Asset security protection strategy adaptive adjustment method and system

Abstract

The invention discloses an asset security protection strategy adaptive adjustment method and system, and the method comprises the steps: obtaining the first asset information of an on-cloud asset or an under-cloud asset in a mixed cloud environment, and generating a plurality of security protection strategies based on the first asset information; carrying out conflict detection and conflict classification on each security protection strategy to obtain a conflict strategy list, and carrying out real-time association analysis on strategy conflicts and security event logs among assets by utilizing the list to obtain a strategy conflict solution; generating a configuration script based on all the security protection strategies and the corresponding strategy description information; and realizing automatic deployment of the assets by using the configuration script, analyzing the change degree of the current asset scale based on the second asset information of the assets subjected to automatic deployment, and dynamically adjusting the security protection strategy if the change degree is greater than a preset value. By adopting the embodiment of the invention, the potential conflict of the strategy can be quickly positioned, and the strategy is adaptively adjusted, so that the asset security is improved.

Description

Technical Field

[0001] The present invention relates to the technical field of security protection strategy adjustment, and in particular to a method and system for adaptively adjusting asset security protection strategies. Background Art

[0002] In the process of risk protection of cloud assets, due to the diversity of asset types and business scenarios, it is usually necessary to formulate multiple protection strategies to deal with different risks. However, as the number of strategies increases, conflicts may arise between strategies, resulting in a decrease in the protection effect or even offsetting each other. For example, for the same cloud host, the intrusion detection strategy may require certain ports to be opened for monitoring, while the access control strategy may require these ports to be closed to reduce the attack surface. More complicated is that multiple protection strategies may cross-act on the same batch of assets, and the correlation and impact between them are difficult to intuitively identify and characterize. Therefore, there is an urgent need for an automated policy conflict detection mechanism that can comprehensively analyze existing protection strategies, accurately locate various conflicts, and provide intuitive conflict descriptions and repair suggestions, so as to provide decision support for security administrators, eliminate policy blind spots, and improve the overall protection level of cloud assets. Summary of the invention

[0003] The embodiments of the present invention provide a method and system for adaptively adjusting asset security protection strategies, which can quickly identify potential conflicts in positioning strategies and adaptively adjust asset security protection strategies in response to changes in asset scale, so as to improve the response speed and processing capabilities to security incidents.

[0004] In order to solve the above technical problems, an embodiment of the present invention provides a method for adaptively adjusting an asset security protection strategy, comprising:

[0005] Acquire first asset information of an asset to be processed in a hybrid cloud environment, and generate multiple security protection strategies corresponding to the asset to be processed based on the first asset information; wherein the asset to be processed is an on-cloud asset or an off-cloud asset;

[0006] Perform conflict detection and conflict classification on each of the security protection strategies to obtain a corresponding conflict strategy list, and use the conflict strategy list to perform real-time correlation analysis on the strategy conflicts between assets and security event logs to obtain a strategy conflict solution;

[0007] Using a policy orchestration engine, combining all the security protection policies and the policy description information corresponding to all the security protection policies, to generate corresponding configuration scripts;

[0008] Based on the configuration script, control the asset to be processed to be automatically deployed, and obtain second asset information of the asset to be processed that has completed the automatic deployment;

[0009] Based on the second asset information, the degree of change in the asset size of the current assets to be processed is analyzed. If the degree of change is greater than a preset value, the security protection strategy of the current assets to be processed is dynamically adjusted.

[0010] By implementing the embodiment of the present invention, first asset information of an on-cloud asset or an off-cloud asset in a hybrid cloud environment is obtained, and based on the first asset information, multiple security protection policies corresponding to the asset are generated, and then conflict detection and conflict classification are performed on each security protection policy to obtain a corresponding conflict policy list, and the background and impact of security incidents on policy conflicts are fully considered. The conflict policy list is used to perform real-time correlation analysis between policy conflicts and security event logs between assets to obtain a policy conflict resolution solution to improve the effectiveness of the policy conflict resolution solution, and by performing conflict detection, conflict classification and real-time correlation analysis on security policies, potential conflicts in positioning policies can be quickly identified, thereby improving the response speed and processing capabilities to security incidents. In addition, a policy orchestration engine is used to combine all security protection policies and the policy description information corresponding to all security protection policies to generate corresponding configuration scripts, which greatly improves the deployment efficiency of asset security protection policies and reduces manual intervention and operational errors. Then, based on the configuration script, the asset is controlled for automatic deployment, and the second asset information of the asset that has completed the automatic deployment is obtained. Finally, based on the second asset information, the degree of change in the current asset scale of the asset is analyzed. If the degree of change is greater than the preset value, the current security protection policy of the asset is dynamically adjusted to ensure the security of assets on or off the cloud in different scales and complex environments, so as to enhance the adaptability and flexibility of the system, and reduce security risks caused by human negligence or outdated policies, thereby improving overall security.

[0011] As a preferred solution, the policy orchestration engine is used to generate corresponding configuration scripts by combining all the security protection policies and the policy description information corresponding to all the security protection policies, specifically:

[0012] Using a policy orchestration engine to parse each of the security protection policies and obtain policy description information corresponding to each of the security protection policies;

[0013] Performing syntax analysis and semantic checking on the policy description information corresponding to each of the security protection policies to obtain an intermediate representation of each of the security protection policies;

[0014] The configuration template library of the platform corresponding to the asset to be processed is called, and the configuration script corresponding to the intermediate representation form of each security protection strategy is obtained from the configuration template library.

[0015] The preferred solution of the embodiment of the present invention is implemented to perform syntax analysis and semantic checking on the policy description information corresponding to each security protection policy, ensuring that all security protection policies follow a unified standard format, reducing errors and deviations in policy development and deployment, and improving policy consistency. In addition, by calling the configuration template library of the platform corresponding to the asset to be processed, and obtaining the configuration script corresponding to the intermediate representation of each security protection policy from the configuration template library, it is possible to quickly adapt to different platforms and environments, ensuring the universality and compatibility of the generated configuration script, and reducing platform restrictions.

[0016] As a preferred solution, the first asset information of the asset to be processed in the hybrid cloud environment is obtained, and based on the first asset information, multiple security protection strategies corresponding to the asset to be processed are generated, specifically:

[0017] Acquire first asset information of an asset to be processed in a hybrid cloud environment, and draw a hybrid cloud network topology map based on the first asset information; wherein the hybrid cloud network topology map includes annotations indicating connection relationships between various network areas on and off the cloud;

[0018] Analyze the firewall logs and network traffic of the asset to be processed, and identify the data flow path and key network nodes and data exchange points by combining the analysis results with the hybrid cloud network topology diagram;

[0019] Based on the data flow path, the key network nodes and the data exchange points, generating multiple security protection strategies corresponding to the assets to be processed;

[0020] The security protection strategy includes:

[0021] Based on the key network nodes, deploy a Web application firewall; wherein the Web application firewall selects corresponding protection rules according to the asset location, and the asset location includes on-cloud and off-cloud;

[0022] According to the data flow path, deploy the IBM Guardium database audit tool at the database front end, and implement role-based fine-grained access control through the IBM Guardium database audit tool;

[0023] Dynamically desensitize sensitive data fields and set corresponding desensitization rules for each user role.

[0024] The preferred scheme of implementing the embodiment of the present invention can draw a hybrid cloud network topology diagram to clearly understand the network structure and connection relationship on and off the cloud, so as to more effectively formulate and deploy security protection strategies and improve overall security. Then, the firewall logs and network traffic of the assets to be processed are analyzed, and the analysis results and the hybrid cloud network topology diagram are combined to identify the data flow path and determine the key network nodes and data exchange points, which can help to accurately locate potential threats and vulnerabilities. Then, based on the data flow path, key network nodes and data exchange points, multiple security protection strategies corresponding to the assets to be processed are generated, that is, the security protection strategies can be dynamically adjusted in response to changes in the data flow path, key network nodes and data exchange points to ensure that the strategies always match the current environment, thereby improving the flexibility and adaptability of the strategies. Furthermore, deploying Web application firewalls based on key network nodes and selecting corresponding protection rules according to asset locations can provide fine-grained protection for both on-cloud and off-cloud applications, effectively resisting various attacks on Web applications, and deploying IBM Guardium database auditing tools on the database front end according to the data flow path to implement role-based fine-grained access control, ensuring that only authorized users can access sensitive data, improving data confidentiality and integrity. In addition, dynamic desensitization of sensitive data fields and setting corresponding desensitization rules for different user roles can protect the security of sensitive data and prevent data leakage without affecting business processes.

