A method and system for adaptively adjusting asset security protection strategies

Abstract

The present invention discloses a method and system for adaptively adjusting asset security protection strategies, comprising: obtaining first asset information of cloud assets or off-cloud assets in a hybrid cloud environment, and generating multiple security protection strategies based on the first asset information; performing conflict detection and conflict classification on each security protection strategy to obtain a conflict strategy list, and using the list to perform real-time correlation analysis of policy conflicts between assets and security event logs to obtain a policy conflict resolution plan; generating a configuration script based on all security protection strategies and their corresponding policy description information; using the configuration script to achieve automated asset deployment, and analyzing the degree of change in the current asset scale based on second asset information of the assets that have completed automated deployment, and dynamically adjusting the security protection strategy if the degree of change is greater than a preset value. By adopting the embodiments of the present invention, potential policy conflicts can be quickly located, and strategies can be adaptively adjusted to improve asset security.

Description

Technical Field

[0001] The present invention relates to the technical field of security protection strategy adjustment, and in particular to a method and system for adaptively adjusting asset security protection strategies. Background Art

[0002] In the process of protecting cloud asset risks, due to the diversity of asset types and business scenarios, multiple protection strategies are often required to address different risks. However, as the number of policies increases, conflicts may arise between them, resulting in a decrease in protection effectiveness or even canceling each other out. For example, for the same cloud host, an intrusion detection policy may require certain ports to be open for monitoring, while an access control policy may require these ports to be closed to reduce the attack surface. Further complicating matters, multiple protection policies may cross-operate on the same assets, making their interdependencies and impacts difficult to intuitively identify and characterize. Therefore, there is an urgent need for an automated policy conflict detection mechanism that can comprehensively analyze existing protection policies, accurately locate various conflicts, and provide intuitive conflict descriptions and remediation suggestions. This would provide decision support for security administrators, eliminate policy blind spots, and improve the overall protection level of cloud assets. Summary of the Invention

[0003] The embodiments of the present invention provide a method and system for adaptively adjusting asset security protection strategies, which can quickly identify potential conflicts in positioning strategies and adaptively adjust asset security protection strategies in response to changes in asset scale, thereby improving the response speed and processing capabilities to security incidents.

[0004] To solve the above technical problems, an embodiment of the present invention provides a method for adaptively adjusting an asset security protection strategy, comprising:

[0005] Obtaining first asset information of an asset to be processed in a hybrid cloud environment, and generating multiple security protection policies corresponding to the asset to be processed based on the first asset information; wherein the asset to be processed is an on-cloud asset or an off-cloud asset;

[0006] Perform conflict detection and conflict classification on each of the security protection policies to obtain a corresponding conflict policy list, and use the conflict policy list to perform real-time correlation analysis on policy conflicts between assets and security event logs to obtain policy conflict resolution solutions;

[0007] Using a policy orchestration engine, combining all the security protection policies and the policy description information corresponding to all the security protection policies, to generate corresponding configuration scripts;

[0008] Based on the configuration script, controlling the asset to be processed to be automatically deployed, and obtaining second asset information of the asset to be processed that has completed the automatic deployment;

[0009] Based on the second asset information, the degree of change in the asset size of the current asset to be processed is analyzed. If the degree of change is greater than a preset value, the security protection strategy of the current asset to be processed is dynamically adjusted.

[0010] By implementing an embodiment of the present invention, first asset information of an on-cloud asset or an off-cloud asset in a hybrid cloud environment is obtained, and based on the first asset information, multiple security protection policies corresponding to the asset are generated, and then conflict detection and conflict classification are performed on each security protection policy to obtain a corresponding conflict policy list. The background and impact of security incidents on policy conflicts are fully considered, and the conflict policy list is used to perform real-time correlation analysis between policy conflicts and security event logs between assets to obtain a policy conflict solution to improve the effectiveness of the policy conflict solution. Moreover, by performing conflict detection, conflict classification and real-time correlation analysis on security policies, potential conflicts in positioning policies can be quickly identified, thereby improving the response speed and processing capabilities to security incidents. In addition, a policy orchestration engine is used to combine all security protection policies and the policy description information corresponding to all security protection policies to generate corresponding configuration scripts, which greatly improves the deployment efficiency of asset security protection policies and reduces manual intervention and operational errors. Then, based on the configuration script, the asset is controlled for automatic deployment, and the second asset information of the asset that has completed the automatic deployment is obtained. Finally, based on the second asset information, the degree of change in the current asset scale of the asset is analyzed. If the degree of change is greater than the preset value, the current security protection policy of the asset is dynamically adjusted to ensure the security of assets on or off the cloud in different scales and complex environments, so as to enhance the adaptability and flexibility of the system, and reduce security risks caused by human negligence or outdated policies, thereby improving overall security.

[0011] As a preferred solution, the policy orchestration engine is used to combine all the security protection policies and the policy description information corresponding to all the security protection policies to generate corresponding configuration scripts, specifically:

[0012] Using a policy orchestration engine to parse each of the security protection policies and obtain policy description information corresponding to each of the security protection policies;

[0013] Performing syntax analysis and semantic checking on the policy description information corresponding to each of the security protection policies to obtain an intermediate representation of each of the security protection policies;

[0014] The configuration template library of the platform corresponding to the asset to be processed is called, and the configuration script corresponding to the intermediate representation of each security protection policy is obtained from the configuration template library.

[0015] Implementation of the preferred solution of the present invention performs syntax analysis and semantic checking on the policy description information corresponding to each security protection policy, ensuring that all security protection policies adhere to a unified standard format. This reduces errors and deviations in policy development and deployment, and improves policy consistency. Furthermore, by invoking the configuration template library of the platform corresponding to the asset being processed and retrieving configuration scripts corresponding to the intermediate representation of each security protection policy from the configuration template library, the system can quickly adapt to different platforms and environments, ensuring the universality and compatibility of the generated configuration scripts and reducing platform restrictions.

