Network security isolation method, computer device and storage medium

Abstract

The invention discloses a network security isolation method, a computer device and a storage medium, and the method comprises the steps: carrying out the feature extraction of network monitoring data based on a quantum computing framework, and obtaining target feature data; the quantum machine learning model is utilized to determine whether security threats exist in the target network according to the target feature data, complex threat modes can be captured in a higher dimension, potential threats can be rapidly detected, and threat detection can be more accurately and efficiently carried out. If the security threat exists, the influence object of the security threat is determined, and the isolation strategy is generated according to the type of the influence object, so that the isolation strategy is dynamically generated, the isolation strategy better conforms to the characteristics of the influence object, the effectiveness of the isolation strategy is improved, and if the security threat is cleared, repair operation is performed on the influence object based on a self-healing mechanism. The flexibility and the self-adaptive capability of the system can be improved, and the continuity of services can be improved.

Description

Technical Field

[0001] The present application relates to the field of network security technology, and in particular to a network security isolation method, a computer device, and a storage medium. Background Art

[0002] As network attack methods become increasingly complex and diverse, traditional network security isolation methods that rely on static isolation strategies and rules have become unable to cope with rapidly changing and emerging threats, reducing the reliability of network protection. Summary of the invention

[0003] The embodiments of the present application provide a network security isolation method, a computer device, and a storage medium, which perform feature extraction on network monitoring data based on a quantum computing framework to obtain target feature data; utilize a quantum machine learning model to determine whether there is a security threat in the target network based on the target feature data, so as to perform threat detection more accurately and efficiently.

[0004] In a first aspect, a network security isolation method is provided, comprising: collecting network monitoring data from a target network according to a target data type; performing feature extraction on the network monitoring data based on a quantum computing framework to obtain target feature data; using a quantum machine learning model to determine whether there is a security threat in the target network according to the target feature data; if the security threat exists, determining an affected object of the security threat, and generating an isolation strategy according to the type of the affected object; performing an isolation operation on the affected object according to the isolation strategy; and if the security threat is cleared, performing a repair operation on the affected object based on a self-healing mechanism.

[0005] In a second aspect, a computer-readable storage medium is provided, on which a computer program / instruction is stored. When the computer program / instruction is executed by a processor, the steps of the network security isolation method described in the first aspect are implemented.

[0006] According to a third aspect, a computer program product is provided, comprising a computer program / instruction, which, when executed by a processor, implements the steps of the network security isolation method as described in the first aspect.

[0007] By applying the above technical solutions, the network monitoring data is feature extracted based on the quantum computing framework to obtain the target feature data; the quantum machine learning model is used to determine whether there is a security threat in the target network based on the target feature data, which can capture complex threat patterns in a higher dimension and quickly detect potential threats, thereby achieving more accurate and efficient threat detection. If there is a security threat, the affected object of the security threat is determined, and an isolation strategy is generated according to the type of the affected object. The isolation strategy is dynamically generated to make the isolation strategy more in line with the characteristics of the affected object, thereby improving the effectiveness of the isolation strategy. If the security threat is cleared, the affected object is repaired based on the self-healing mechanism, which can improve the elasticity and adaptability of the system and improve business continuity. BRIEF DESCRIPTION OF THE DRAWINGS

[0008] In order to more clearly illustrate the technical solution of the present application, the drawings required for use in the description of the embodiments will be briefly introduced below. Obviously, the drawings described below are only some embodiments recorded in the present application. For ordinary technicians in this field, other drawings can be obtained based on these drawings without paying any creative labor.

[0009] Figure 1 This is a flow chart of the network security isolation method according to an embodiment of the present application;

[0010] Figure 2 This is a flow chart of a network security isolation method according to another embodiment of the present application;

[0011] Figure 3 A flowchart for determining a quantum machine learning model according to an embodiment of the present application;

[0012] Figure 4 A flowchart of updating a quantum machine learning model according to an embodiment of the present application;

[0013] Figure 5 This is a schematic diagram of the zero trust architecture;

[0014] Figure 6 4 is a structural block diagram of a computer device according to an embodiment of the present application. DETAILED DESCRIPTION

[0015] Various aspects and features of the present application are described herein with reference to the accompanying drawings.

[0016] It should be understood that various modifications may be made to the embodiments of the present application. Therefore, the above description should not be considered as limiting, but only as an example of an embodiment. Other modifications within the scope and spirit of the present application will occur to those skilled in the art.