[0025] As a preferred solution, based on the configuration script, controlling the asset to be processed to be automatically deployed, and obtaining the second asset information of the asset to be processed that has completed the automatic deployment, specifically:

[0026] Transferring the configuration script to the Ansible configuration management tool;

[0027] Generate deployment instructions based on the configuration script through the Ansible configuration management tool, and send the deployment instructions to the asset to be processed;

[0028] When a change in the cloud platform's assets is detected, Nmap is called to identify the changed assets in the cloud platform, and the asset list is updated based on the identification results and the CMDB system. Based on the updated asset list, the second asset information of the current pending assets is obtained.

[0029] The preferred solution of the embodiment of the present invention is implemented. When a change in the assets of the cloud platform is detected, Nmap is called to identify the changed assets in the cloud platform, so that real-time monitoring and detection of assets on the cloud can be achieved, ensuring timely discovery of asset changes, improving the real-time nature of asset management, and combining the identification results with the CMDB (configuration management database) system to update the asset list and asset information, ensuring the accuracy and real-time nature of asset information, and reducing configuration errors caused by lagging asset information. In addition, the configuration script is transmitted to the Ansible configuration management tool, and deployment instructions are generated based on the configuration script, so that the automated deployment of security protection strategies can be achieved, manual operations can be reduced, and deployment efficiency and accuracy can be improved.

[0030] As a preferred solution, based on the second asset information, the change degree of the asset scale of the current asset to be processed is analyzed. If the change degree is greater than a preset value, the security protection strategy of the current asset to be processed is dynamically adjusted, specifically:

[0031] By using an autoregressive integrated moving average model and combining the second asset information, the asset quantity change rate of the current assets to be processed is calculated and the asset change trend of the current assets to be processed is predicted;

[0032] If the asset quantity change rate of the current assets to be processed is greater than the preset value, the security policy evaluation model is started to re-evaluate the security protection strategy, database access control and data encryption measures corresponding to the current assets to be processed, generate new configuration parameter recommendations, and dynamically adjust the security protection strategy of the current assets to be processed; wherein the security policy evaluation model is pre-built based on the random forest algorithm.

[0033] The preferred solution of the embodiment of the present invention is to calculate the asset quantity change rate of the current assets to be processed and predict the asset change trend of the current assets to be processed through the autoregressive integral moving average model combined with the second asset information, which can help enterprises understand the dynamic changes of assets in advance and provide data support for security policy adjustments. If the asset quantity change rate of the current assets to be processed is greater than the preset value, the security policy evaluation model is started to re-evaluate the security protection strategy, database access control and data encryption measures corresponding to the current assets to be processed, generate new configuration parameter recommendations, and dynamically adjust the security protection strategy of the current assets to be processed, so that the security protection strategy can better adapt to asset changes and improve the flexibility and adaptability of the strategy. In addition, the use of the random forest algorithm to pre-construct a security policy evaluation model can comprehensively consider multi-dimensional security factors, provide scientific and comprehensive security policy evaluation, and enhance the scientificity and accuracy of decision-making.

[0034] As a preferred solution, the above mentioned security protection strategies are subjected to conflict detection and conflict classification to obtain a corresponding conflict strategy list, and the conflict strategy list is used to perform real-time correlation analysis on the strategy conflicts between assets and security event logs to obtain a strategy conflict solution, specifically:

[0035] Based on the first asset information, the differentiated protection requirements of the assets to be processed are abstracted into a policy rule set;

[0036] Based on the policy rule set, determining the policy priority of each of the security protection policies and generating an initial security policy library;

[0037] A conflict detection is performed on the initial security policy library. If a policy conflict is detected in the initial security policy library, a logical identification analysis is performed on each of the security protection policies to obtain a list of conflicting policies. The list of conflicting policies is used to perform real-time correlation analysis on the policy conflicts between assets and security event logs to obtain a policy conflict resolution solution.

[0038] The preferred solution of the embodiment of the present invention is to abstract the differentiated protection requirements of the assets to be processed into a policy rule set, and then determine the policy priority of each security protection policy based on the policy rule set and generate an initial security policy library, which can accurately identify the specific protection requirements of each asset, so that each security protection policy in the initial security policy library has its own corresponding policy priority, which can meet the security needs of different assets in a targeted manner. If a policy conflict is detected in the initial security policy library, a logical identification analysis is performed on each security protection policy to obtain a list of conflicting policies, so as to more accurately locate and understand the cause of the policy conflict, provide detailed data support for the formulation of solutions, and use the list of conflicting policies to perform real-time correlation analysis on policy conflicts between assets and security event logs, so as to promptly discover security incidents caused by policy conflicts, and quickly formulate policy conflict solutions to reduce the scope of impact of security incidents.

[0039] As a preferred solution, the initial security policy library is subjected to conflict detection. If a policy conflict is detected in the initial security policy library, each of the security protection policies is subjected to logical identification analysis to obtain a conflict policy list. The conflict policy list is used to perform real-time correlation analysis on the policy conflicts between assets and security event logs to obtain a policy conflict solution, which is specifically:

[0040] Perform conflict detection on the initial security policy library. If a policy conflict is detected in the initial security policy library, use the Prolog logic reasoning engine to identify the policy semantic conflict and rule conflict of each security protection policy, obtain the semantic conflict and rule conflict between each security protection policy, and compare the priority of each security protection policy to obtain the priority conflict between each security protection policy. Then, combine the semantic conflict, rule conflict and priority conflict between each security protection policy to form a conflict policy list.

[0041] The conflicting policy list is used to perform real-time correlation analysis on the policy conflicts between assets and security event logs to obtain a policy conflict resolution solution.

[0042] A preferred solution for implementing the embodiment of the present invention is that if a policy conflict is detected in the initial security policy library, a Prolog logic reasoning engine is used to perform in-depth policy semantic conflict and rule conflict identification on the security protection policy, which can ensure that all potential policy conflicts are accurately detected, thereby improving the consistency and effectiveness of the policy, and compare the priorities of various security protection policies to obtain the priority conflicts between various security protection policies. Then, a detailed list of conflicting policies is formed by combining the semantic conflicts, rule conflicts and priority conflicts between various security protection policies, clearly presenting various types of conflicts between all policies, so as to help enterprises better manage and execute security policies, ensure that the most critical and urgent policies are executed first, and improve the efficiency and effectiveness of security protection.

[0043] As a preferred solution, the asset security protection strategy adaptive adjustment method further includes:

[0044] Obtaining a security event log from the asset to be processed;

[0045] Based on the security event log, identifying policy conflicts and abnormal behavior patterns between assets to generate reports related to associated events;

[0046] Using a pre-built decision tree model, the associated events are classified and matched with response plans to obtain a preliminary response execution plan;

[0047] According to the historical response effect data of the preliminary response execution plan, the preliminary response execution plan is dynamically optimized to determine the optimal response action sequence; wherein the optimal response action sequence includes a number of response actions related to the policy conflict and the execution order of each of the response actions related to the policy conflict.

[0048] By implementing the preferred solution of the embodiment of the present invention, the security event log is obtained from the assets to be processed, and the policy conflicts and abnormal behavior patterns between assets can be monitored and identified in real time, ensuring the timely discovery and handling of potential security threats. In addition, by using the pre-built decision tree model to classify the associated events and match them with the response plan, the preliminary response execution plan can be quickly determined to improve the efficiency and accuracy of the event response. Then, based on the historical response effect data of the preliminary response execution plan, the preliminary response execution plan is dynamically optimized to determine the optimal response action sequence, which can ensure that the response plan is always in the best state and improve the response effect.

[0049] As a preferred solution, based on the security event log, identifying policy conflicts and abnormal behavior patterns between assets to generate reports related to associated events is specifically:

[0050] Parsing and standardizing the security event log to obtain standardized log data;

[0051] Using the Apriori algorithm to mine association rules on the standardized log data;

[0052] Based on the results of association rule mining, determine whether each security event is a related event, and combine all related events and the standardized log data corresponding to all related events to generate reports related to the related events.

[0053] By implementing the preferred solution of the embodiment of the present invention, the security event log is parsed and standardized, which can eliminate format differences and noise in the log data, ensure the consistency and availability of the data, and provide a high-quality data foundation for subsequent analysis and processing. In addition, the Apriori algorithm is used to mine association rules on standardized log data, which can quickly identify frequent patterns and association rules in the log data, and help discover potential relationships and patterns hidden in the data.