[0016] As a preferred solution, the first asset information of the asset to be processed in the hybrid cloud environment is obtained, and based on the first asset information, multiple security protection policies corresponding to the asset to be processed are generated, specifically:

[0017] Obtaining first asset information of an asset to be processed in a hybrid cloud environment, and drawing a hybrid cloud network topology map based on the first asset information; wherein the hybrid cloud network topology map includes annotations indicating connection relationships between various network areas on and off the cloud;

[0018] Analyze the firewall logs and network traffic of the asset to be processed, and combine the analysis results with the hybrid cloud network topology diagram to identify the data flow path and determine the key network nodes and data exchange points;

[0019] generating a plurality of security protection strategies corresponding to the asset to be processed based on the data flow path, the key network nodes, and the data exchange points;

[0020] The security protection strategy includes:

[0021] Deploy a Web application firewall based on the key network nodes; wherein the Web application firewall selects corresponding protection rules based on the asset location, wherein the asset location includes both on-cloud and off-cloud;

[0022] According to the data flow path, deploy the IBM Guardium database audit tool on the database front end, and implement role-based fine-grained access control through the IBM Guardium database audit tool;

[0023] Dynamically desensitize sensitive data fields and set corresponding desensitization rules for each user role.

[0024] By implementing the preferred solution of the embodiment of the present invention, by drawing a hybrid cloud network topology diagram, it is possible to clearly understand the network structure and connection relationship on and off the cloud, thereby more effectively formulating and deploying security protection strategies and improving overall security. Then, the firewall logs and network traffic of the assets to be processed are analyzed, and the analysis results and the hybrid cloud network topology diagram are combined to identify the data flow path and determine the key network nodes and data exchange points, which can help to accurately locate potential threats and vulnerabilities. Then, based on the data flow path, key network nodes and data exchange points, multiple security protection strategies corresponding to the assets to be processed are generated, that is, they can respond to changes in the data flow path, key network nodes and data exchange points, and dynamically adjust the security protection strategy to ensure that the strategy always matches the current environment, thereby improving the flexibility and adaptability of the strategy. Furthermore, deploying a Web application firewall based on key network nodes and selecting corresponding protection rules according to the asset location can provide fine-grained protection for both on-cloud and off-cloud, effectively resisting various attacks on Web applications. In addition, deploying the IBM Guardium database audit tool on the database front end based on the data flow path can implement role-based fine-grained access control, ensuring that only authorized users can access sensitive data, improving data confidentiality and integrity. In addition, dynamic desensitization of sensitive data fields and setting corresponding desensitization rules for different user roles can protect the security of sensitive data and prevent data leakage without affecting business processes.

[0025] As a preferred solution, the configuration script is used to control the asset to be processed to be automatically deployed, and the second asset information of the asset to be processed that has completed the automatic deployment is obtained, specifically:

[0026] Transferring the configuration script to the Ansible configuration management tool;

[0027] Generate deployment instructions based on the configuration script using the Ansible configuration management tool, and send the deployment instructions to the asset to be processed;

[0028] When a change in the cloud platform's assets is detected, Nmap is called to identify the changed assets in the cloud platform. The asset list is updated based on the identification results and the CMDB system. Based on the updated asset list, the second asset information of the current pending assets is obtained.

[0029] The preferred solution of the embodiment of the present invention is to call Nmap to identify the changed assets in the cloud platform when a change is detected in the cloud platform's assets. This can achieve real-time monitoring and detection of assets on the cloud, ensuring timely detection of asset changes and improving the real-time nature of asset management. In addition, the identification results are combined with the CMDB (configuration management database) system to update the asset list and asset information, ensuring the accuracy and real-time nature of asset information and reducing configuration errors caused by lagging asset information. In addition, the configuration script is transmitted to the Ansible configuration management tool, and deployment instructions are generated based on the configuration script. This can realize the automated deployment of security protection policies, reduce manual operations, and improve deployment efficiency and accuracy.

[0030] As a preferred solution, based on the second asset information, the change degree of the asset size of the current asset to be processed is analyzed. If the change degree is greater than a preset value, the security protection strategy of the current asset to be processed is dynamically adjusted, specifically:

[0031] Calculate the asset quantity change rate of the current assets to be processed and predict the asset change trend of the current assets to be processed by combining the second asset information with the autoregressive integrated moving average model;

[0032] If the asset quantity change rate of the current assets to be processed is greater than a preset value, the security policy evaluation model is started to re-evaluate the security protection strategy, database access control and data encryption measures corresponding to the current assets to be processed, generate new configuration parameter recommendations, and dynamically adjust the security protection strategy of the current assets to be processed; wherein, the security policy evaluation model is pre-built based on the random forest algorithm.

[0033] The preferred solution of the embodiment of the present invention is to calculate the asset quantity change rate of the current assets to be processed and predict the asset change trend of the current assets to be processed through the autoregressive integral moving average model in combination with the second asset information. This can help enterprises understand the dynamic changes of assets in advance and provide data support for security policy adjustments. If the asset quantity change rate of the current assets to be processed is greater than the preset value, the security policy evaluation model is started to re-evaluate the security protection policy, database access control and data encryption measures corresponding to the current assets to be processed, generate new configuration parameter recommendations, and dynamically adjust the security protection policy of the current assets to be processed, so that the security protection policy can better adapt to changes in assets and improve the flexibility and adaptability of the policy. In addition, the use of the random forest algorithm to pre-construct a security policy evaluation model can comprehensively consider multi-dimensional security factors, provide a scientific and comprehensive security policy evaluation, and enhance the scientificity and accuracy of decision-making.