[0017] The accompanying drawings, which are incorporated in and constitute a part of the specification, illustrate embodiments of the present application and, together with the general description of the present application given above and the detailed description of the embodiments given below, serve to explain the principles of the present application.

[0018] These and other characteristics of the present application will become apparent from the following description of a preferred form of embodiment given as a non-limiting example with reference to the accompanying drawings.

[0019] It should also be understood that although the present application has been described with reference to some specific examples, those skilled in the art will be able to readily implement many other equivalent forms of the present application.

[0020] The above and other aspects, features and advantages of the present application will become more apparent in view of the following detailed description when taken in conjunction with the accompanying drawings.

[0021] Specific embodiments of the present application are described hereinafter with reference to the accompanying drawings; however, it should be understood that the embodiments applied for are merely examples of the present application, which may be implemented in a variety of ways. Well-known and / or repeated functions and structures are not described in detail to avoid unnecessary or redundant details that obscure the present application. Therefore, the specific structural and functional details applied for herein are not intended to be limiting, but merely serve as a basis and representative basis for the claims to teach those skilled in the art to use the present application in a variety of ways with substantially any suitable detailed structure.

[0022] This specification may use the phrases "in one embodiment," "in another embodiment," "in yet another embodiment," or "in other embodiments," all of which may refer to one or more of the same or different embodiments according to the present application.

[0023] A network security isolation method in an embodiment of the present application extracts features from network monitoring data based on a quantum computing framework to obtain target feature data; a quantum machine learning model is used to determine whether there is a security threat in the target network based on the target feature data, which can capture complex threat patterns in a higher dimension and quickly detect potential threats, thereby achieving more accurate and efficient threat detection. If there is a security threat, the affected object of the security threat is determined, and an isolation strategy is generated based on the type of the affected object to achieve dynamic generation of the isolation strategy, so that the isolation strategy is more in line with the characteristics of the affected object, thereby improving the effectiveness of the isolation strategy, and if the security threat is cleared, a repair operation is performed on the affected object based on a self-healing mechanism, which can improve the elasticity and adaptability of the system and improve business continuity.

[0024] like Figure 1 As shown, the following steps are included:

[0025] Step S101, collecting network monitoring data from a target network according to a target data type.

[0026] In this embodiment, the target data type can be determined according to the tasks or activities existing in the target network, and the target data type may include one or more data types such as network traffic, user behavior logs, system events, etc. Specifically, network monitoring data that meets the target data type can be collected by writing data collection scripts, deploying sensors, agents or data collectors, or using API interfaces, etc., to ensure comprehensive coverage of all activities in the target network.

[0027] In some embodiments of the present application, after obtaining the network monitoring data, the network monitoring data is also preprocessed to improve the accuracy of the network monitoring data. Preprocessing may include, for example, cleaning, standardization, noise reduction, and feature extraction. Specifically, algorithms such as denoising algorithms, feature scaling algorithms, and feature extraction algorithms may be used to clean, deduplicate, normalize, and convert data to ensure the quality and consistency of the network monitoring data.

[0028] Step S102: extracting features from the network monitoring data based on a quantum computing framework to obtain target feature data.

[0029] In this embodiment, the network monitoring data is input into the quantum computing framework, and based on the characteristics of quantum superposition and quantum entanglement of the quantum computing framework, useful characteristic patterns (such as potential attack characteristics) are quickly found to obtain target characteristic data.

[0030] Step S103, using a quantum machine learning model to determine whether there is a security threat in the target network according to the target feature data.

[0031] In this embodiment, a quantum machine learning model for threat detection is pre-trained. The quantum machine learning model combines the unique characteristics of quantum computing (such as quantum superposition, quantum entanglement, etc.) with the pattern recognition ability of classical machine learning, so that it can achieve faster processing speed and better performance than traditional machine learning algorithms in solving specific problems. Quantum machine learning models may include any of the models such as quantum support vector machine (Quantum SVM) and quantum neural network (QNN). The embodiment of the present application can capture complex threat patterns in higher dimensions through the quantum machine learning model, and can even identify minor anomalies in advanced persistent threats (APT). The efficient processing capability of quantum algorithms can perform detailed analysis of real-time traffic in isolated systems and detect potential attack behaviors in advance.

[0032] The target feature data is input into the quantum machine learning model, and the output results of the quantum machine learning model are used to determine whether there are security threats in the target network. The quantum machine learning model can automatically classify and identify different types of security threats, such as malware attacks, abnormal traffic, denial of service attacks (DDoS), unauthorized access, data leakage, etc.