[0054] In order to solve the same technical problem, an embodiment of the present invention further provides an asset security protection strategy adaptive adjustment system, including:

[0055] A data acquisition module, used to acquire first asset information of an asset to be processed in a hybrid cloud environment, and generate multiple security protection strategies corresponding to the asset to be processed based on the first asset information; wherein the asset to be processed is an on-cloud asset or an off-cloud asset;

[0056] A policy conflict detection module is used to perform conflict detection and conflict classification on each of the security protection policies, obtain a corresponding conflict policy list, and use the conflict policy list to perform real-time correlation analysis on the policy conflicts between assets and security event logs to obtain a policy conflict solution;

[0057] A script generation module, used to generate corresponding configuration scripts by using a policy orchestration engine and combining all the security protection policies and the policy description information corresponding to all the security protection policies;

[0058] An asset deployment module, used to control the asset to be processed to be automatically deployed based on the configuration script, and obtain the second asset information of the asset to be processed that has completed the automatic deployment;

[0059] The strategy adjustment module is used to analyze the degree of change of the asset scale of the current assets to be processed based on the second asset information, and dynamically adjust the security protection strategy of the current assets to be processed if the degree of change is greater than a preset value. BRIEF DESCRIPTION OF THE DRAWINGS

[0060] Figure 1 : A flowchart of a method for adaptively adjusting asset security protection strategies provided in Embodiment 1 of the present invention;

[0061] Figure 2 : A structural diagram of an asset security protection strategy adaptive adjustment system provided in Example 1 of the present invention. DETAILED DESCRIPTION

[0062] The following will be combined with the drawings in the embodiments of the present invention to clearly and completely describe the technical solutions in the embodiments of the present invention. Obviously, the described embodiments are only part of the embodiments of the present invention, not all of the embodiments. Based on the embodiments of the present invention, all other embodiments obtained by ordinary technicians in this field without creative work are within the scope of protection of the present invention.

[0063] Embodiment one:

[0064] Please refer to Figure 1 , is a method for adaptively adjusting asset security protection strategies provided by an embodiment of the present invention, the method comprises steps S1 to S5, each of which is specifically as follows:

[0065] Step S1, obtaining first asset information of an asset to be processed in a hybrid cloud environment, and generating multiple security protection strategies corresponding to the asset to be processed based on the first asset information.

[0066] Among them, the assets to be processed are on-cloud assets or off-cloud assets.

[0067] In this embodiment, the first asset information of the asset to be processed includes but is not limited to the network location, operating system type and data sensitivity; the security protection strategy includes but is not limited to WAF protection strategy, database access control and data encryption measures. Among them, WAF (Web Application Firewall) is a Web application firewall.

[0068] As a preferred solution, step S1 includes steps S11 to S13, and each step is specifically as follows:

[0069] Step S11, obtaining first asset information of the asset to be processed in the hybrid cloud environment, and drawing a hybrid cloud network topology map based on the first asset information.

[0070] Among them, the hybrid cloud network topology diagram contains annotations that represent the connection relationships between various network areas on and off the cloud.

[0071] In this embodiment, we first obtain the list of on-cloud and off-cloud assets in the hybrid cloud environment, and then use Nmap to scan assets and collect attributes according to the on-cloud and off-cloud asset lists, and record the network location, operating system type, data sensitivity and other key attribute information of each asset to be processed as the first asset information of each asset to be processed. Next, we divide the security level according to the importance of the assets, and the evaluation criteria include data sensitivity and business impact. We establish an asset attribute database, and finally use SolarWinds Network Topology Mapper to draw a hybrid cloud network topology map and mark the connection relationship between each network area on the cloud and off-cloud.

[0072] As an example, when using Nmap to perform asset scanning, TCP SYN scanning is used, and the scanning frequency is set to 1,000 packets per second to balance the scanning speed and network load. The scanning results show that there are 500 devices in the hybrid cloud environment, including 300 on-cloud assets and 200 off-cloud assets. The asset importance assessment uses a 5-point system, and the score is calculated based on data sensitivity and business impact. Assets with a score of 3 or above are classified as high-risk assets. In addition, when SolarWinds Network Topology Mapper draws a network topology map, it uses SNMP and WMI protocols to automatically discover network devices and generate a topology map containing 50 nodes.

[0073] Step S12, analyze the firewall logs and network traffic of the assets to be processed, and combine the analysis results with the hybrid cloud network topology diagram to identify the data flow path and determine the key network nodes and data exchange points.

[0074] In this embodiment, the data flow path is identified by analyzing the firewall log and the Wireshark network traffic monitoring tool, and the key network nodes and data exchange points that need to be protected are determined.

[0075] As an example, Wireshark was used to perform traffic analysis, capture 10GB of network traffic, and identify five key data flow paths.

[0076] Step S13, based on the data flow path, key network nodes and data exchange points, generate multiple security protection strategies corresponding to the assets to be processed.

[0077] Among them, the security protection strategy includes the following measures:

[0078] ① Deploy Web application firewalls based on key network nodes.

[0079] Among them, the Web Application Firewall selects corresponding protection rules based on the asset location, which includes on-cloud and off-cloud.

[0080] In this embodiment, AWS WAF is deployed for on-cloud assets, and protection rules are set based on the characteristics of Web applications. For off-cloud assets, F5 BIG-IP ASM is used for protection, and targeted SQL injection, XSS and other attack defense strategies are configured.

[0081] In addition, through the Splunk Security Information and Event Management System (Splunk SIEM system), the WAF linkage between the cloud and offline is achieved, and security events and alarms are centrally managed.

[0082] As an example, the AWS WAF configuration contains 50 custom rules covering the OWASP Top 10 security risks. F5 BIG-IP ASM is deployed in a cloud environment with machine learning enabled to build a baseline model by analyzing normal traffic for one week. The Splunk SIEM system sets 100 correlation rules to achieve real-time correlation analysis of WAF events.

[0083] ② According to the data flow path, deploy the IBM Guardium database audit tool on the database front end, and use the IBM Guardium database audit tool to implement role-based fine-grained access control.

[0084] As an example, the IBM Guardium database audit tool monitors 10 key databases, records SQL queries and generates risk scores.

[0085] ③Dynamically desensitize sensitive data fields and set corresponding desensitization rules for each user role.

[0086] As an example, Informatica Data Masking is used to dynamically mask sensitive fields (such as ID card number, bank card number, etc.), and masking results of different degrees are returned based on the user role.

[0087] Furthermore, the security protection strategy also includes: configuring firewall rules based on network topology and data flow information to limit access rights between different network segments; regularly using vulnerability scanning tools such as Qualys to conduct security assessments of on-cloud and off-cloud assets, and updating security protection strategies based on the scanning results.

[0088] As an example, the firewall rule configuration is based on the principle of least privilege, with a total of 500 access control lists. Qualys vulnerability scanning performs a full scan once a week, with a scan depth of 3. The scan results show 10 high-risk vulnerabilities, 50 medium-risk vulnerabilities, and 100 low-risk vulnerabilities; based on the scan results, the patch management strategy is updated to prioritize the repair of high-risk vulnerabilities with a score greater than 7.

[0089] It should be noted that the effectiveness of all security measures is continuously monitored through the Security Operations Center (SOC), and a security situation report is generated monthly, including key performance indicators (KPIs) such as security incident response time and vulnerability repair rate.

[0090] Furthermore, the security protection strategy also includes: for cloud assets, deploy security components including distributed denial of service attack protection, network application firewall, and web application deployment DDoS protection components; implement fine-grained access control on local core databases, including role-based access control, column-level encryption, and dynamic data desensitization, and keep consistent with the security strategy of cloud assets. Specifically, the above security protection strategy includes steps S01 to S08, and each step is as follows:

[0091] Step S01, receiving inbound traffic information carrying a unique identifier of a cloud asset, where the inbound traffic information is sent when the cloud asset accesses the network.

[0092] Among them, SSL / TLS encrypted channels are used during data transmission to ensure the security of data throughout its entire life cycle; specifically, SSL / TLS encryption adopts TLS1.3 protocol, the key exchange algorithm is ECDHE, and the symmetric encryption algorithm is AES-256-GCM.

[0093] Step S02, sending traffic monitoring instructions to the traffic cleaning center based on the inbound traffic information. The traffic cleaning center monitors and filters the inbound traffic in real time based on the traffic monitoring instructions. If it is detected that the inbound traffic exceeds the preset traffic threshold, the cleaning mechanism is triggered to divert the abnormal traffic to the cleaning device for deep packet inspection and feature matching.

