verified, and the abnormal network configuration policies can be quickly determined, and the abnormal configuration information in the abnormal network configuration policies can be adjusted to achieve the purpose of optimizing the network performance in the power monitoring system, and then achieve the technical effect of effectively verifying and adjusting the network configuration policies in the power monitoring system, thereby solving the technical problem of being unable to effectively verify and adjust the network configuration policies in the power monitoring system.

[0046] The above method of this embodiment is further introduced below.

[0047] As an optional implementation method, step S102, extracting the target network configuration strategy from the network configuration strategy set, includes: obtaining network traffic data in the power monitoring system; extracting policy configuration information associated with the network configuration strategy from the network traffic data; based on the policy configuration information, determining all network configuration strategies associated with the network traffic data; based on the network traffic data, determining the number of times each network configuration strategy is used within a preset time period; based on the number of times used, extracting the target network configuration strategy from all network configuration strategies.

[0048] In this embodiment, the network flow data is used to monitor the real-time situation of the network, and the network flow data can be used to indicate the data packet information monitored in the network within a period of time. By analyzing the network flow data, the network configuration policy information used in the transmission process of the network flow data can be identified.

[0049] Optionally, after obtaining the network configuration policy information corresponding to the network traffic data, the network configuration policy associated with each piece of network traffic data can be determined, and then the number of times each network configuration policy is used within a preset time period can be counted, and based on the number of times used, the target network configuration policy can be filtered out from all network configuration policies, wherein the preset time period can be set in advance, for example, the preset time period can be one day, one week or one month. This is only an illustrative example and does not limit the specific value of the preset time period.

[0050] For example, after obtaining the number of times each network configuration strategy is used within a preset time period, the number of times each network configuration strategy is used can be compared with a number threshold to obtain a comparison result. Based on the comparison result, a network configuration strategy whose number of uses is less than the number threshold is selected, and the selected network configuration strategy is determined as the target network configuration strategy.

[0051] In this step, by obtaining the network traffic data in the power monitoring system, and then based on the network configuration strategies associated with the network traffic data and the number of times each network configuration strategy is used within a preset time period, the network configuration strategies with lower usage frequency can be quickly determined, thereby improving the efficiency of screening network configuration strategies with potential security risks in the power monitoring system network.

[0052] As an optional implementation method, a target network configuration policy is extracted from all network configuration policies based on the number of uses, including: extracting a network configuration policy whose number of uses is less than a number threshold from all network configuration policies; and determining the extracted network configuration policy as the target network configuration policy.

[0053] In this embodiment, since the number of uses is used to indicate the frequency of use of the network configuration policy, based on this, after the number of uses of all network traffic data is extracted from the network traffic data, the network configuration policy with a number of uses less than a number threshold can be extracted from all network configuration policies according to the number of uses of each network configuration policy, and the extracted network configuration policy is determined as the target network configuration policy, wherein the target network configuration policy can be used to indicate a network configuration policy with a lower usage frequency in the network.

[0054] For example, when the number threshold is 50, the network configuration policy that has been used less than 50 times can be determined as the target network configuration policy, where this is only an illustrative example and does not limit the specific data of the number threshold.

[0055] As an optional implementation, based on policy verification rules, abnormal network configuration policies in the target network configuration policy are identified, including: based on the policy verification rules, determining the matching degree between the configuration rules of each network configuration policy in the target network configuration policy and the policy verification rules; and determining the network configuration policy whose matching degree is less than the matching threshold as an abnormal network configuration policy.

[0056] In this embodiment, since the policy verification rules are a set of predefined rules or standards, they are used to evaluate whether the network configuration policy meets the expected security and performance requirements. These rules may include checking port opening, service operation status, protocol usage, network access rights, etc. Based on this, the configuration rules of each network configuration policy in the target network configuration policy can be tested through the policy verification rules to determine the matching degree between each network configuration policy and the policy verification rules, and the matching degree is used to indicate the degree to which the corresponding network configuration policy meets the policy verification rules.

[0057] Optionally, after determining the degree of match between the configuration rule of each network configuration policy in the target network configuration policy and the policy verification rule, the network configuration policy with a degree of match less than a threshold value of the degree of match may be determined as an abnormal network configuration policy.