[0033] Step S104: If the security threat exists, determine the affected object of the security threat, and generate an isolation strategy according to the type of the affected object.

[0034] In this embodiment, the type of the affected object may include any of the types of application, device, operating system, network area, etc. For example, the affected object may be one or more applications, one or more devices, or one or more network areas. An isolation policy is generated according to the type of the affected object to isolate the affected object.

[0035] Step S105: performing an isolation operation on the affected object according to the isolation strategy.

[0036] Perform isolation operations on the affected objects according to the isolation policy to prevent the security threat from spreading to other applications, other devices, other network areas, etc. The isolation operation may include one or more of adjusting the network partition of the affected object, adjusting the firewall configuration of the affected object, performing logical isolation on the affected object, and adjusting the access control policy of the affected object.

[0037] Step S106: If the security threat is eliminated, a repair operation is performed on the affected object based on a self-healing mechanism.

[0038] In this embodiment, a self-healing mechanism is established in advance. If the security threat is removed, a repair operation is performed on the affected object based on the self-healing mechanism. Specifically, the self-healing mechanism will reintegrate the previously isolated affected object into the system to ensure normal operation. This process will undergo strict security verification to ensure that the system is in a safe state, significantly improving the elasticity and adaptability of the system. After the security threat is removed, the self-healing mechanism can quickly restore the normal operation of the isolated affected object, help the network to automatically recover when attacked or fails, maintain the security and normal operation of the system, and ensure the continuity of key services.

[0039] The network security isolation method of the embodiment of the present application collects network monitoring data from the target network according to the target data type, extracts features from the network monitoring data based on the quantum computing framework, and obtains target feature data; uses the quantum machine learning model to determine whether there is a security threat in the target network based on the target feature data, which can capture complex threat patterns in a higher dimension and quickly detect potential threats, thereby achieving more accurate and efficient threat detection. If there is a security threat, determine the affected object of the security threat, generate an isolation strategy based on the type of the affected object, and dynamically generate an isolation strategy, so that the isolation strategy is more in line with the characteristics of the affected object, thereby improving the effectiveness of the isolation strategy, and if the security threat is cleared, perform a repair operation on the affected object based on the self-healing mechanism, which can improve the elasticity and adaptability of the system and improve business continuity.

[0040] In some embodiments of the present application, performing a repair operation on the affected object based on a self-healing mechanism includes at least one of the following:

[0041] Identify and replace tampered system files in the affected object;

[0042] Automatically restore the security configuration of the affected object;

[0043] If the security threat is malware or a virus, automatically clear or quarantine infected files in the affected object;

[0044] If the security threat is a system vulnerability, a patch corresponding to the system vulnerability is automatically applied to the affected object.

[0045] In this embodiment, if there are tampered system files in the affected object, the self-healing mechanism can identify and replace the tampered system files, thereby restoring the system files of the affected object to normal. If the security configuration of the affected object has changed, the self-healing mechanism can automatically restore the security configuration. If the security threat is malware or a virus, the self-healing mechanism can automatically clear or isolate the infected files in the affected object. If the security threat is a system vulnerability, the self-healing mechanism can automatically apply a patch corresponding to the system vulnerability in the affected object to repair the corresponding system vulnerability.

[0046] It is understandable that, depending on the degree of security threats, the repair operations performed on the affected object based on the self-healing mechanism can be one or more. For example, after the security threat is cleared, for an affected object, the self-healing mechanism identifies and replaces the tampered system files in the affected object, and automatically restores the security configuration of the affected object. Alternatively, if the security threat is malware or a virus, and there are tampered system files and infected files in the affected object, the self-healing mechanism identifies and replaces the tampered system files in the affected object, and automatically clears or isolates the infected files in the affected object.

[0047] By adopting at least one of a plurality of repair operations to perform a modification operation on the affected object, a more flexible and accurate repair operation can be performed on the affected object.

[0048] In some embodiments of the present application, generating an isolation strategy according to the type of the affected object includes:

[0049] If the type of the affected object is a device or an application, the isolation strategy includes isolating the affected object from other systems to prevent the security threat from spreading to other parts of the network;

[0050] If the type of the affected object is a network area, the isolation strategy includes creating a virtual isolation area for isolating the network area, so as to isolate the network area.