[0094] Specifically, when it is detected that the traffic exceeds the threshold, the cleaning mechanism is triggered to direct the traffic to the cleaning device with a processing capacity of 10Tbps. Among them, the cleaning device uses deep packet inspection technology to identify and filter malicious traffic by analyzing packet header information, load characteristics and behavior patterns. In addition, the random forest algorithm in the network application firewall uses 100 decision trees, each of which is trained based on a different feature subset, such as request frequency, URL parameters, HTTP headers, etc. In real-time analysis, if more than 60% of the decision trees determine the request as abnormal, the protection measures are triggered.

[0095] As an example, when deploying the distributed denial of service attack protection component, the traffic cleaning center uses an adaptive threshold algorithm to calculate the baseline based on the traffic data of the past 30 days and set the dynamic threshold. For example, for an application with an average daily traffic of 100Gbps, the normal peak may reach 150Gbps, and the threshold is set to 200Gbps.

[0096] As another example, the traffic threshold is dynamically set based on the application scale and historical traffic data, and the threshold range is between 5,000 and 50,000 packets per second.

[0097] Step S03, receiving anomaly detection results with HTTP request features.

[0098] Among them, before executing step S04, a network application firewall is deployed in advance on the front end of the Web application on the cloud, and an anomaly detection module based on the random forest algorithm is configured to perform real-time analysis on HTTP requests, identify attack behaviors such as SQL injection and cross-site scripting (and obtain "anomaly detection results with HTTP request characteristics"), and set protection rules including request frequency limitation, IP reputation check, malicious signature matching, etc.

[0099] Step S04, determine whether there is a low-reputation IP address related to the HTTP request feature in the IP reputation database; if there is a low-reputation IP address related to the HTTP request feature in the IP reputation database, then the HTTP request feature is determined to be illegal; if there is no low-reputation IP address related to the HTTP request feature in the IP reputation database, then the HTTP request feature is determined to be legal.

[0100] Specifically, the IP reputation check is implemented by integrating the Spamhaus IP reputation database, and automatically updating the local IP reputation database every hour (the IP reputation check module obtains updates from Spamhaus every hour, containing about 1 million malicious IP addresses).

[0101] Step S05: If the HTTP request feature is legal, the HTTP request is allowed to pass through the network application firewall.

[0102] Step S06, receiving access request information for the local core database, sending access control instructions to the XACML policy decision point according to the access request information, and the XACML policy decision point performs real-time evaluation and decision on the access request according to the access control instructions.

[0103] Specifically, we implement fine-grained access control on the local core database, adopt an attribute-based access control model, use XACML (Extensible Access Control Markup Language) to define access policies, combine the three dimensions of users, resources, and operations, and build an access policy matrix. Through the XACML Policy Decision Point (PDP), each access request is evaluated and decided in real time to determine whether it meets the preset access rules.

[0104] As an example, the access control of the local database uses XACML to define fine-grained policies, such as "allow users in the finance department to view but not modify financial statements during working hours." The XACML policy decision point can handle 1,000 access requests per second with an average response time of 10 milliseconds.

[0105] Step S07: if it is determined that the access request complies with the preset access rules, access to the local core database is allowed.

[0106] Step S08, obtaining sensitive column data to be encrypted and stored, and encrypting the sensitive column data.

[0107] Specifically, column-level encryption and dynamic data desensitization are implemented. The AES-256 algorithm is used to encrypt and store sensitive column data (the key length is 256 bits). HashiCorp Vault is used for key management to store and manage keys, and key rotation and access auditing are implemented (keys are updated every 90 days). When querying data, dynamic desensitization is performed based on user roles and permission levels. Desensitization rules include partial hiding, full hiding, replacement, and other methods (dynamic data desensitization processes sensitive information according to predefined rules, such as replacing the middle 8 digits of a credit card number with asterisks). A central policy management platform is used to uniformly manage cloud and local security policies to ensure policy consistency. The policy synchronization mechanism includes regular hourly synchronization (the central policy management platform performs full policy synchronization once an hour, and the change detection mechanism is enabled at the same time), real-time change detection (when a policy change is detected, the update is pushed to all endpoints within 30 seconds) and automatic deployment, pushing policy updates to cloud and local security components through the XACML policy distribution point (PDP) (the XACML policy distribution point adopts a publish-subscribe model to ensure that cloud and local components can receive and apply the latest security policies in a timely manner, thereby maintaining the consistency of the overall security situation).

[0108] Step S2, performing conflict detection and conflict classification on each security protection strategy to obtain a corresponding conflict strategy list, and using the conflict strategy list to perform real-time correlation analysis on the strategy conflicts between assets and security event logs to obtain a strategy conflict resolution solution.

[0109] As a preferred solution, step S2 includes step S21 to step S23, and each step is specifically as follows:

[0110] Step S21, based on the first asset information, abstracting the differentiated protection requirements of the asset to be processed into a policy rule set.

[0111] In this embodiment, the first asset information also includes the asset type and security protection level. Specifically, an asset relationship model is constructed through the Neo4j graph database, and then the asset relationship model is used in combination with the first asset information to classify and mark the assets to be processed in the heterogeneous network environment to obtain asset classification results. Then, based on the asset classification results, the Extensible Access Control Markup Language (XACML) is used to construct a security policy model; wherein the security policy model is used to abstract the protection requirements of assets on and off the cloud into a set of policy rules.

[0112] As an example, the security protection level is divided into three levels: high, medium and low. The asset relationship model contains 10,000 nodes and 50,000 relationships. The connectivity and centrality between assets are calculated through graph algorithms, and 20 key nodes can be identified. The security policy model built based on XACML defines 500 security rules, covering access control, data protection and network isolation.

[0113] Step S22, using a rule matching algorithm, based on the policy rule set, calculates the rule similarity, thereby determining the policy priority of each security protection policy and generating an initial security policy library.

[0114] As an example, the rule matching algorithm uses cosine similarity calculation, the threshold is set to 0.8, and the rules with similarity higher than the threshold are merged and optimized, and finally 400 non-redundant rules are obtained.

[0115] Step S23, perform conflict detection on the initial security policy library. If a policy conflict is detected in the initial security policy library, perform logical identification analysis on each security protection policy to obtain a list of conflicting policies. Use the list of conflicting policies to perform real-time correlation analysis on the policy conflicts between assets and security event logs to obtain a policy conflict resolution solution.

[0116] As a preferred solution, step S23 includes step S231 to step S232, and each step is specifically as follows:

[0117] Step S231, perform conflict detection on the initial security policy library. If a policy conflict is detected in the initial security policy library, use the Prolog logic reasoning engine to identify the policy semantic conflicts and rule conflicts of each security protection policy, obtain the semantic conflicts and rule conflicts between each security protection policy, and compare the priorities of each security protection policy to obtain the priority conflicts between each security protection policy. Then, combine the semantic conflicts, rule conflicts and priority conflicts between each security protection policy to form a conflict policy list and generate conflict resolution suggestions.

[0118] As an example, the Prolog logic reasoning engine analyzed the strategy library and found 50 semantic conflicts and 30 rule conflicts. Priority comparison found 20 priority conflicts. Conflict resolution suggestions include rule merging, priority adjustment, and condition refinement.

[0119] Step S232, using the conflicting policy list, conducts real-time correlation analysis on the policy conflicts between assets and the security event logs to obtain a policy conflict resolution solution.

[0120] Specifically, step S232 includes step S2321 to step S2322, and each step is as follows:

[0121] Step S2321, using the Apache Flink real-time data stream processing platform, for the conflicting policy list, conduct real-time correlation analysis on the policy conflicts between assets and security event logs, identify time series anomaly patterns through the long short-term memory network (LSTM), and perform anomaly detection in combination with the isolation forest algorithm to identify suspicious security events.

[0122] As an example, the Apache Flink real-time processing platform processes 10,000 log events per second, and the LSTM network trains the model based on historical data from the past 7 days, with a prediction window of 1 hour. The isolation forest algorithm sets the anomaly threshold to 0.95 and detects 100 potential anomalies.

[0123] Step S2322, based on the correlation analysis results and combined with the asset status information in the cloud environment, generates policy conflict solutions and security incident warning information, and automatically applies the updated security policy through the policy execution engine to achieve dynamic security protection.

[0124] As an example, the policy execution engine updates the security policy every 5 minutes, with an average response time of 100 milliseconds, to dynamically update the protection configuration of 500 devices.

[0125] Furthermore, step S2 also includes a policy defect redundancy processing flow, which includes steps S201 to S202, and each step is specifically as follows:

[0126] Step S201 , by comparing the security policy actually deployed on the asset with the standard policy template of the cloud service provider, the difference items of the policy attributes are identified to determine whether there are policy defects or redundancies.