[0034] As a preferred solution, conflict detection and conflict classification are performed on each of the security protection policies to obtain a corresponding conflict policy list, and the conflict policy list is used to perform real-time correlation analysis on the policy conflicts between assets and security event logs to obtain a policy conflict solution, specifically:

[0035] Based on the first asset information, abstracting the differentiated protection requirements of the assets to be processed into a policy rule set;

[0036] Based on the policy rule set, determining the policy priority of each of the security protection policies and generating an initial security policy library;

[0037] Conflict detection is performed on the initial security policy library. If policy conflicts are detected in the initial security policy library, logical identification analysis is performed on each of the security protection policies to obtain a list of conflicting policies. The list of conflicting policies is used to perform real-time correlation analysis on the policy conflicts between assets and security event logs to obtain a policy conflict solution.

[0038] The preferred solution of the embodiment of the present invention is to abstract the differentiated protection requirements of the assets to be processed into a policy rule set, and then determine the policy priority of each security protection policy based on the policy rule set and generate an initial security policy library, which can accurately identify the specific protection requirements of each asset, so that each security protection policy in the initial security policy library has its own corresponding policy priority, which can meet the security needs of different assets in a targeted manner. If a policy conflict is detected in the initial security policy library, a logical identification analysis is performed on each security protection policy to obtain a list of conflicting policies, so as to more accurately locate and understand the cause of the policy conflict, provide detailed data support for the formulation of solutions, and use the conflicting policy list to conduct real-time correlation analysis of policy conflicts between assets and security event logs, so as to promptly discover security incidents caused by policy conflicts and quickly formulate policy conflict solutions to reduce the scope of the impact of security incidents.

[0039] As a preferred solution, the initial security policy library is subjected to conflict detection. If a policy conflict is detected in the initial security policy library, each of the security protection policies is logically identified and analyzed to obtain a conflict policy list. The conflict policy list is then used to perform real-time correlation analysis on the policy conflicts between assets and security event logs to obtain a policy conflict solution, specifically:

[0040] Performing conflict detection on the initial security policy library. If a policy conflict is detected in the initial security policy library, using a Prolog logic reasoning engine to identify policy semantic conflicts and rule conflicts for each of the security protection policies, obtaining semantic conflicts and rule conflicts between the security protection policies, performing priority comparison on the security protection policies, obtaining priority conflicts between the security protection policies, and then combining the semantic conflicts, rule conflicts, and priority conflicts between the security protection policies to form a conflicting policy list.

[0041] By utilizing the conflicting policy list, real-time correlation analysis is performed on the policy conflicts between assets and security event logs to obtain a policy conflict resolution solution.

[0042] According to the preferred solution of the embodiment of the present invention, if a policy conflict is detected in the initial security policy library, the Prolog logic reasoning engine is used to perform in-depth policy semantic conflict and rule conflict identification on the security protection policy, which can ensure that all potential policy conflicts are accurately detected, thereby improving the consistency and effectiveness of the policy, and compare the priorities of various security protection policies to obtain the priority conflicts between various security protection policies. Then, the semantic conflicts, rule conflicts and priority conflicts between various security protection policies are combined to form a detailed conflict policy list, which clearly presents all types of conflicts between all policies, so as to help enterprises better manage and execute security policies, ensure that the most critical and urgent policies are executed first, and improve the efficiency and effectiveness of security protection.

[0043] As a preferred solution, the asset security protection strategy adaptive adjustment method further includes:

[0044] Obtaining security event logs from the asset to be processed;

[0045] Based on the security event log, identifying policy conflicts and abnormal behavior patterns between assets to generate reports related to the associated events;

[0046] Using a pre-built decision tree model, the associated events are classified and matched with response plans to obtain a preliminary response execution plan;

[0047] Based on the historical response effect data of the preliminary response execution plan, the preliminary response execution plan is dynamically optimized to determine the optimal response action sequence; wherein the optimal response action sequence includes several response actions related to the policy conflict and the execution order of each of the response actions related to the policy conflict.

[0048] Implementing the preferred solution of the present invention's embodiment, which captures security event logs from the assets to be processed, enables real-time monitoring and identification of policy conflicts and abnormal behavior patterns between assets, ensuring timely detection and resolution of potential security threats. Furthermore, utilizing a pre-built decision tree model to classify related events and match them with response plans, a preliminary response execution plan can be quickly determined, improving the efficiency and accuracy of event response. Based on the preliminary response execution plan's historical response effectiveness data, the preliminary response execution plan is then dynamically optimized to determine the optimal response action sequence, ensuring that the response plan is always in optimal condition and enhancing response effectiveness.

[0049] As a preferred solution, based on the security event log, identifying policy conflicts and abnormal behavior patterns between assets to generate reports related to associated events is specifically as follows:

[0050] Parsing and standardizing the security event log to obtain standardized log data;

[0051] Using the Apriori algorithm to perform association rule mining on the standardized log data;

[0052] Based on the association rule mining results, determine whether each security event is a related event, and combine all related events and the standardized log data corresponding to all related events to generate reports related to the related events.

[0053] Implementing the preferred solution of the present invention's embodiment, parsing and standardizing security event logs can eliminate format differences and noise in log data, ensuring data consistency and usability, and providing a high-quality data foundation for subsequent analysis and processing. Furthermore, using the Apriori algorithm to perform association rule mining on standardized log data can quickly identify frequent patterns and association rules in the log data, helping to discover potential relationships and patterns hidden in the data.