[0051] In this embodiment, the types of affected objects include devices, applications, network areas, etc. If the type of the affected object is a device or an application, the corresponding device or application needs to be isolated to prevent the security threat from spreading to other parts of the network. If the type of the affected object is a network area, the corresponding network area needs to be isolated. Specifically, a virtual isolation zone for isolating the network area is created to isolate the network area.

[0052] By adopting corresponding isolation strategies according to the types of affected objects, the isolation strategies are matched with the characteristics of the affected objects, thus ensuring the effectiveness of the isolation strategies.

[0053] In some embodiments of the present application, after performing an isolation operation on the affected object according to the isolation strategy, such as Figure 2 As shown, the following steps are also included:

[0054] Step S107, collecting isolated network data related to the affected object.

[0055] In this embodiment, the isolated network data may include one or more data types such as network traffic, user behavior logs, system events, etc. related to the affected object, so as to evaluate the isolation effect and the impact on normal business based on the isolated network data.

[0056] Step S108: If the isolated network data meets the policy adjustment condition, adjust the isolation policy.

[0057] In this embodiment, the policy adjustment condition may include at least one of the following: abnormal network data related to the affected object still exists in the network data after isolation; the network data after isolation represents the impact on normal business. Adjusting the isolation policy includes at least one of the following: performing further isolation operations; adjusting the isolation scope corresponding to the isolation policy.

[0058] By adjusting the isolation policy when the network data after isolation meets the policy adjustment conditions, dynamic adjustment of the isolation policy is achieved, making the isolation policy more in line with the actual situation of the affected object or the current network environment, thereby ensuring the effectiveness and accuracy of the isolation policy.

[0059] In some embodiments of the present application, Figure 3 As shown, the determination process of the quantum machine learning model includes the following steps:

[0060] Step S201, obtaining historical network data within a preset time period.

[0061] In this embodiment, the quantum machine learning model is obtained by training the initial quantum machine learning model using historical network data within a preset time period. The preset time period may be, for example, one month or half a month. The historical network data may include one or more data types such as network traffic, user behavior logs, and system events. The historical network data may be collected by writing data collection scripts, deploying sensors, agents, or data collectors, or using API interfaces.

[0062] Step S202, preprocessing the historical network data according to the target preprocessing process to generate a training data set.

[0063] In this embodiment, the data quality and consistency of the historical network data can be guaranteed by preprocessing the historical network data according to the target preprocessing process. Preprocessing may include cleaning, standardization, noise reduction and feature extraction, and specifically, algorithms such as denoising algorithms, feature scaling algorithms, and feature extraction algorithms may be used to clean, deduplicate, normalize and convert data. After the preprocessing of the historical network data is completed, a training data set is generated, and the training data set includes normal behavior samples and known attack samples.

[0064] Step S203: extract features from the training data set based on the quantum computing framework to obtain sample target feature data.

[0065] In this embodiment, the training data set is input into the quantum computing framework, and features of the training data set are extracted based on the characteristics of quantum superposition and quantum entanglement of the quantum computing framework to obtain sample target feature data.

[0066] Step S204: Based on the target quantum algorithm, the initial quantum machine learning model is trained according to the sample target feature data.

[0067] In this embodiment, after obtaining the sample target feature data, the sample target feature data is input into the initial quantum machine learning model, and the initial quantum machine learning model is trained based on the target quantum algorithm.

[0068] The target quantum algorithm may be a quantum search algorithm, which is a new type of algorithm that uses quantum mechanical properties for calculations and can efficiently search for specific elements in an unordered database. The quantum search algorithm may be, for example, the Grover algorithm. Training the initial quantum machine learning model based on the target quantum algorithm can find the global optimal solution in a shorter time, thereby accelerating the convergence of the initial quantum machine learning model.

[0069] Step S205, when the training completion condition is met, the quantum machine learning model is obtained.

[0070] In this embodiment, the training completion condition may be that a target number of iterations is reached, or that the recognition accuracy of the model reaches a target accuracy, etc.

[0071] The training data set is feature extracted through the quantum computing framework, and the initial quantum machine learning model is trained according to the sample target feature data based on the target quantum algorithm, achieving efficient and accurate determination of the quantum machine learning model.

[0072] In some embodiments of the present application, after performing an isolation operation on the affected object according to the isolation strategy, such as Figure 4 As shown, the following steps are also included:

[0073] Step S206, collecting feedback data after the isolation operation is performed, wherein the feedback data includes at least one of the isolation success rate, false alarm rate, and missed alarm rate.