[0127] Specifically, step S201 includes step S2011 to step S2015, and each step is specifically as follows:

[0128] Step S2011, using the Ansible configuration management tool, obtains security policy information carrying the asset identification number and the cloud service provider's standard policy template from the asset.

[0129] As an example, use the Ansible configuration management tool to scan 1,000 servers in the enterprise network to extract the security policy configuration files on each server and obtain standard policy templates from the cloud service provider's API.

[0130] Step S2012: Based on the security policy information and the pre-established cloud service provider standard policy template, the Word2Vec semantic similarity algorithm is used to compare the policy attributes of the asset security policy and the standard policy template to obtain the difference items and generate a difference item report. The policy attributes include but are not limited to access control rules, data encryption configuration, and intrusion detection rules.

[0131] As an example, the Word2Vec algorithm uses a 100-dimensional vector to represent policy attributes, and compares the actual policy and the standard template by calculating the cosine similarity. The threshold is set to 0.8, and attributes below the threshold are marked as differences.

[0132] Step S2013, based on the difference item, using the random forest algorithm, considering multiple features such as policy coverage and execution frequency, calculate the policy attribute value, and then determine whether there is a policy defect or redundancy; if the policy attribute value is lower than the standard template threshold, then the policy is determined to be a policy defect; if the policy attribute value is higher than the standard template threshold, then the policy is determined to be a policy redundancy.

[0133] As an example, the difference report shows that 300 policy attributes are different. The random forest algorithm uses 1,000 decision trees, each considering 5 features, including policy coverage, execution frequency, update time, etc. Policy attribute values ​​that deviate from the standard template threshold by more than 20% are judged as defects or redundancies, identifying 150 policy defects and 50 policy redundancies.

[0134] Step S2014: For policies that are determined to be policy defects, the cloud service provider's security best practice knowledge base is called, and the BERT model is used to extract knowledge from the cloud service provider's security best practice knowledge base, and combined with asset feature tags, policy repair suggestions are automatically generated according to the rule template. The policy repair suggestions include missing access control rules, data encryption configurations, and / or intrusion detection rules.

[0135] As an example, the BERT model extracts knowledge from 10GB of security best practices documents and generates 5,000 rule templates. Asset feature labels include 10 dimensions such as operating system type, network location, and data sensitivity. Rule templates are combined with asset features to automatically generate 200 new access control rules, 50 data encryption configurations, and 100 intrusion detection rules.

[0136] Step S2015: For policies that are determined to be redundant, the PageRank graph analysis algorithm is used to analyze the dependencies between policies, quantify the importance of each policy, and determine the necessity of redundant policies for asset protection. If there is no dependency and the protection level is too high, a suggestion for merging or deleting policies is generated, and a simplified policy configuration plan is output. The Terraform policy orchestration tool is used to automatically apply repair suggestions and simplified plans to achieve automatic policy updates and deployments, ensuring consistency and optimization of security policies for assets on and off the cloud.

[0137] As an example, the PageRank algorithm analyzes 5,000 dependencies between 1,000 policy nodes, and policies with importance scores below 0.01 are considered deletable, ultimately identifying 30 mergeable policies and 20 deletable policies. The Terraform tool receives repair suggestions and simplification plans, generates 500 lines of Infrastructure as Code (IaC) scripts, and completes policy updates for all servers within 15 minutes, achieving consistency and optimization of security policies for 1,000 servers on and off the cloud.

[0138] Step S202, based on the business characteristics and security requirements of the assets, match the policy configuration from the cloud service provider's policy template library to form policy optimization suggestions, submit the generated policy repair, simplification, and optimization suggestions to the cloud service provider's security orchestration engine, and apply the policy changes to the cloud assets through the automated policy distribution and execution mechanism.

[0139] Specifically, step S202 includes step S2021 to step S2026, and each step is specifically as follows:

[0140] Step S2021, use ServiceNowCMDB to obtain the business feature information of the assets, and use the ELKStack log analysis tool to extract security requirement data, and then classify the assets through a convolutional neural network based on the business feature information and security requirement data to obtain an asset feature vector containing features such as business type, data sensitivity, and access frequency.

[0141] As an example, ServiceNowCMDB scans the enterprise network and identifies 1,000 cloud assets, including virtual machines, containers, and serverless functions. ELKStack analyzes logs from the past 30 days to extract the average daily request volume, data processing volume, and error rate for each asset. The convolutional neural network uses 3 convolutional layers and 2 fully connected layers. The input features include 20 indicators such as CPU usage, memory usage, and network traffic, and outputs a 100-dimensional feature vector.

[0142] Step S2022: Use the cosine similarity algorithm to match the asset feature vector with the policy vector in the cloud service provider's policy template library and calculate the similarity value.

[0143] As an example, the cloud service provider policy template library contains 10,000 predefined policies, each of which is represented as a 100-dimensional vector. The cosine similarity algorithm calculates the similarity between the asset feature vector and the policy vector, and a threshold of 0.8 selects an average of 50 candidate policies.

[0144] Step S2023: If the similarity value is higher than the preset threshold, the corresponding policy template is determined as a candidate optimization solution.

[0145] As an example, the preset threshold is set to 0.8.

[0146] Step S2024, using the random forest algorithm to evaluate the candidate optimization solutions, and selecting the optimal strategy configuration based on the evaluation results to generate strategy optimization recommendations.

[0147] Specifically, factors such as policy coverage, CVSS security score, and JMeter performance test results are considered to select the optimal policy configuration and generate policy optimization recommendations.

[0148] As an example, the random forest algorithm uses 100 decision trees, each considering 10 features, including CVSS score (1-10 points), response time (milliseconds) and throughput (requests per second) of the JMeter test. The optimal policy configuration strikes a balance between security and performance, such as a CVSS score of no less than 7.5 and a response time increase of no more than 5%.

[0149] Step S2025: Submit a policy change request through the API of the security orchestration engine.

[0150] Among them, policy change requests include but are not limited to policy fixes, simplifications, and optimization suggestions.

[0151] Specifically, the policy repair, simplification, and optimization suggestions are integrated into a unified policy change plan, and the policy change request is submitted through the API of the security orchestration engine to trigger the automated policy distribution and execution mechanism.

[0152] As an example, the security orchestration engine parses policy change proposals and detects potential conflicts in 10% of the changes. It resolves 80% of the conflicts by adjusting rule priorities, and the remaining 20% ​​require manual intervention.

[0153] Step S2026: After receiving the policy change request, the security orchestration engine performs policy parsing, conflict detection, and rollback preparation, and applies the policy change to the target cloud assets.

[0154] In this embodiment, the Splunk security information and event management system is used to monitor the effects of policy changes, collect security events and performance indicators, and form feedback data for continuous optimization of policy configuration.

[0155] As an example, during the policy deployment process, the security orchestration engine creates a rollback snapshot for each change. The SplunkSIEM system collects indicators every 5 minutes to monitor the number of security events and system performance changes within 7 days. If an anomaly is detected (such as a 20% increase in security events or a 10% drop in performance), the policy rollback is automatically triggered.

[0156] Step S3, using a policy orchestration engine, combining all security protection policies and the policy description information corresponding to all security protection policies, to generate corresponding configuration scripts.

[0157] As a preferred solution, step S3 includes step S31 to step S33, and each step is specifically as follows:

[0158] Step S31, using a policy orchestration engine to parse each security protection policy and obtain policy description information corresponding to each security protection policy.

[0159] It should be noted that the policy description information includes the security protection policy, which is in the YAML format.

[0160] As an example, a YAML-formatted security policy file containing 50 rules is parsed using the policy orchestration engine.

[0161] Step S32, using the ANTLR parser, performs syntax analysis and semantic checking on the policy description information corresponding to each security protection policy to obtain an intermediate representation of each security protection policy to ensure policy integrity and consistency.

[0162] As an example, an ANTLR parser performs 1000 syntax checks and 200 semantic validations, converted into an intermediate representation graph containing 150 nodes.

[0163] Step S33: call the configuration template library of the platform corresponding to the asset to be processed, and obtain the configuration script corresponding to the intermediate representation of each security protection strategy from the configuration template library.

[0164] In this embodiment, according to the intermediate representation, the configuration template library of the corresponding platform is called using the Jinja2 template engine to generate configuration scripts adapted to different cloud platforms and local environments. The configuration scripts include but are not limited to firewall rules, access control lists, and encryption parameters. The configuration scripts are used to handle configuration differences between platforms.

[0165] As an example, using the Jinja2 template engine, templates for three cloud platforms (AWS, Azure, Alibaba Cloud) and two local environments (Linux, Windows) are selected from the configuration template library to generate a total of 300 configuration scripts covering firewall rules, access control lists, and encryption parameters.