[0054] To solve the same technical problem, an embodiment of the present invention further provides an asset security protection strategy adaptive adjustment system, including:

[0055] A data acquisition module is configured to acquire first asset information of an asset to be processed in a hybrid cloud environment, and generate a plurality of security protection policies corresponding to the asset to be processed based on the first asset information; wherein the asset to be processed is an on-cloud asset or an off-cloud asset;

[0056] A policy conflict detection module is used to perform conflict detection and conflict classification on each of the security protection policies, obtain a corresponding conflict policy list, and use the conflict policy list to perform real-time correlation analysis on policy conflicts between assets and security event logs to obtain policy conflict resolution solutions;

[0057] A script generation module is used to use a policy orchestration engine to combine all the security protection policies and the policy description information corresponding to all the security protection policies to generate corresponding configuration scripts;

[0058] An asset deployment module, configured to control the automated deployment of the asset to be processed based on the configuration script, and obtain second asset information of the asset to be processed that has completed the automated deployment;

[0059] The policy adjustment module is used to analyze the degree of change in the asset size of the current asset to be processed based on the second asset information, and dynamically adjust the security protection policy of the current asset to be processed if the degree of change is greater than a preset value. BRIEF DESCRIPTION OF THE DRAWINGS

[0060] Figure 1 : A flowchart of a method for adaptively adjusting an asset security protection strategy provided in Example 1 of the present invention;

[0061] Figure 2 : A structural diagram of an asset security protection strategy adaptive adjustment system provided in Example 1 of the present invention. DETAILED DESCRIPTION

[0062] The following will clearly and completely describe the technical solutions in the embodiments of the present invention in conjunction with the accompanying drawings. Obviously, the described embodiments are only part of the embodiments of the present invention, not all of the embodiments. All other embodiments obtained by ordinary technicians in this field based on the embodiments of the present invention without making any creative efforts shall fall within the scope of protection of the present invention.

[0063] Embodiment one:

[0064] Please refer to Figure 1 , an embodiment of the present invention provides an asset security protection strategy adaptive adjustment method, the method includes steps S1 to S5, each step is specifically as follows:

[0065] Step S1: Acquire first asset information of an asset to be processed in a hybrid cloud environment, and generate multiple security protection policies corresponding to the asset to be processed based on the first asset information.

[0066] Among them, the assets to be processed are on-cloud assets or off-cloud assets.

[0067] In this embodiment, the first asset information of the asset to be processed includes, but is not limited to, network location, operating system type, and data sensitivity; the security protection policy includes, but is not limited to, WAF protection policy, database access control, and data encryption measures. WAF (Web Application Firewall) refers to a Web application firewall.

[0068] As a preferred solution, step S1 includes steps S11 to S13, and the details of each step are as follows:

[0069] Step S11: obtaining first asset information of an asset to be processed in a hybrid cloud environment, and drawing a hybrid cloud network topology map based on the first asset information.

[0070] The hybrid cloud network topology diagram includes annotations that represent the connection relationships between various network areas on and off the cloud.

[0071] In this example, we first obtain an inventory of both on- and off-cloud assets in a hybrid cloud environment. We then use Nmap to scan and collect attributes based on the on- and off-cloud asset inventory. Key attribute information, such as the network location, operating system type, and data sensitivity, is recorded for each asset to be processed as the primary asset information. Next, we assign security levels based on asset importance, using evaluation criteria including data sensitivity and business impact. We then establish an asset attribute database. Finally, we use SolarWinds Network Topology Mapper to create a hybrid cloud network topology diagram, noting the connections between the various on- and off-cloud network areas.

[0072] As an example, when performing an asset scan using Nmap, a TCP SYN scan was employed, with a scan frequency set to 1,000 packets per second to balance scan speed and network load. The scan results showed a total of 500 devices in the hybrid cloud environment, including 300 on-cloud assets and 200 off-cloud assets. Asset importance was assessed using a 5-point scale, with scores calculated based on data sensitivity and business impact. Assets with scores above 3 were classified as high-risk. Furthermore, when drawing a network topology map, SolarWinds Network Topology Mapper automatically discovered network devices using SNMP and WMI protocols, generating a topology map containing 50 nodes.

[0073] Step S12: Analyze the firewall logs and network traffic of the asset to be processed, and combine the analysis results with the hybrid cloud network topology diagram to identify the data flow path and determine the key network nodes and data exchange points.

[0074] In this embodiment, the data flow path is identified by analyzing the firewall log and the Wireshark network traffic monitoring tool, and the key network nodes and data exchange points that need to be protected are determined.

[0075] As an example, Wireshark was used to perform traffic analysis, capture 10GB of network traffic, and identify five key data flow paths.

[0076] Step S13: Generate multiple security protection strategies corresponding to the assets to be processed based on the data flow path, key network nodes and data exchange points.

[0077] The security protection strategy includes the following measures:

[0078] ① Deploy Web application firewalls based on key network nodes.

[0079] Among them, the Web Application Firewall selects corresponding protection rules based on the asset location, which includes both on-cloud and off-cloud.

[0080] In this embodiment, AWS WAF is deployed for on-cloud assets, and protection rules tailored to the characteristics of web applications are set; while for off-cloud assets, F5 BIG-IP ASM is used for protection, and targeted SQL injection, XSS and other attack defense strategies are configured.

[0081] In addition, through the Splunk Security Information and Event Management System (Splunk SIEM system), cloud-based and off-cloud WAF linkage is achieved, and security events and alarms are centrally managed.

[0082] As an example, the AWS WAF configuration includes 50 custom rules covering the OWASP Top 10 security risks. F5 BIG-IP ASM is deployed in a cloud environment with machine learning enabled, and a baseline model is established by analyzing one week of normal traffic. The Splunk SIEM system is configured with 100 correlation rules to enable real-time correlation analysis of WAF events.

[0083] ② Based on the data flow path, deploy the IBM Guardium database audit tool on the database front end, and use the IBM Guardium database audit tool to implement role-based fine-grained access control.

[0084] As an example, the IBM Guardium database audit tool monitors 10 key databases, records SQL queries and assigns risk scores.

[0085] ③Dynamically desensitize sensitive data fields and set corresponding desensitization rules for each user role.

[0086] As an example, use Informatica Data Masking to dynamically mask sensitive fields (such as ID card number, bank card number, etc.) and return different levels of masking results based on user roles.