[0074] In this embodiment, after performing an isolation operation on the affected object according to the isolation strategy, feedback data is collected, and the quantum machine learning model is subsequently updated through the feedback data. The feedback data includes at least one of the isolation success rate, false alarm rate, and missed alarm rate.

[0075] Step S207: adding the feedback data to the training data set to generate a new training data set.

[0076] In this embodiment, the feedback data is added to the training data set to generate a new training data set, so that the new training data set covers the data related to the current isolation operation.

[0077] Step S208: retrain the quantum machine learning model based on the new training data set to update the quantum machine learning model.

[0078] In this embodiment, feature extraction is performed on a new training data set based on a quantum computing framework to obtain new sample target feature data. Based on a target quantum algorithm, the quantum machine learning model is retrained according to the new sample target feature data to optimize the parameters of the quantum machine learning model, thereby updating the quantum machine learning model.

[0079] By generating new training data sets from the feedback data after the isolation operation, the quantum machine learning model can be continuously optimized, allowing the quantum machine learning model to adapt to new threat forms and improving the quantum machine learning model's ability to identify and respond to security threats.

[0080] In some embodiments of the present application, the isolation strategy complies with the zero trust architecture.

[0081] In this embodiment, under the zero-trust architecture, it is assumed that there may be threats both inside and outside the network, and no network traffic, devices or users inside or outside the network are trusted, and all access must be authenticated and authorized. Through the zero-trust architecture, network security isolation is strengthened, and the security of the network is significantly enhanced through refined access management, dynamic monitoring and continuous verification. Any device or user must go through a strict verification process before accessing network resources, thereby further improving the effectiveness of the isolation strategy.

[0082] like Figure 5 The following is a schematic diagram of the zero trust architecture: Figure 5 As shown in the figure, the subject / device initiates an access request to the target resource through the core components of the zero trust architecture. Subjects / devices include users, devices, cooperative subjects, other assets / subjects, etc., and target resources include applications, data centers, cloud services, and other enterprise resources.

[0083] The core components of the zero-trust architecture include the control and management module and the policy enforcement point. Among them, the control and management module consists of identity authentication, policy engine and policy manager. Identity authentication is used to verify the identity of the subject / device and determine whether its identity is legal. The policy engine is mainly responsible for comprehensively analyzing multi-dimensional risk information and ultimately deciding whether to grant the specified access subject access to the object; the policy manager is responsible for establishing a logical connection between the access subject and the object, generating the subject's credentials for accessing the object, and communicating with the policy enforcement point to execute the policy through the policy enforcement point. The policy enforcement point determines whether to allow the subject / device to access the target resources based on the policy issued by the policy manager. Multiple components can act as policy enforcement points, such as terminal agents, gateways, etc.

[0084] In some embodiments of the present application, after performing a repair operation on the affected object based on the self-healing mechanism, it also includes: recording operation data related to all threat detection, policy generation, and isolation execution, and using the operation data to generate auditable logs. Use a log management system (such as SIEM) to record and store all relevant activity logs to ensure the transparency and traceability of system operations; regularly design and analyze logs through security audit tools and AI analysis to identify potential weaknesses in the system and provide optimization suggestions.

[0085] The network security isolation method of the embodiment of the present application can ensure that the system can be seamlessly integrated with the enterprise's existing security infrastructure (such as firewalls, IDS / IPS, SIEM) by using open APIs, modular design and compatibility protocols, and can work together with traditional security tools to form a more powerful defense system.

[0086] For example, the target network can be the intranet of a bank, and the network monitoring data can be the traffic between various branches and departments. Based on the quantum computing framework, the traffic between various branches and departments is feature extracted to obtain target feature data; using the quantum machine learning model, determine whether there are security threats in the bank's intranet based on the target feature data; if an abnormal traffic pattern of a branch is detected (possibly caused by malware infection), the network of the branch is automatically isolated and its traffic is directed to the isolation area to prevent the threat from spreading to the entire bank network. If the security threat is eliminated, the infected files in the affected object are automatically cleared or isolated, and the corresponding security configuration is restored. At the same time, the network data after isolation is collected, and the isolation strategy is dynamically adjusted according to the business needs of different departments to ensure that normal business is not affected.