[0166] Step S4: Based on the configuration script, control the asset to be processed to be automatically deployed, and obtain the second asset information of the asset to be processed that has completed the automatic deployment.

[0167] As a preferred solution, step S4 includes step S41 to step S43, and each step is specifically as follows:

[0168] Step S41, transferring the configuration script to the Ansible configuration management tool.

[0169] Step S42, using the Ansible configuration management tool, generates deployment instructions based on the configuration script, and sends the deployment instructions to the assets to be processed to trigger the automated deployment process, update the security configuration of assets such as Web application servers and database servers, and set up a failure retry mechanism and rollback strategy.

[0170] As an example, the Ansible tool pushes configurations to 1,000 cloud assets and 500 local assets in parallel, sets a three-failure retry mechanism with an interval of 30 seconds each, and the deployment success rate reaches 99.5%.

[0171] Step S43, when it is detected that the assets of the cloud platform have changed, Nmap is called to identify the changed assets in the cloud platform, and the asset list is updated in combination with the identification results and the CMDB system, and based on the updated asset list, the second asset information of the current asset to be processed is obtained.

[0172] In this embodiment, the elastic scaling events of the cloud platform are monitored. When resource expansion or contraction is triggered, Nmap is automatically called for asset discovery to identify newly added or deleted Web applications and core database assets, and the asset list is updated in conjunction with the configuration management database (CMDB) system, and the corresponding security policies are adjusted according to asset changes. In addition, the Zabbix asset information collection tool is used to obtain the second asset information of the current assets to be processed as asset scale data.

[0173] As an example, the cloud platform monitoring detected 50 new web servers and 5 database servers in 10 minutes. Nmap immediately started a quick scan and completed the detection of 1024 ports in 2 minutes, identifying the operating system type and open services of the new assets. The CMDB system updates the asset list, automatically assigns security groups to the new assets, inherits 80% of the basic policies of the original similar assets, and customizes 20% of personalized rules based on the newly identified characteristics. Zabbix collects asset data every 5 minutes.

[0174] In this embodiment, the Prometheus monitoring system is used to collect security indicator data and verify the policy deployment effect. If the security indicator data meets the preset threshold requirements, it is determined that the personalized security protection policy deployment is successful.

[0175] Among them, security indicator data includes but is not limited to strategy generation efficiency, false alarm rate and performance impact.

[0176] As an example, Prometheus collects security indicators every 5 seconds, including the number of firewall interceptions, SQL injection attempt frequency, and abnormal access patterns, generating nearly 24 hours of time series data. By comparing the changes in indicators before and after deployment, it was found that security incidents decreased by 30%, the false alarm rate decreased by 15%, and the system response time increased by no more than 50 milliseconds, verifying the effectiveness of the policy deployment.

[0177] Preferably, when an asset changes, the newly added asset information is classified and labeled according to the preset protection requirement mapping rules, and then the WAF protection policy, database access control rules and data encryption scheme with the highest matching degree are selected from the policy library to generate the initial security policy configuration, and a graph-theory-based conflict detection algorithm is used to identify policy conflicts between new assets and existing assets and obtain conflict resolution solutions.

[0178] Specifically, a grayscale release strategy is adopted to first apply new configuration parameters to 10% of assets, and Prometheus is used to monitor system stability indicators such as response time and error rate. When the indicators meet the preset conditions, the application scope is gradually expanded to 100%. The Splunk Security Information and Event Management (SIEM) system is used to monitor the changes in security indicators after dynamic adjustment, including attack interception rate, false alarm rate and performance impact, to evaluate the adjustment effect and form a feedback loop.

[0179] As an example, the first round of grayscale release deployed new configurations on 100 servers. Prometheus monitored an average response time increase of 5ms and an error rate increase of 0.1%, both within acceptable ranges, and gradually expanded to 1,000 servers. The security policy library contains 1,000 WAF rules, 500 access control policies, and 200 encryption schemes. Policy matching is performed on 50 newly added web servers and 10 database servers, with an average of 20 rules per asset. The graph theory conflict detection algorithm constructs a policy relationship graph containing 5,000 nodes, identifies 30 potential conflicts, resolves 25 of them by adjusting rule priorities, and the remaining 5 require manual intervention.

[0180] Preferably, when an asset changes, the associated policy entries are retrieved from the security policy configuration library for the deleted asset information, the policy deletion operation is performed, and the policy dependency graph is updated to ensure policy integrity. The Nessus vulnerability scanning tool is then used to check for security vulnerabilities that appear after policy deletion and generate a risk assessment report.

[0181] As an example, by deleting the policies related to 100 retired servers, the updated dependency graph has 200 fewer nodes and 500 fewer edges. The Nessus scan found 15 medium-risk vulnerabilities and 5 high-risk vulnerabilities, generating a 50-page risk assessment report.

[0182] Step S5, based on the second asset information, analyzing the degree of change in the asset size of the current asset to be processed, if the degree of change is greater than a preset value, dynamically adjusting the security protection strategy of the current asset to be processed.

[0183] As a preferred solution, step S5 includes step S51 to step S52, and each step is specifically as follows:

[0184] Step S51, through the Autoregressive Integrated Moving Average Model (ARIMA model), combined with the second asset information, calculate the asset quantity change rate of the current assets to be processed and predict the asset change trend of the current assets to be processed.

[0185] As an illustration, nearly 30 days of data are input into the ARIMA model, and the asset growth rate forecast for the next 7 days is 15%, which exceeds the preset threshold of 10%.

[0186] Step S52: If the asset quantity change rate of the current assets to be processed is greater than the preset value, it is determined that the asset scale has changed significantly. At this time, the security policy evaluation model is started to re-evaluate the security protection strategy, database access control and data encryption measures corresponding to the current assets to be processed, generate new configuration parameter recommendations, and dynamically adjust the security protection strategy of the current assets to be processed.

[0187] Among them, the security policy evaluation model is pre-built based on the random forest algorithm.

[0188] As an example, the random forest model uses 100 decision trees, considers 50 features such as request frequency, data sensitivity, etc., re-evaluates 2,000 security rules, and adjusts the parameters of 300 rules.

[0189] Preferably, with assets as nodes and business and security associations as edges, a dynamically evolving asset security association graph is constructed to capture the complex interactions and dependency changes between assets in real time, discover potential security risk propagation paths and weak links, and quantitatively evaluate the importance and vulnerability of each asset node to guide the priority sorting and resource allocation of security protection. Specifically, the above process includes steps S011 to S018, and each step is as follows:

[0190] Step S011, obtain the stored asset information, and construct an initial asset security association map based on the asset information.

[0191] Among them, asset information includes asset nodes and business security association edges. The initial asset security association graph is used to represent the security relationship between assets.

[0192] Specifically, the Neo4j graph database is used to store and manage asset information, with each asset as a node and business and security associations as edges to build an initial asset security association graph.

[0193] As an example, the initial construction of the Neo4j graph database contains a security association graph with 10,000 asset nodes and 50,000 association edges.

[0194] Step S012, using Apache Kafka to collect large-scale asset data generated by real-time status changes of assets in real time, and then process the large-scale asset data through Apache Flink to obtain graph data stream update information.

[0195] As an example, Apache Kafka is configured with 100 partitions and receives 50,000 asset status update messages per second. Apache Flink is set to 50 parallelisms and processes the data stream in real time with an average latency of less than 100 milliseconds.

[0196] Step S013, dynamically update the initial asset security association graph according to the graph data stream update information, and use the depth-first search (DFS) algorithm to analyze the complex interactions and dependencies between asset nodes based on the initial asset security association graph.

[0197] As an example, the depth-first search algorithm identified 200 critical paths in the graph, and calculated that the average path length was 5 hops and the longest path was 12 hops.

[0198] Step S014, calculate the shortest path between nodes, obtain the connectivity information between assets, and if the connectivity information meets the preset conditions, it is determined to be a critical path and the security risk propagation channel is obtained.

[0199] As an example, the shortest path and connectivity between nodes are calculated, critical paths and potential security risk propagation channels are identified, and a risk propagation path report containing risk propagation probability and impact range is generated. The risk propagation path report contains 500 high-risk propagation channels, and each channel is marked with the propagation probability and potential impact range.

[0200] Step S015, based on the PageRank algorithm, calculate the importance score of each asset node, and use the random forest algorithm to process the historical security event data and vulnerability scanning results of the SIEM system to evaluate the vulnerability index of the node.