[0087] Furthermore, the security protection strategy also includes: configuring firewall rules based on network topology and data flow information to limit access rights between different network segments; regularly using vulnerability scanning tools such as Qualys to conduct security assessments of on- and off-cloud assets, and updating security protection strategies based on the scan results.

[0088] As an example, firewall rules are configured based on the principle of least privilege, with a total of 500 access control lists. Qualys vulnerability scanning performs a full scan weekly at a depth of 3. The scan results reveal 10 high-risk vulnerabilities, 50 medium-risk vulnerabilities, and 100 low-risk vulnerabilities. Based on these scan results, patch management policies are updated, prioritizing remediation of high-risk vulnerabilities with a score greater than 7.

[0089] It should be noted that the effectiveness of all security measures is continuously monitored by the Security Operations Center (SOC), and a security situation report is generated monthly, including key performance indicators (KPIs) such as security incident response time and vulnerability repair rate.

[0090] Furthermore, the security protection strategy also includes: for cloud assets, deploying security components including distributed denial of service attack protection, network application firewall, and web application deployment DDoS protection components; implementing fine-grained access control for local core databases, including role-based access control, column-level encryption, and dynamic data desensitization, consistent with the security policy of cloud assets. Specifically, the above security protection strategy includes steps S01 to S08, each of which is as follows:

[0091] Step S01: Receive inbound traffic information carrying a unique identifier of a cloud asset. The inbound traffic information is sent when the cloud asset accesses the network.

[0092] Among them, SSL / TLS encrypted channels are used during data transmission to ensure the security of data throughout its entire life cycle; specifically, SSL / TLS encryption adopts the TLS1.3 protocol, the key exchange algorithm is ECDHE, and the symmetric encryption algorithm is AES-256-GCM.

[0093] In step S02, a traffic monitoring instruction is sent to the traffic cleaning center based on the inbound traffic information. The traffic cleaning center monitors and filters the inbound traffic in real time based on the traffic monitoring instruction. If it is detected that the inbound traffic exceeds the preset traffic threshold, the cleaning mechanism is triggered to divert the abnormal traffic to the cleaning device for deep packet inspection and feature matching.

[0094] Specifically, when traffic exceeds a threshold, a scrubbing mechanism is triggered, directing traffic to a scrubbing appliance with 10Tbps processing capacity. This scrubbing appliance uses deep packet inspection technology to identify and filter malicious traffic by analyzing packet header information, payload characteristics, and behavioral patterns. Furthermore, the random forest algorithm within the network application firewall utilizes 100 decision trees, each trained based on a different subset of features, such as request frequency, URL parameters, and HTTP headers. During real-time analysis, if more than 60% of the decision trees identify a request as anomalous, protective measures are triggered.

[0095] As an example, when deploying the distributed denial of service attack protection component, the traffic scrubbing center uses an adaptive threshold algorithm to calculate a baseline based on the past 30 days of traffic data and set dynamic thresholds. For example, for an application with an average daily traffic of 100Gbps, the normal peak traffic may reach 150Gbps. In this case, the threshold is set to 200Gbps.

[0096] As another example, the traffic threshold is dynamically set based on the application scale and historical traffic data, and the threshold range is between 5,000 and 50,000 packets per second.

[0097] Step S03: Receive anomaly detection results with HTTP request features.

[0098] Among them, before executing step S04, a network application firewall is deployed in advance on the front end of the Web application on the cloud, and an anomaly detection module based on the random forest algorithm is configured to perform real-time analysis on HTTP requests, identify attack behaviors such as SQL injection and cross-site scripting (and obtain "anomaly detection results with HTTP request characteristics"), and set protection rules including request frequency limit, IP reputation check, malicious signature matching, etc.

[0099] Step S04, determine whether there is a low-reputation IP address related to the HTTP request feature in the IP reputation database; if there is a low-reputation IP address related to the HTTP request feature in the IP reputation database, then determine that the HTTP request feature is illegal; if there is no low-reputation IP address related to the HTTP request feature in the IP reputation database, then determine that the HTTP request feature is legal.

[0100] Specifically, IP reputation checking is implemented by integrating the Spamhaus IP reputation database, which automatically updates the local IP reputation database every hour (the IP reputation checking module obtains updates from Spamhaus every hour, which contains approximately 1 million malicious IP addresses).

[0101] Step S05: If the HTTP request feature is legal, the HTTP request is allowed to pass through the network application firewall.

[0102] Step S06: receiving access request information for the local core database, sending access control instructions to the XACML policy decision point according to the access request information, and the XACML policy decision point performs real-time evaluation and decision on the access request according to the access control instructions.

[0103] Specifically, fine-grained access control is implemented for the local core database, using an attribute-based access control model and XACML (Extensible Access Control Markup Language) to define access policies. This combines the three dimensions of user, resource, and operation to construct an access policy matrix. Each access request is evaluated and decided in real time through the XACML Policy Decision Point (PDP), determining whether it complies with the preset access rules.

[0104] As an example, access control for a local database uses XACML to define fine-grained policies, such as "Allow users in the finance department to view but not modify financial statements during working hours." The XACML policy decision point can handle 1,000 access requests per second with an average response time of 10 milliseconds.

[0105] Step S07: If it is determined that the access request complies with the preset access rules, access to the local core database is allowed.

[0106] Step S08: Acquire sensitive column data that needs to be encrypted and stored, and encrypt the sensitive column data.