[0087] The target network can also be a cloud computing platform, where different tenants usually share the same physical resources, but the data and applications of each tenant need to be strictly isolated to prevent data leakage or cross-tenant attacks. Network monitoring data can be the network behavior volume of each tenant. Based on the quantum computing framework, the network behavior of each tenant is feature extracted to obtain the target feature data; using the quantum machine learning model, it is determined whether there is a security threat in the bank's intranet based on the target feature data; if a tenant's application has abnormal traffic (such as DDoS attack), the tenant will be automatically isolated and its access to shared resources will be restricted. If the security threat is cleared, the tampered system files of the corresponding tenant are identified and replaced based on the self-healing mechanism. At the same time, the network data after isolation is collected, and the isolation strategy is dynamically adjusted according to the network data after isolation to adapt to the dynamic needs of each tenant and ensure the overall security and stability of the cloud platform.

[0088] The target network can also be an enterprise network. Large enterprises usually have multiple departments and branches. How to prevent malicious behavior of internal employees or lateral movement of external attackers after intrusion is an important challenge for enterprise network security. Network monitoring data can be the network behavior of employees. Based on the quantum computing framework, the network behavior of each employee is extracted to obtain target feature data; using the quantum machine learning model, it is determined whether there is a security threat in the bank's intranet based on the target feature data; if abnormal activities are detected (such as data leakage attempts or unauthorized access), the terminal devices of the relevant employees will be automatically isolated and their access rights will be restricted. If the security threat is cleared, the security configuration of the terminal devices of the relevant employees will be automatically restored based on the self-healing mechanism. At the same time, the network data after isolation is collected, and the isolation strategy is dynamically adjusted according to the collected network data after isolation, balancing security needs and business efficiency to ensure the overall security of the enterprise network.

[0089] The network security isolation method of the present application embodiment can have the following beneficial effects:

[0090] 1) Enhanced accuracy of threat detection: With the introduction of quantum machine learning models, network threats can be more accurately identified and classified, especially when dealing with complex and new threats. Quantum machine learning models can discover abnormal patterns and identify hidden threats by learning from large amounts of data. For example, quantum machine learning models can detect zero-day attacks and advanced persistent threats (APTs), which are usually not detected by traditional detection methods.

[0091] 2) Real-time dynamic response and automated isolation: Quantum machine learning models enable network security systems to automatically perform isolation operations the moment a threat is detected, without human intervention. This real-time response capability effectively shortens the time an attacker exists in the network and prevents the threat from spreading further. Once abnormal traffic in the network is detected, the system can automatically isolate the infected device or user to prevent the attacker from further invading the network through lateral movement.

[0092] 3) Reduce human errors and improve operational efficiency: Automated threat detection and isolation reduces reliance on manual judgment, thereby reducing the risk of human error. At the same time, the system can run 24 / 7 without interruption to ensure the continued effectiveness of network security measures. In complex enterprise networks, quantum machine learning models can replace security experts to complete many heavy monitoring and response tasks, improving overall operation and maintenance efficiency.

[0093] 4) Continuous learning and adaptation to new threats: Quantum machine learning models can autonomously update and optimize detection strategies over time by continuously learning new network data and threat intelligence. This continuous learning capability enables the system to adapt to new and evolving network threats. When faced with a new attack method, the system can analyze the characteristics of the attack method and update the existing detection and isolation strategy to ensure that similar threats can be effectively dealt with in the future.

[0094] 5) Improve the comprehensiveness and scalability of network security: Quantum machine learning models can integrate multiple data sources and security tools to form a comprehensive security protection system that is suitable for network environments of different sizes and complexities. The scalability of this approach ensures that both small businesses and large organizations can deploy effective network security isolation solutions. In large-scale enterprise networks or cloud computing environments, quantum machine learning models can monitor and isolate threats from multiple regions or tenants in real time to ensure the security of the overall network.

[0095] 6) Improved internal threat protection capabilities: Quantum machine learning models can better monitor and analyze internal user behavior, detect potential internal threats, and take timely isolation measures. This helps prevent malicious behavior by insiders or security incidents caused by compromised internal devices. When the system detects abnormal behavior of an internal user, it can quickly reduce the user's access rights to a minimum, protecting sensitive data from potential threats.

[0096] The embodiment of the present application also proposes a network security isolation device, including: a collection module, used to collect network monitoring data from a target network according to a target data type; an acquisition module, used to extract features from the network monitoring data based on a quantum computing framework to obtain target feature data; a determination module, used to use a quantum machine learning model to determine whether there is a security threat in the target network according to the target feature data; a generation module, used to determine the affected object of the security threat if the security threat exists, and generate an isolation strategy according to the type of the affected object; an isolation module, used to perform an isolation operation on the affected object according to the isolation strategy; and a self-healing module, used to perform a repair operation on the affected object based on a self-healing mechanism if the security threat is cleared.