[0201] As an example, the PageRank algorithm is iterated 10 times with a convergence threshold of 0.001 to obtain a list of top 100 important nodes. The SIEM system provides security event data for the past 90 days, including 1 million log records. Vulnerability scanning covers all assets and finds 5,000 medium- and low-risk vulnerabilities and 500 high-risk vulnerabilities. The random forest model uses 100 decision trees and considers 20 features, such as attack frequency and number of vulnerabilities, to generate a vulnerability index between 0 and 1.

[0202] Step S016, generating a node importance and vulnerability matrix according to the importance score of each asset node and the vulnerability index of the node.

[0203] Step S017, based on the node importance and vulnerability matrix, and the security risk propagation channel, a genetic algorithm is used for multi-objective optimization, and a balanced solution between protection effect and resource consumption is obtained through multi-objective optimization.

[0204] As an example, the genetic algorithm population size is set to 1000, the evolution is 500 generations, the crossover rate is 0.8, the mutation rate is 0.1, and the optimization objectives include maximizing the protection coverage and minimizing the resource consumption.

[0205] Step S018, through the security orchestration and automated response (SOAR) platform, the optimization result - the balance plan between protection effect and resource consumption, is converted into specific security policy configuration and resource scheduling instructions, forming a security protection priority ranking and resource allocation plan, realizing dynamic adjustment of protection strategies and intelligent allocation of resources.

[0206] As an example, the SOAR platform receives the optimization results and generates 1,000 security policy configuration instructions and 200 resource scheduling tasks).

[0207] As a preferred solution, an asset security protection strategy adaptive adjustment method provided in an embodiment of the present invention further includes a strategy conflict response process, which includes steps S6 to S9, and each step is specifically as follows:

[0208] Step S6: deploy a distributed log collector to obtain security event logs from the assets to be processed, and transmit the security event logs to the ELK central log analysis platform in real time through the Kafka message queue.

[0209] As an example, the ELK platform processes 100,000 logs per second.

[0210] Step S7, based on the security event log, identifying policy conflicts and abnormal behavior patterns between assets to generate reports related to associated events.

[0211] As a preferred solution, step S7 includes step S71 to step S73, and each step is specifically as follows:

[0212] Step S71, parse and standardize the security event log to obtain standardized log data and achieve unified conversion of data format.

[0213] As an example, using Logstash, 10 security event logs in different formats are uniformly converted to JSON, and the field standardization rate reaches 99.5%.

[0214] Step S72: Use the Apriori algorithm to perform association rule mining on the standardized log data.

[0215] In this embodiment, the minimum support and confidence thresholds are pre-set, and then the Apriori algorithm is used to perform real-time correlation analysis on the standardized security event data, identify policy conflicts and abnormal behavior patterns between assets, and generate correlation event reports and risk scores based on the CVSS scoring system.

[0216] As an example, the Apriori algorithm mines association rules in 10 million event data with a minimum support of 0.1 and a confidence threshold of 0.8, and finds 500 high-confidence rules. The CVSS scoring system assigns a risk score of 0-10 to each event based on factors such as the scope of impact and the complexity of the attack.

[0217] Step S73, based on the association rule mining results, determine whether each security event is a related event, and combine all the related events and the standardized log data corresponding to all the related events to generate a report related to the related events.

[0218] In this embodiment, if the association rule mining result meets the preset minimum support and confidence thresholds, the security event is determined to be a correlation event to identify policy conflicts and abnormal behavior patterns between assets.

[0219] Step S8, using the pre-built decision tree model, classify the associated events and match them with the response plans to obtain a preliminary response execution plan.

[0220] In this embodiment, a XACML (Extensible Access Control Markup Language) engine is used to process complex multi-policy conflict scenarios to build a decision tree model, and then the decision tree model is used to automatically classify and match response plans for related events to generate a preliminary response execution plan.

[0221] As an example, the XACML engine processes 1,000 policy conflict scenarios per second with a resolution rate of 95%. The decision tree model contains 100 leaf nodes, covers 200 response scenarios, and the average decision time is less than 50 milliseconds.

[0222] Step S9, dynamically optimizing the preliminary response execution plan according to the historical response effect data of the preliminary response execution plan to determine the optimal response action sequence.

[0223] The optimal response action sequence includes a number of response actions related to the policy conflict and the execution order of each response action related to the policy conflict.

[0224] In this embodiment, the Q-learning reinforcement learning algorithm is used to dynamically adjust the ε value based on the balanced exploration and utilization of the ε-greedy strategy to obtain historical response effect data. According to the historical response effect data, the preliminary response execution plan is dynamically optimized to select the optimal response action sequence.

[0225] As an example, the Q-learning algorithm sets the learning rate α = 0.1, the discount factor γ = 0.9, the initial value of ε is 0.3, and it decays by 10% every 1000 iterations. After 100,000 interactions, the response accuracy of the reinforcement learning model increased from the initial 70% to 95%.

[0226] Preferably, the Apache Airflow workflow orchestration tool is used to realize the automation of the entire process from alarm analysis to disposal execution, and is integrated with the security orchestration platform through the RESTful API interface to issue execution instructions, realize automated processing and policy adjustment, and form a closed-loop security management system.

[0227] As an example, Apache Airflow orchestrates 50 task nodes to build a complete incident response workflow, and the average execution time is optimized from 30 minutes to 5 minutes. The security orchestration platform processes 200 automated tasks per minute through the RESTful API interface, including firewall rule updates, account locks, network segment isolation and other operations, achieving an 80% full-process response automation rate.

[0228] Please refer to Figure 2 , is a structural diagram of an asset security protection strategy adaptive adjustment system provided by an embodiment of the present invention, the system includes a data acquisition module M1, a strategy conflict detection module M2, a script generation module M3, an asset deployment module M4 and a strategy adjustment module M5, and each module is specifically as follows:

[0229] The data acquisition module M1 is used to acquire first asset information of an asset to be processed in a hybrid cloud environment, and generate multiple security protection strategies corresponding to the asset to be processed based on the first asset information; wherein the asset to be processed is an asset on the cloud or an asset off the cloud;

[0230] The policy conflict detection module M2 is used to perform conflict detection and conflict classification on various security protection policies, obtain the corresponding conflict policy list, and use the conflict policy list to perform real-time correlation analysis on the policy conflicts between assets and security event logs to obtain policy conflict solutions.

[0231] The script generation module M3 is used to use the policy orchestration engine to combine all security protection policies and the policy description information corresponding to all security protection policies to generate corresponding configuration scripts;

[0232] The asset deployment module M4 is used to control the automatic deployment of the assets to be processed based on the configuration script, and obtain the second asset information of the assets to be processed that have completed the automatic deployment;

[0233] The policy adjustment module M5 is used to analyze the degree of change of the asset scale of the current asset to be processed based on the second asset information, and dynamically adjust the security protection policy of the current asset to be processed if the degree of change is greater than a preset value.

[0234] Those skilled in the art can clearly understand that, for the convenience and brevity of description, the specific working process of the system described above can refer to the corresponding process in the aforementioned method embodiment, and will not be repeated here.

[0235] Compared with the prior art, the embodiments of the present invention have the following beneficial effects:

[0236] The present invention provides a method and system for adaptively adjusting asset security protection strategies, which obtain first asset information of cloud assets or off-cloud assets in a hybrid cloud environment, and generate multiple security protection strategies corresponding to the asset based on the first asset information, then perform conflict detection and conflict classification on each security protection strategy, obtain a corresponding conflict strategy list, and fully consider the background and impact of security incidents on strategy conflicts, use the conflict strategy list to perform real-time correlation analysis between strategy conflicts and security event logs between assets, obtain a strategy conflict resolution method, and improve the effectiveness of the strategy conflict resolution method, and by performing conflict detection, conflict classification and real-time correlation analysis on security policies, it is possible to quickly identify and locate potential conflicts in strategy, thereby improving the response speed and processing capability to security incidents. In addition, a policy orchestration engine is used to combine all security protection policies and the policy description information corresponding to all security protection policies to generate corresponding configuration scripts, which greatly improves the deployment efficiency of asset security protection policies and reduces manual intervention and operational errors. Then, based on the configuration script, the asset is controlled for automatic deployment, and the second asset information of the asset that has completed the automatic deployment is obtained. Finally, based on the second asset information, the degree of change in the current asset scale of the asset is analyzed. If the degree of change is greater than the preset value, the current security protection policy of the asset is dynamically adjusted to ensure the security of assets on or off the cloud in different scales and complex environments, so as to enhance the adaptability and flexibility of the system, and reduce security risks caused by human negligence or outdated policies, thereby improving overall security.