[0107] Specifically, column-level encryption and dynamic data desensitization are implemented. Sensitive column data is encrypted and stored using the AES-256 algorithm (with a 256-bit key length). HashiCorp Vault is used for key storage and management, and key rotation and access auditing are implemented (keys are updated every 90 days). During data queries, data is dynamically desensitized based on user roles and permission levels. Desensitization rules include partial hiding, full hiding, and replacement (dynamic data desensitization processes sensitive information according to predefined rules, such as replacing the middle 8 digits of a credit card number with asterisks). A central policy management platform is used to uniformly manage cloud and local security policies to ensure policy consistency. The policy synchronization mechanism includes regular hourly synchronization (the central policy management platform performs full policy synchronization every hour, and the change detection mechanism is enabled at the same time), real-time change detection (when a policy change is detected, the update is pushed to all endpoints within 30 seconds) and automatic deployment, pushing policy updates to cloud and local security components through the XACML Policy Distribution Point (PDP) (the XACML Policy Distribution Point adopts a publish-subscribe model to ensure that cloud and local components can receive and apply the latest security policies in a timely manner, thereby maintaining the consistency of the overall security posture).

[0108] In step S2, conflict detection and conflict classification are performed on each security protection policy to obtain a corresponding conflict policy list. The conflict policy list is used to perform real-time correlation analysis on the policy conflicts between assets and security event logs to obtain a policy conflict solution.

[0109] As a preferred solution, step S2 includes steps S21 to S23, and each step is specifically as follows:

[0110] Step S21: Based on the first asset information, the differentiated protection requirements of the asset to be processed are abstracted into a policy rule set.

[0111] In this embodiment, the first asset information also includes the asset type and security protection level. Specifically, an asset relationship model is constructed using the Neo4j graph database. This asset relationship model, combined with the first asset information, is then used to classify and label the assets to be processed in the heterogeneous network environment, resulting in an asset classification result. Based on the asset classification result, a security policy model is then constructed using the Extensible Access Control Markup Language (XACML). The security policy model is used to abstract the protection requirements of both on- and off-cloud assets into a set of policy rules.

[0112] As an example, security protection levels are categorized as high, medium, and low. The asset relationship model contains 10,000 nodes and 50,000 relationships. Using graph algorithms to calculate connectivity and centrality between assets, 20 key nodes can be identified. The XACML-based security policy model defines 500 security rules covering access control, data protection, and network isolation.

[0113] In step S22, the rule similarity is calculated based on the policy rule set through a rule matching algorithm, and the policy priority of each security protection policy is determined and an initial security policy library is generated.

[0114] As an example, the rule matching algorithm uses cosine similarity calculation with a threshold of 0.8. Rules with similarity higher than the threshold are merged and optimized, and finally 400 non-redundant rules are obtained.

[0115] In step S23, conflict detection is performed on the initial security policy library. If policy conflicts are detected in the initial security policy library, logical identification and analysis are performed on each security protection policy to obtain a list of conflicting policies. The list of conflicting policies is used to perform real-time correlation analysis on the policy conflicts between assets and security event logs to obtain a solution to the policy conflict.

[0116] As a preferred solution, step S23 includes step S231 to step S232, and each step is specifically as follows:

[0117] In step S231, a conflict detection is performed on the initial security policy library. If a policy conflict is detected in the initial security policy library, the Prolog logic reasoning engine is used to identify the policy semantic conflicts and rule conflicts of each security protection policy, and obtain the semantic conflicts and rule conflicts between each security protection policy. The priority of each security protection policy is compared to obtain the priority conflicts between each security protection policy. Then, the semantic conflicts, rule conflicts and priority conflicts between each security protection policy are combined to form a conflict policy list and generate conflict resolution suggestions.

[0118] As an example, the Prolog logic inference engine analyzed the policy library and found 50 semantic conflicts and 30 rule conflicts. Priority comparison revealed 20 priority conflicts. Conflict resolution suggestions included rule merging, priority adjustment, and condition refinement.

[0119] In step S232, the conflicting policy list is used to perform real-time correlation analysis on the policy conflicts between assets and the security event logs to obtain a policy conflict resolution solution.

[0120] Specifically, step S232 includes step S2321 to step S2322, and each step is as follows:

[0121] In step S2321, the Apache Flink real-time data stream processing platform is used to perform real-time correlation analysis on the conflicting policy list, the policy conflicts between assets and the security event logs, and the long short-term memory network (LSTM) is used to identify time series anomaly patterns. The isolation forest algorithm is combined to perform anomaly detection and identify suspicious security events.

[0122] As an example, the Apache Flink real-time processing platform processes 10,000 log events per second. An LSTM network is trained based on seven days of historical data, with a prediction window of one hour. The Isolation Forest algorithm is set to an anomaly threshold of 0.95 and detects 100 potential anomalies.

[0123] Step S2322: Based on the correlation analysis results and combined with the asset status information in the cloud environment, a policy conflict solution and security incident warning information are generated, and the updated security policy is automatically applied through the policy execution engine to achieve dynamic security protection.

[0124] As an example, the policy execution engine updates the security policy every 5 minutes, with an average response time of 100 milliseconds, to dynamically update the protection configuration of 500 devices.

[0125] Furthermore, step S2 also includes a policy defect redundancy processing process, which includes steps S201 to S202. The details of each step are as follows:

[0126] Step S201 compares the security policy actually deployed on the asset with the cloud service provider's standard policy template to identify differences in policy attributes and determine whether there are policy defects or redundancies.

[0127] Specifically, step S201 includes steps S2011 to S2015, and each step is as follows:

[0128] In step S2011, the Ansible configuration management tool is used to obtain security policy information carrying the asset identification number and the cloud service provider's standard policy template from the asset.

[0129] As an example, the Ansible configuration management tool is used to scan 1,000 servers in the enterprise network to extract the security policy configuration files on each server and obtain standard policy templates from the cloud service provider's API.

[0130] In step S2012, based on the security policy information and the pre-established cloud service provider standard policy template, the Word2Vec semantic similarity algorithm is used to compare the policy attributes of the asset security policy with those of the standard policy template, identifying differences and generating a difference report. Policy attributes include, but are not limited to, access control rules, data encryption configuration, and intrusion detection rules.