[0097] The network security isolation device of the embodiment of the present application extracts features from network monitoring data based on a quantum computing framework to obtain target feature data; uses a quantum machine learning model to determine whether there is a security threat in the target network based on the target feature data, can capture complex threat patterns in a higher dimension, and can quickly detect potential threats, thereby achieving more accurate and efficient threat detection. If there is a security threat, determine the affected object of the security threat, generate an isolation strategy based on the type of the affected object, and dynamically generate an isolation strategy, so that the isolation strategy is more in line with the characteristics of the affected object, thereby improving the effectiveness of the isolation strategy, and if the security threat is cleared, perform a repair operation on the affected object based on the self-healing mechanism, which can improve the elasticity and adaptability of the system and improve business continuity.

[0098] In a specific application scenario, the self-healing module is specifically used to execute at least one of the following: identifying and replacing tampered system files in the affected object; automatically restoring the security configuration of the affected object; if the security threat is malware or a virus, automatically clearing or isolating the infected files in the affected object; if the security threat is a system vulnerability, automatically applying a patch corresponding to the system vulnerability in the affected object.

[0099] In a specific application scenario, the generation module is specifically used for: if the type of the affected object is a device or application, the isolation strategy includes isolating the affected object from other systems to prevent the security threat from spreading to other parts of the network; if the type of the affected object is a network area, the isolation strategy includes creating a virtual isolation area for isolating the network area to isolate the network area.

[0100] In a specific application scenario, an adjustment module is also included, which is used to: collect isolated network data related to the affected object; if the isolated network data meets the policy adjustment conditions, adjust the isolation policy.

[0101] In a specific application scenario, the determination process of the quantum machine learning model includes: obtaining historical network data within a preset time length; preprocessing the historical network data according to the target preprocessing process to generate a training data set; extracting features of the training data set based on the quantum computing framework to obtain sample target feature data; based on the target quantum algorithm, training the initial quantum machine learning model according to the sample target feature data; and obtaining the quantum machine learning model when the training completion conditions are met.

[0102] In a specific application scenario, an update module is also included, which is used to: collect feedback data after performing the isolation operation, wherein the feedback data includes at least one of the isolation success rate, false alarm rate, and missed alarm rate; add the feedback data to the training data set to generate a new training data set; and re-train the quantum machine learning model based on the new training data set to update the quantum machine learning model.

[0103] In a specific application scenario, the isolation strategy complies with the zero-trust architecture.

[0104] The present application also provides a computer device, such as Figure 6 As shown, it includes a memory, a processor and a computer program stored in the memory, and the processor executes the computer program to implement the steps of the network security isolation method as described in the various embodiments of the present application.

[0105] The computer device in the embodiment of the present application may be a terminal, or may be other devices other than a terminal. Exemplarily, the computer device may be a mobile phone, a tablet computer, a laptop computer, a PDA, an in-vehicle electronic device, a mobile Internet device (MID), an augmented reality (AR) / virtual reality (VR) device, a robot, a wearable device, an ultra-mobile personal computer (UMPC), a netbook or a personal digital assistant (PDA), etc. It may also be a server, a network attached storage (NAS), a personal computer (PC), a television (TV), a teller machine or a self-service machine, etc., which is not specifically limited in the embodiment of the present disclosure.

[0106] The memory may include a RAM (Random Access Memory) or a non-volatile memory, such as at least one disk memory. Optionally, the memory may also be at least one storage device located away from the aforementioned processor.

[0107] The above-mentioned processor can be a general-purpose processor, including CPU, NP (Network Processor), etc.; it can also be DSP (Digital Signal Processing), ASIC (Application Specific Integrated Circuit), FPGA (Field Programmable Gate Array) or other programmable logic devices, discrete gate or transistor logic devices, discrete hardware components.

[0108] An embodiment of the present application further proposes a computer-readable storage medium on which a computer program / instruction is stored. When the computer program / instruction is executed by a processor, the steps of the network security isolation method as described in the various embodiments of the present application are implemented.

[0109] An embodiment of the present application also proposes a computer program product, including a computer program / instruction, which, when executed by a processor, implements the steps of the network security isolation method described in each embodiment of the present application.