[0058] In this step, by checking the configuration rules of each network configuration policy in the target network configuration policy through the policy verification rules, abnormal network configuration policies can be quickly determined to improve the efficiency of locating abnormal network configuration policies in the target network configuration policy.

[0059] As an optional implementation method, the method for adjusting the network policy configuration also includes: in the same business environment, comparing the abnormal network configuration policy and the normal network configuration policy to obtain a policy comparison result, wherein the normal network configuration policy is used to indicate a network configuration policy whose usage frequency is higher than a frequency threshold, and the policy comparison result is used to indicate the configuration difference between the abnormal network configuration policy and the normal network configuration policy; based on the policy comparison result, adjusting the abnormal configuration information of the abnormal network configuration policy.

[0060] In this embodiment, abnormal network configuration policies are used to indicate uncommon or non-standard network configurations in the network environment. These configurations may be caused by errors, malicious behavior or outdated configurations, and may cause security risks or performance issues; normal network configuration policies are used to indicate network configurations that are considered standard and safe in the network environment. These configurations are usually verified and widely accepted as best practices.

[0061] Optionally, abnormal configuration policies may generally exhibit the following characteristics: the presence of abnormal configuration information, security vulnerabilities, redundant policies, and non-compliant policies. Among them, abnormal configuration information is generally used to indicate that there are configuration rules in the network configuration policy that may be different from the normal configuration policy (common configuration policy) due to misconfiguration; security vulnerabilities are generally used to indicate that there may be situations in the network configuration policy that allow unauthorized access or data leakage; redundant policies are used to indicate that the network configuration policy may cause policy conflicts or affect network performance; non-compliant policies are generally used to indicate policies that violate enterprise security policies or best practices.

[0062] Optionally, since the network configuration policies in the same business environment satisfy the same configuration rules, based on this, by comparing the abnormal network configuration policy and the normal network configuration policy in the same business environment, the policy comparison result obtained can be used to represent the configuration difference between the abnormal network configuration policy and the normal network configuration policy, wherein the comparison may involve checking whether the configuration of the IP address, port, protocol, service, etc. of the abnormal network configuration policy meets the standards in the normal business environment. The configuration differences may include ports that should not be open, services that should not exist, incorrect routing rules, etc., which are not limited here.

[0063] Optionally, after determining the configuration difference, the abnormal configuration information in the abnormal network configuration policy can be adjusted to make it closer to the normal network configuration policy, for example, shutting down unnecessary services in the abnormal network configuration policy, changing the wrong configuration in the abnormal network configuration policy, updating routing rules, etc., which are not specifically limited here.

[0064] In this step, differentiated feature comparison technology is applied to compare the majority strategy and the minority strategy in the same business environment to achieve adaptive adjustment of abnormal network configuration strategies to optimize network performance and security configuration.

[0065] As an optional implementation method, step S104, based on the policy verification rules, adjusts the abnormal configuration information of the abnormal network configuration policy, including: based on the policy verification rules, generating policy adjustment information of the abnormal network configuration policy, wherein the policy adjustment information is used to adjust the abnormal configuration information in the abnormal network configuration policy; based on the policy adjustment information, adjusting the abnormal configuration information of the abnormal network configuration policy.

[0066] In this embodiment, as described above, the policy verification rules are a set of predefined rules or standards used to evaluate whether the network configuration policy meets the expected security and performance requirements. These rules may include checking port opening, service operation status, protocol usage, network access rights, etc.

[0067] Optionally, after obtaining the abnormal network configuration policy, the abnormal network configuration policy can be fine-grainedly analyzed according to the policy verification rules to locate the specific cause of the abnormality of the abnormal network configuration policy, identify the security issues or configuration errors in the abnormal configuration policy, and provide detailed rectification suggestions. For example, the ports that need to be closed, the configuration files that need to be updated, the services that need to be changed, etc. in the abnormal network configuration policy are not specifically limited here.

[0068] In this step, by automatically detecting and adjusting abnormal configuration information in abnormal network configuration policies, human errors can be reduced, response speed can be improved, and the stability and security of the network environment can be ensured.