[0131] As an example, the Word2Vec algorithm uses a 100-dimensional vector to represent policy attributes. The actual policy and the standard template are compared by calculating the cosine similarity. The threshold is set to 0.8, and attributes below the threshold are marked as differences.

[0132] In step S2013, based on the difference item, the random forest algorithm is used to consider multiple features such as policy coverage and execution frequency to calculate the policy attribute value, and then determine whether there is a policy defect or redundancy; if the policy attribute value is lower than the standard template threshold, the policy is determined to be a policy defect; if the policy attribute value is higher than the standard template threshold, the policy is determined to be a policy redundancy.

[0133] As an example, the discrepancy report shows discrepancies in 300 policy attributes. The random forest algorithm uses 1,000 decision trees, each considering five features, including policy coverage, execution frequency, and update time. Policy attribute values ​​that deviate by more than 20% from the standard template threshold are considered deficient or redundant, identifying 150 policy deficiencies and 50 policy redundancies.

[0134] In step S2014, for policies identified as flawed, the cloud provider's security best practices knowledge base is accessed and the BERT model is used to extract knowledge from the knowledge base. Combined with asset feature tags, policy remediation suggestions are automatically generated based on the rule template. These remediation suggestions include missing access control rules, data encryption configurations, and / or intrusion detection rules.

[0135] As an example, the BERT model extracted knowledge from a 10GB security best practices document and generated 5,000 rule templates. Asset attribute tags included 10 dimensions, including operating system type, network location, and data sensitivity. Combining the rule templates with the asset attributes, they automatically generated 200 new access control rules, 50 data encryption configurations, and 100 intrusion detection rules.

[0136] In step S2015, for policies identified as redundant, the PageRank graph analysis algorithm analyzes inter-policy dependencies, quantifies the importance of each policy, and determines the necessity of redundant policies for asset protection. If there are no dependencies and the protection level is too high, recommendations are generated to merge or delete policies and a simplified policy configuration is output. The Terraform policy orchestration tool automatically applies the remediation recommendations and simplification solutions, enabling automated policy updates and deployment, ensuring consistent and optimized security policies for both on- and off-cloud assets.

[0137] As an example, the PageRank algorithm analyzed 5,000 dependencies between 1,000 policy nodes. Policies with an importance score below 0.01 were considered deletable, ultimately identifying 30 policies that could be merged and 20 that could be deleted. The Terraform tool received the remediation suggestions and simplification plans, generated a 500-line Infrastructure as Code (IaC) script, and completed the policy update for all servers within 15 minutes, achieving consistent and optimized security policies for 1,000 servers on and off the cloud.

[0138] In step S202, policy configurations are matched from the cloud service provider's policy template library based on the business characteristics and security requirements of the assets to form policy optimization suggestions. The generated policy repair, simplification, and optimization suggestions are submitted to the cloud service provider's security orchestration engine. Through the automated policy distribution and execution mechanism, the policy changes are applied to the cloud assets.

[0139] Specifically, step S202 includes steps S2021 to S2026, and each step is as follows:

[0140] In step S2021, the business feature information of the assets is obtained using ServiceNowCMDB, and the security requirement data is extracted using the ELKStack log analysis tool. Then, based on the business feature information and security requirement data, the assets are classified using a convolutional neural network to obtain an asset feature vector containing features such as business type, data sensitivity, and access frequency.

[0141] As an example, ServiceNow CMDB scanned the enterprise network and identified 1,000 cloud assets, including virtual machines, containers, and serverless functions. ELKStack analyzed logs from the past 30 days to extract the average daily request volume, data processing volume, and error rate for each asset. The convolutional neural network used three convolutional layers and two fully connected layers, taking in 20 metrics such as CPU usage, memory usage, and network traffic as input and outputting a 100-dimensional feature vector.

[0142] In step S2022, the cosine similarity algorithm is used to match the asset feature vector with the policy vector in the cloud service provider's policy template library, and a similarity value is calculated.

[0143] As an example, a cloud service provider's policy template library contains 10,000 predefined policies, each represented as a 100-dimensional vector. The cosine similarity algorithm calculates the similarity between the asset feature vector and the policy vector, with a threshold of 0.8 screening out an average of 50 candidate policies.

[0144] Step S2023: If the similarity value is higher than the preset threshold, the corresponding policy template is determined as a candidate optimization solution.

[0145] As an example, the preset threshold is set to 0.8.

[0146] In step S2024, a random forest algorithm is used to evaluate the candidate optimization solutions, and the optimal strategy configuration is selected based on the evaluation results to generate strategy optimization recommendations.

[0147] Specifically, factors such as policy coverage, CVSS security score, and JMeter performance test results are considered to select the optimal policy configuration and generate policy optimization recommendations.

[0148] As an example, the random forest algorithm uses 100 decision trees, each considering 10 features, including CVSS score (1-10), JMeter test response time (in milliseconds), and throughput (number of requests per second). The optimal policy configuration strikes a balance between security and performance, such as a CVSS score of at least 7.5 and a response time increase of no more than 5%.

[0149] Step S2025: Submit a policy change request through the API of the security orchestration engine.

[0150] Among them, policy change requests include but are not limited to policy repairs, simplifications, and optimization suggestions.

[0151] Specifically, policy repair, simplification, and optimization suggestions are integrated into a unified policy change plan, and policy change requests are submitted through the API of the security orchestration engine to trigger the automated policy distribution and execution mechanism.

[0152] As an example, the security orchestration engine analyzes policy change proposals and detects potential conflicts in 10% of the changes. It resolves 80% of the conflicts by adjusting rule priorities, and the remaining 20% ​​require manual intervention.

[0153] In step S2026, after receiving the policy change request, the security orchestration engine performs policy parsing, conflict detection, and rollback preparation, and applies the policy change to the target cloud assets.