[0237] The specific embodiments described above further illustrate the purpose, technical solutions and beneficial effects of the present invention. It should be understood that the above description is only a specific embodiment of the present invention and is not intended to limit the scope of protection of the present invention. It is particularly pointed out that for those skilled in the art, any modification, equivalent replacement, improvement, etc. made within the spirit and principle of the present invention should be included in the scope of protection of the present invention.

Claims

1. A method for adaptively adjusting asset security protection strategies, characterized in that: include: Acquire first asset information of an asset to be processed in a hybrid cloud environment, and generate multiple security protection strategies corresponding to the asset to be processed based on the first asset information; wherein the asset to be processed is an on-cloud asset or an off-cloud asset; Perform conflict detection and conflict classification on each of the security protection strategies to obtain a corresponding conflict strategy list, and use the conflict strategy list to perform real-time correlation analysis on the strategy conflicts between assets and security event logs to obtain a strategy conflict solution; Using a policy orchestration engine, combining all the security protection policies and the policy description information corresponding to all the security protection policies, to generate corresponding configuration scripts; Based on the configuration script, control the asset to be processed to be automatically deployed, and obtain second asset information of the asset to be processed that has completed the automatic deployment; Based on the second asset information, the degree of change in the asset size of the current assets to be processed is analyzed. If the degree of change is greater than a preset value, the security protection strategy of the current assets to be processed is dynamically adjusted.

2. The asset security protection strategy adaptive adjustment method according to claim 1, characterized in that: The policy orchestration engine is used to generate corresponding configuration scripts by combining all the security protection policies and the policy description information corresponding to all the security protection policies, specifically: Using a policy orchestration engine to parse each of the security protection policies and obtain policy description information corresponding to each of the security protection policies; Performing syntax analysis and semantic checking on the policy description information corresponding to each of the security protection policies to obtain an intermediate representation of each of the security protection policies; The configuration template library of the platform corresponding to the asset to be processed is called, and the configuration script corresponding to the intermediate representation form of each security protection strategy is obtained from the configuration template library.

3. The asset security protection strategy adaptive adjustment method according to claim 1, characterized in that: The acquiring of first asset information of an asset to be processed in a hybrid cloud environment, and generating, based on the first asset information, a plurality of security protection strategies corresponding to the asset to be processed, specifically comprises: Acquire first asset information of an asset to be processed in a hybrid cloud environment, and draw a hybrid cloud network topology map based on the first asset information; wherein the hybrid cloud network topology map includes annotations indicating connection relationships between various network areas on and off the cloud; Analyze the firewall logs and network traffic of the asset to be processed, and identify the data flow path and key network nodes and data exchange points by combining the analysis results with the hybrid cloud network topology diagram; Based on the data flow path, the key network nodes and the data exchange points, generating multiple security protection strategies corresponding to the assets to be processed; The security protection strategy includes: Based on the key network nodes, deploy a Web application firewall; wherein the Web application firewall selects corresponding protection rules according to the asset location, and the asset location includes on-cloud and off-cloud; According to the data flow path, deploy the IBM Guardium database audit tool at the database front end, and implement role-based fine-grained access control through the IBM Guardium database audit tool; Dynamically desensitize sensitive data fields and set corresponding desensitization rules for each user role.

4. The asset security protection strategy adaptive adjustment method according to claim 1, characterized in that: The step of controlling the asset to be processed to be automatically deployed based on the configuration script and obtaining the second asset information of the asset to be processed that has completed the automatic deployment is specifically as follows: Transferring the configuration script to the Ansible configuration management tool; Generate deployment instructions based on the configuration script through the Ansible configuration management tool, and send the deployment instructions to the asset to be processed; When a change in the cloud platform's assets is detected, Nmap is called to identify the changed assets in the cloud platform, and the asset list is updated based on the identification results and the CMDB system. Based on the updated asset list, the second asset information of the current pending assets is obtained.

5. The asset security protection strategy adaptive adjustment method according to claim 1, characterized in that: Based on the second asset information, the change degree of the asset scale of the current asset to be processed is analyzed. If the change degree is greater than a preset value, the security protection strategy of the current asset to be processed is dynamically adjusted, specifically: By using an autoregressive integrated moving average model and combining the second asset information, the asset quantity change rate of the current assets to be processed is calculated and the asset change trend of the current assets to be processed is predicted; If the asset quantity change rate of the current assets to be processed is greater than the preset value, the security policy evaluation model is started to re-evaluate the security protection strategy, database access control and data encryption measures corresponding to the current assets to be processed, generate new configuration parameter recommendations, and dynamically adjust the security protection strategy of the current assets to be processed; wherein the security policy evaluation model is pre-built based on the random forest algorithm.

6. The asset security protection strategy adaptive adjustment method according to claim 1, characterized in that: The conflict detection and conflict classification are performed on each of the security protection strategies to obtain a corresponding conflict strategy list, and the conflict strategy list is used to perform real-time correlation analysis on the strategy conflicts between assets and security event logs to obtain a strategy conflict solution, specifically: Based on the first asset information, the differentiated protection requirements of the assets to be processed are abstracted into a policy rule set; Based on the policy rule set, determining the policy priority of each of the security protection policies and generating an initial security policy library; A conflict detection is performed on the initial security policy library. If a policy conflict is detected in the initial security policy library, a logical identification analysis is performed on each of the security protection policies to obtain a list of conflicting policies. The list of conflicting policies is used to perform real-time correlation analysis on the policy conflicts between assets and security event logs to obtain a policy conflict resolution solution.

7. The method for adaptively adjusting asset security protection strategy according to claim 6, characterized in that: The initial security policy library is subjected to conflict detection. If a policy conflict is detected in the initial security policy library, each of the security protection policies is subjected to logical identification analysis to obtain a conflict policy list. The conflict policy list is used to perform real-time correlation analysis on the policy conflicts between assets and security event logs to obtain a policy conflict solution, which is specifically: Perform conflict detection on the initial security policy library. If a policy conflict is detected in the initial security policy library, use the Prolog logic reasoning engine to identify the policy semantic conflict and rule conflict of each security protection policy, obtain the semantic conflict and rule conflict between each security protection policy, and compare the priority of each security protection policy to obtain the priority conflict between each security protection policy. Then, combine the semantic conflict, rule conflict and priority conflict between each security protection policy to form a conflict policy list. The conflicting policy list is used to perform real-time correlation analysis on the policy conflicts between assets and security event logs to obtain a policy conflict resolution solution.

8. The asset security protection strategy adaptive adjustment method according to claim 1, characterized in that: Also includes: Obtaining a security event log from the asset to be processed; Based on the security event log, identifying policy conflicts and abnormal behavior patterns between assets to generate reports related to associated events; Using a pre-built decision tree model, the associated events are classified and matched with response plans to obtain a preliminary response execution plan; According to the historical response effect data of the preliminary response execution plan, the preliminary response execution plan is dynamically optimized to determine the optimal response action sequence; wherein the optimal response action sequence includes a number of response actions related to the policy conflict and the execution order of each of the response actions related to the policy conflict.

9. The asset security protection strategy adaptive adjustment method according to claim 8, characterized in that: Based on the security event log, identifying policy conflicts and abnormal behavior patterns between assets to generate reports related to associated events, specifically: Parsing and standardizing the security event log to obtain standardized log data; Using the Apriori algorithm to mine association rules on the standardized log data; Based on the results of association rule mining, determine whether each security event is a related event, and combine all related events and the standardized log data corresponding to all related events to generate reports related to the related events.

10. An asset security protection strategy adaptive adjustment system, characterized in that: include: A data acquisition module, used to acquire first asset information of an asset to be processed in a hybrid cloud environment, and generate multiple security protection strategies corresponding to the asset to be processed based on the first asset information; wherein the asset to be processed is an on-cloud asset or an off-cloud asset; A policy conflict detection module is used to perform conflict detection and conflict classification on each of the security protection policies, obtain a corresponding conflict policy list, and use the conflict policy list to perform real-time correlation analysis on the policy conflicts between assets and security event logs to obtain a policy conflict solution; A script generation module, used to generate corresponding configuration scripts by using a policy orchestration engine and combining all the security protection policies and the policy description information corresponding to all the security protection policies; An asset deployment module, used to control the asset to be processed to be automatically deployed based on the configuration script, and obtain the second asset information of the asset to be processed that has completed the automatic deployment; The policy adjustment module is used to analyze the degree of change of the asset scale of the current assets to be processed based on the second asset information, and dynamically adjust the security protection policy of the current assets to be processed if the degree of change is greater than a preset value.

Images