[0069] The technical solution of the embodiment of the present invention is illustrated below in conjunction with preferred implementation modes.

[0070] At present, when conducting policy audits on network devices in power monitoring systems, the focus is mainly on general firewall devices and switch devices, and effective and invalid policies are judged by monitoring and analyzing the log data in the firewall devices and switch devices. Due to the huge amount of log data, a large amount of computing resources are required, and the data processing efficiency is low. In addition, this method mainly targets firewall devices and switch devices in the network, ignoring the vertical encryption devices in the power monitoring system. There is a technical problem that the network configuration policy of the network devices in the power monitoring system cannot be effectively verified and adjusted.

[0071] However, the present application provides a method for adjusting a network configuration strategy by obtaining the network configuration strategy of a network device in a power monitoring system, wherein the network device may include at least: a vertical encryption device, a firewall device, and a switch device, and using pre-established policy verification rules to classify and cluster the obtained network configuration strategies to obtain a majority of strategies with higher usage frequencies and a minority of strategies with lower usage frequencies, and then using data statistics and differential analysis to automatically extract potential danger strategies from the minority strategies, and locate the specific causes of the potential danger strategies in a fine-grained manner, form rectification suggestions, and guide operation and maintenance personnel to correct the potential danger strategies according to the rectification suggestions to optimize the network environment and ensure the network security of the power monitoring system, thereby achieving the technical effect of effectively verifying and adjusting the network configuration strategy in the power monitoring system, thereby solving the technical problem of being unable to effectively verify and adjust the network configuration strategy in the power monitoring system.

[0072] Optionally, by collecting various key information of the vertical encryption device, firewall device and switch device, such as routing information, tunnel information, policy information, etc., various policy issues can be analyzed based on the collected data. For example, it was originally planned to open port 1024, but after analyzing the collected data, it was found that ports 1000-1024 were actually opened. There are too many opened ports, which poses a security risk, and the user is guided to modify the policy.

[0073] Next, the composition of classifying and clustering the network configuration strategies adopted by the network devices in the power monitoring system is further introduced.

[0074] In this embodiment, after obtaining the network configuration strategies in the network devices in the power monitoring system, the number of times each network configuration strategy is used within a preset time period can be counted, and then the majority strategy and the minority strategy can be determined based on the number of uses and the frequency threshold, where the majority strategy is used to indicate strategies with higher usage frequencies, and the minority strategy is used to indicate strategies with lower usage frequencies.

[0075] For example, assuming that the number threshold is 50, the majority policy can be used to indicate the network configuration policies whose usage times are greater than 50, and the minority policy can be used to indicate the network configuration policies whose usage times are less than 50.

[0076] Optionally, majority policies refer to policies that often appear and are frequently used in the network. Minority policies refer to policies that rarely appear in the network, are used less frequently, or may have anomalies. Among them, potential risk policies in minority policies are used to indicate policies that are found to be used less frequently through data statistics and differential analysis during the network policy audit process, but may pose a threat to network security and performance. These potential risk policies usually exhibit the following characteristics: configuration anomalies, security vulnerabilities, or redundant policies, and policies that do not comply with regulations. Among them, configuration anomalies may be unreasonable policies caused by misconfiguration, security vulnerabilities may be manifested as allowing unauthorized access or data leakage, redundant policies may cause policy conflicts or performance problems, and non-compliant policies may be policies that violate enterprise security.

[0077] Optionally, after the vulnerability strategy is determined, a fine-grained analysis of the vulnerability strategy can be performed, for example, by deeply analyzing network policies and traffic data, identifying potential security issues or configuration errors, and providing detailed rectification suggestions to ensure network security and performance and reduce potential security risks.

[0078] Optionally, the network configuration policy adjustment method provided in the present application is applicable to analyzing the network configuration policy in the network security boundary device in the power monitoring system. Traditional policy audits are aimed at general firewall devices and switch devices, and lack policy audit products for vertical encryption devices in power monitoring systems. This application targets the business characteristics and compliance control requirements of the power monitoring system, enables data mining technology, automatically analyzes the policy risks of a large number of vertical encryption devices, reduces the exposure of some assets in the substation, and ensures the network security of the power monitoring system.