[0110] In the above embodiments, it can be implemented in whole or in part by software, hardware, firmware or any combination thereof. When implemented using software, it can be implemented in whole or in part in the form of a computer program product. The computer program product includes one or more computer instructions. When the computer program instructions are loaded and executed on a computer, the process or function described in the embodiment of the present application is generated in whole or in part. The computer can be a general-purpose computer, a special-purpose computer, a computer network, or other programmable devices. The computer instructions can be stored in a computer-readable storage medium, or transmitted from one computer-readable storage medium to another computer-readable storage medium. For example, the computer instructions can be transmitted from a website site, computer, server or data center by wired (e.g., coaxial cable, optical fiber, digital subscriber line) or wireless (e.g., infrared, wireless, microwave, etc.) mode to another website site, computer, server or data center. The computer-readable storage medium can be any available medium that a computer can access or a data storage device such as a server or data center that includes one or more available media integration. The available medium can be a magnetic medium, (e.g., a floppy disk, a hard disk, a tape), an optical medium (e.g., a DVD), or a semiconductor medium (e.g., a solid-state hard disk), etc.

[0111] The above embodiments are only exemplary embodiments of the present application and are not intended to limit the present application. The protection scope of the present application is defined by the claims. Those skilled in the art may make various modifications or equivalent substitutions to the present application within the essence and protection scope of the present application, and such modifications or equivalent substitutions shall also be deemed to fall within the protection scope of the present application.

Claims

1. A network security isolation method, characterized in that: include: Collect network monitoring data from the target network according to the target data type; Extracting features from the network monitoring data based on a quantum computing framework to obtain target feature data; Using a quantum machine learning model, determining whether there is a security threat in the target network according to the target feature data; If the security threat exists, determining an affected object of the security threat, and generating an isolation strategy according to the type of the affected object; Performing an isolation operation on the affected object according to the isolation strategy; If the security threat is eliminated, a repair operation is performed on the affected object based on a self-healing mechanism.

2. The network security isolation method according to claim 1, characterized in that: Performing a repair operation on the affected object based on the self-healing mechanism includes at least one of the following: Identify and replace tampered system files in the affected object; Automatically restore the security configuration of the affected object; If the security threat is malware or a virus, automatically clear or quarantine infected files in the affected object; If the security threat is a system vulnerability, a patch corresponding to the system vulnerability is automatically applied to the affected object.

3. The network security isolation method according to claim 1, characterized in that: An isolation strategy is generated according to the type of the affected object, including: If the type of the affected object is a device or an application, the isolation strategy includes isolating the affected object from other systems to prevent the security threat from spreading to other parts of the network; If the type of the affected object is a network area, the isolation strategy includes creating a virtual isolation area for isolating the network area, so as to isolate the network area.

4. The network security isolation method according to claim 1, characterized in that: After performing the isolation operation on the affected object according to the isolation strategy, the method further includes: Collecting post-isolation network data related to the affected object; If the isolated network data meets the policy adjustment condition, the isolation policy is adjusted.

5. The network security isolation method according to claim 1, characterized in that: The process of determining the quantum machine learning model includes: Get historical network data within a preset time period; Preprocessing the historical network data according to a target preprocessing process to generate a training data set; Perform feature extraction on the training data set based on the quantum computing framework to obtain sample target feature data; Based on the target quantum algorithm, an initial quantum machine learning model is trained according to the sample target feature data; When the training completion conditions are met, the quantum machine learning model is obtained.

6. The network security isolation method according to claim 5, characterized in that: After performing the isolation operation on the affected object according to the isolation strategy, the method further includes: Collecting feedback data after performing the isolation operation, wherein the feedback data includes at least one of an isolation success rate, a false alarm rate, and a missed alarm rate; Adding the feedback data to the training data set to generate a new training data set; The quantum machine learning model is retrained based on the new training data set to update the quantum machine learning model.

7. The network security isolation method according to claim 1, characterized in that: The described isolation strategy is consistent with the Zero Trust architecture.

8. A computer device comprising a memory, a processor and a computer program stored in the memory, characterized in that: The processor executes the computer program to implement the steps of the network security isolation method according to any one of claims 1 to 7.

9. A computer-readable storage medium having a computer program / instruction stored thereon, characterized in that: When the computer program / instructions are executed by a processor, the steps of the network security isolation method as described in any one of claims 1 to 7 are implemented.

10. A computer program product comprising a computer program / instructions, characterized in that When the computer program / instructions are executed by a processor, the steps of the network security isolation method as described in any one of claims 1 to 7 are implemented.

Images