[0079] Optionally, traditional policy audit products determine policy hits through log monitoring and analysis to determine valid and invalid policies. This method is indirect, time-consuming and has low accuracy. The present application directly obtains all policy configurations inside the vertical encryption device, firewall device and switch device, and conducts in-depth analysis. When using it, the user only needs to connect the device itself. The vertical encryption device can also connect to the vertical encryption device management center, run a one-click check, automatically log in to the border device collection, read the policy configuration and hit count in full, directly and quickly analyze the policy, quickly generate reports, and accurately evaluate policy risks.

[0080] Optionally, the present application uses feature engineering methods to conduct a detailed analysis of key attributes of network policies (such as source address, destination address, port, etc.), and uses clustering algorithms to achieve accurate classification of policies, thereby constructing an efficient policy management mechanism.

[0081] Optionally, the present application uses the principle of adaptive learning based on the standards automatically formed by the majority of policies and the abnormal assumptions of the minority of policies, and realizes automatic identification and classification of policies through threshold analysis, thereby providing a new risk assessment method for network security.

[0082] Optionally, the present application applies differentiated feature comparison technology to compare majority policies and minority policies in the same business environment to achieve adaptive adjustment of policy configuration to optimize network performance and security configuration.

[0083] According to an embodiment of the present invention, a network configuration policy adjustment device is also provided. It should be noted that the network configuration policy adjustment device can be used to execute the network configuration policy adjustment method in embodiment 1.

[0084] Figure 2 FIG. 1 is a schematic diagram of a device for adjusting a network configuration strategy according to an embodiment of the present invention. Figure 2 As shown, the network configuration policy adjustment device 200 may include: an acquisition unit 201 , an extraction unit 202 , an identification unit 203 and an adjustment unit 204 .

[0085] An acquisition unit 201 is used to acquire a network configuration policy set of a network device in a power monitoring system, wherein the network configuration policy in the network configuration policy set is used to represent a rule for securely transmitting data in the power monitoring system in the network device;

[0086] An extracting unit 202 is used to extract a target network configuration policy from the network configuration policy set, wherein the target network configuration policy is used to indicate a network configuration policy in the network configuration policy set whose usage frequency is lower than a frequency threshold;

[0087] An identification unit 203 is used to identify an abnormal network configuration policy in the target network configuration policy based on a policy verification rule, wherein the policy verification rule is used to indicate a rule for verifying the network configuration policy, and the abnormal network configuration policy is used to at least indicate a network configuration policy with a security vulnerability;

[0088] The adjusting unit 204 is configured to adjust the abnormal configuration information of the abnormal network configuration policy based on the policy verification rule.

[0089] Optionally, the extraction unit 202 is also used to: obtain network traffic data in the power monitoring system; extract policy configuration information associated with the network configuration strategy from the network traffic data; determine all network configuration strategies associated with the network traffic data based on the policy configuration information; determine the number of times each network configuration strategy is used within a preset time period based on the network traffic data; and extract a target network configuration strategy from all network configuration strategies based on the number of times used.

[0090] Optionally, the extracting unit 202 is further configured to: extract, from all network configuration policies, a network configuration policy whose usage times are less than a times threshold; and determine the extracted network configuration policy as a target network configuration policy.

[0091] Optionally, the identification unit 203 is further used to: determine the matching degree between the configuration rules of each network configuration policy in the target network configuration policy and the policy verification rule based on the policy verification rule; and determine the network configuration policy whose matching degree is less than the matching threshold as an abnormal network configuration policy.

[0092] Optionally, the network configuration policy adjustment device 200 is also used to: compare the abnormal network configuration policy and the normal network configuration policy in the same business environment to obtain a policy comparison result, wherein the normal network configuration policy is used to indicate a network configuration policy whose usage frequency is higher than a frequency threshold, and the policy comparison result is used to indicate the configuration difference between the abnormal network configuration policy and the normal network configuration policy; based on the policy comparison result, adjust the abnormal configuration information of the abnormal network configuration policy.

[0093] Optionally, the adjustment unit 204 is further used to: generate policy adjustment information of the abnormal network configuration policy based on the policy verification rule, wherein the policy adjustment information is used to adjust the abnormal configuration information in the abnormal network configuration policy; and adjust the abnormal configuration information of the abnormal network configuration policy based on the policy adjustment information.

[0094] In this embodiment, since there is a high possibility that network configuration policies that are less frequently used in the power monitoring system are abnormal, based on this, through policy verification rules, the network configuration policies of all network devices in the power monitoring system that are less frequently used are verified, and abnormal network configuration policies can be quickly determined, and the abnormal configuration information in the abnormal network configuration policies can be adjusted to achieve the purpose of optimizing the network performance in the power monitoring system, and then achieve the technical effect of effectively verifying and adjusting the network configuration policies in the power monitoring system, thereby solving the technical problem of being unable to effectively verify and adjust the network configuration policies in the power monitoring system.

[0095] According to an embodiment of the present invention, a computer-readable storage medium is further provided. The storage medium includes a stored program, wherein the program executes the method for adjusting the network configuration policy in Embodiment 1.

[0096] According to an embodiment of the present invention, a processor is further provided. The processor is used to run a program, wherein the method for adjusting the network configuration policy in Embodiment 1 is executed when the program is running.

[0097] According to another aspect of the present invention, a computer program product is provided, which includes computer instructions, and when the computer instructions are executed by a processor, the method for adjusting the network configuration policy in the first embodiment is implemented.

[0098] The serial numbers of the above embodiments of the present invention are only for description and do not represent the advantages or disadvantages of the embodiments.

[0099] In the above embodiments of the present invention, the description of each embodiment has its own emphasis. For parts that are not described in detail in a certain embodiment, reference can be made to the relevant descriptions of other embodiments.

[0100] In the several embodiments provided in this application, it should be understood that the disclosed technical content can be implemented in other ways. Among them, the device embodiments described above are only schematic. For example, the division of units can be a logical function division. There may be other division methods in actual implementation. For example, multiple units or components can be combined or integrated into another system, or some features can be ignored or not executed. Another point is that the mutual coupling or direct coupling or communication connection shown or discussed can be through some interfaces, indirect coupling or communication connection of units or modules, which can be electrical or other forms.

[0101] The units described as separate components may or may not be physically separated, and the components shown as units may or may not be physical units, that is, they may be located in one place or distributed over multiple units. Some or all of the units may be selected according to actual needs to achieve the purpose of the present embodiment.

[0102] In addition, each functional unit in each embodiment of the present invention may be integrated into one processing unit, or each unit may exist physically separately, or two or more units may be integrated into one unit. The above-mentioned integrated unit may be implemented in the form of hardware or in the form of software functional units.

[0103] If the integrated unit is implemented in the form of a software functional unit and sold or used as an independent functional component, it can be stored in a computer-readable storage medium. Based on this understanding, the technical solution of the present invention, in essence, or the part that contributes to the prior art, or all or part of the technical solution can be embodied in the form of a software functional component, which is stored in a storage medium and includes several instructions for a computer device (which can be a personal computer, a server or a network device, etc.) to perform all or part of the steps of the methods of each embodiment of the present invention. The aforementioned storage medium includes: U disk, Read-Only Memory (ROM), Random Access Memory (RAM), mobile hard disk, magnetic disk or optical disk, etc., various media that can store program codes.

[0104] The above are only preferred embodiments of the present invention. It should be pointed out that, for ordinary technicians in this technical field, several improvements and modifications can be made without departing from the principles of the present invention. These improvements and modifications should also be regarded as the scope of protection of the present invention.

Claims

1. A method for adjusting a network configuration strategy, characterized in that: Applied to a power monitoring system, the method comprises: Acquire a network configuration policy set of a network device in the power monitoring system, wherein the network configuration policy in the network configuration policy set is used to represent a rule for enabling data in the power monitoring system to be securely transmitted in the network device; Extracting a target network configuration policy from the network configuration policy set, wherein the target network configuration policy is used to indicate a network configuration policy in the network configuration policy set whose usage frequency is lower than a frequency threshold; Based on a policy verification rule, identifying an abnormal network configuration policy in the target network configuration policy, wherein the policy verification rule is used to indicate a rule for verifying the network configuration policy, and the abnormal network configuration policy is used to at least indicate a network configuration policy with a security vulnerability; Based on the policy verification rule, the abnormal configuration information of the abnormal network configuration policy is adjusted.

2. The method according to claim 1, characterized in that Extracting a target network configuration policy from the network configuration policy set includes: Acquire network traffic data in the power monitoring system; Extracting policy configuration information associated with the network configuration policy from the network traffic data; Based on the policy configuration information, determine all the network configuration policies associated with the network traffic data; Based on the network traffic data, determining the number of times each of the network configuration strategies is used within a preset time period; Based on the number of uses, the target network configuration policy is extracted from all the network configuration policies.

3. The method according to claim 2, characterized in that Based on the number of times used, extracting the target network configuration policy from all the network configuration policies includes: Extracting the network configuration policy whose usage times are less than the times threshold from all the network configuration policies; The extracted network configuration policy is determined as the target network configuration policy.

4. The method according to claim 1, characterized in that: Based on the policy verification rule, identifying abnormal network configuration policies in the target network configuration policy includes: Based on the policy verification rule, determining the degree of match between each configuration rule of the network configuration policy in the target network configuration policy and the policy verification rule; The network configuration policy whose matching degree is less than the matching threshold is determined as the abnormal network configuration policy.

5. The method according to claim 1, characterized in that The method further comprises: In the same service environment, comparing the abnormal network configuration policy and the normal network configuration policy to obtain a policy comparison result, wherein the normal network configuration policy is used to indicate the network configuration policy with a usage frequency higher than the frequency threshold, and the policy comparison result is used to indicate a configuration difference between the abnormal network configuration policy and the normal network configuration policy; Based on the policy comparison result, the abnormal configuration information of the abnormal network configuration policy is adjusted.

6. The method according to claim 1, characterized in that The policy verification rules include at least one of the following: address information, port information, protocol information, access mode information, and communication volume information. The address information includes at least a source address and a destination address whose usage frequency is greater than a first frequency threshold, the port information includes at least a network port whose usage frequency is greater than a second frequency threshold, the access mode information includes at least access time distribution information of the network configuration policy, and the communication volume information includes at least a communication volume range of the network configuration policy, wherein the first frequency threshold is the same as or different from the second frequency threshold.

7. The method according to claim 1, characterized in that The adjusting the abnormal configuration information of the abnormal network configuration policy based on the policy verification rule includes: Based on the policy verification rule, generating policy adjustment information of the abnormal network configuration policy, wherein the policy adjustment information is used to adjust the abnormal configuration information in the abnormal network configuration policy; Based on the policy adjustment information, the abnormal configuration information of the abnormal network configuration policy is adjusted.

8. The method according to any one of claims 1 to 7, characterized in that: The network device includes at least one of the following: a vertical encryption device, a firewall device and a switch device.

9. A device for adjusting a network configuration strategy, characterized in that: Applied in a power monitoring system, the device comprises: An acquisition unit, configured to acquire a network configuration policy set of a network device in the power monitoring system, wherein the network configuration policy in the network configuration policy set is used to represent a rule for enabling data in the power monitoring system to be securely transmitted in the network device; An extracting unit, configured to extract a target network configuration policy from the network configuration policy set, wherein the target network configuration policy is used to indicate a network configuration policy in the network configuration policy set whose usage frequency is lower than a frequency threshold; an identification unit, configured to identify an abnormal network configuration policy in the target network configuration policy based on a policy verification rule, wherein the policy verification rule is used to indicate a rule for verifying the network configuration policy, and the abnormal network configuration policy is used to at least indicate a network configuration policy with a security vulnerability; An adjusting unit is used to adjust the abnormal configuration information of the abnormal network configuration policy based on the policy verification rule.

10. A computer-readable storage medium, characterized in that: The computer-readable storage medium includes a stored program, wherein when the program is executed by a processor, the device where the storage medium is located is controlled to execute the method according to any one of claims 1 to 8.

Images