[0154] In this embodiment, the Splunk security information and event management system is used to monitor the effects of policy changes, collect security events and performance indicators, and form feedback data for continuous optimization of policy configuration.

[0155] As an example, during policy deployment, the security orchestration engine creates a rollback snapshot for each change. The SplunkSIEM system collects metrics every five minutes, monitoring the number of security incidents and system performance changes over a seven-day period. If an anomaly is detected (such as a 20% increase in security incidents or a 10% performance drop), a policy rollback is automatically triggered.

[0156] In step S3, a policy orchestration engine is used to combine all security protection policies and the policy description information corresponding to all security protection policies to generate corresponding configuration scripts.

[0157] As a preferred solution, step S3 includes steps S31 to S33, and each step is specifically as follows:

[0158] In step S31, a policy orchestration engine is used to parse each security protection policy to obtain policy description information corresponding to each security protection policy.

[0159] It should be noted that the policy description information includes the security protection policy, which is in YAML format.

[0160] As an example, a YAML-formatted security policy file containing 50 rules is parsed using the policy orchestration engine.

[0161] In step S32, the policy description information corresponding to each security protection policy is parsed and semantically checked by using the ANTLR parser to obtain an intermediate representation of each security protection policy to ensure policy integrity and consistency.

[0162] As an example, an ANTLR parser performs 1000 syntax checks and 200 semantic validations, resulting in an intermediate representation graph containing 150 nodes.

[0163] Step S33: Call the configuration template library of the platform corresponding to the asset to be processed, and obtain the configuration script corresponding to the intermediate representation of each security protection policy from the configuration template library.

[0164] In this embodiment, the Jinja2 template engine is used to call the corresponding platform's configuration template library based on the intermediate representation to generate configuration scripts adapted to different cloud platforms and local environments. These configuration scripts include, but are not limited to, firewall rules, access control lists, and encryption parameters. These configuration scripts are used to address configuration differences between platforms.

[0165] As an example, using the Jinja2 template engine, templates for three cloud platforms (AWS, Azure, and Alibaba Cloud) and two local environments (Linux and Windows) are selected from the configuration template library to generate a total of 300 configuration scripts, covering firewall rules, access control lists, and encryption parameters.

[0166] Step S4: Based on the configuration script, control the asset to be processed to be automatically deployed, and obtain the second asset information of the asset to be processed that has completed the automatic deployment.

[0167] As a preferred solution, step S4 includes steps S41 to S43, and the details of each step are as follows:

[0168] Step S41: Transfer the configuration script to the Ansible configuration management tool.

[0169] In step S42, the Ansible configuration management tool is used to generate deployment instructions based on the configuration script and send the deployment instructions to the assets to be processed to trigger the automated deployment process, update the security configuration of assets such as the Web application server and database server, and set a failure retry mechanism and rollback strategy.

[0170] As an example, the Ansible tool pushed configurations to 1,000 cloud assets and 500 local assets in parallel, set a failure retry mechanism with three failure retries, each with an interval of 30 seconds, and achieved a deployment success rate of 99.5%.

[0171] Step S43: When a change in the cloud platform's assets is detected, Nmap is called to identify the changed assets in the cloud platform, and the asset list is updated based on the identification results and the CMDB system. Based on the updated asset list, the second asset information of the current asset to be processed is obtained.

[0172] In this embodiment, the cloud platform's elastic scaling events are monitored. When resource expansion or contraction is triggered, Nmap is automatically invoked for asset discovery, identifying newly added or deleted web applications and core database assets. The asset inventory is updated using the configuration management database (CMDB) system, and security policies are adjusted accordingly. Furthermore, the Zabbix asset information collection tool is used to obtain secondary asset information for the currently processed assets, which serves as asset size data.

[0173] For example, the cloud platform detected the addition of 50 web servers and 5 database servers within 10 minutes. Nmap immediately initiated a rapid scan, probing all 1024 ports in 2 minutes and identifying the operating system types and open services of the newly added assets. The CMDB system then updated the asset inventory and automatically assigned security groups to the new assets, inheriting 80% of the basic policies for existing assets of the same type and customizing 20% ​​of the rules based on the newly identified characteristics. Zabbix collects asset data every 5 minutes.

[0174] In this embodiment, Prometheus is used to monitor the system, collect security indicator data, and verify the effectiveness of policy deployment. If the security indicator data meets the preset threshold requirements, the personalized security protection policy deployment is determined to be successful.

[0175] Among them, security indicator data includes but is not limited to policy generation efficiency, false alarm rate and performance impact.

[0176] As an example, Prometheus collects security metrics every 5 seconds, including firewall interception counts, SQL injection attempt frequency, and abnormal access patterns, generating nearly 24 hours of time series data. Comparing the metrics before and after deployment revealed a 30% reduction in security incidents, a 15% drop in false positives, and a 50-millisecond improvement in system response time, validating the effectiveness of the policy deployment.

[0177] Preferably, when an asset changes, the newly added asset information is classified and labeled according to the preset protection requirement mapping rules, and then the WAF protection policy, database access control rules and data encryption scheme with the highest matching degree are selected from the policy library to generate the initial security policy configuration. In addition, a graph-theory-based conflict detection algorithm is used to identify policy conflicts between new assets and existing assets and obtain conflict resolution solutions.

[0178] Specifically, a grayscale release strategy was adopted, initially applying new configuration parameters to 10% of assets. System stability indicators, such as response time and error rate, were monitored using Prometheus. Once these indicators met pre-set conditions, the application was gradually expanded to 100%. The Splunk Security Information and Event Management (SIEM) system was used to monitor changes in security metrics after the dynamic adjustments, including attack interception rates, false alarm rates, and performance impacts, to evaluate the effectiveness of the adjustments and form a feedback loop.

[0179] As an example, during the initial grayscale release, a new configuration was deployed on 100 servers. Prometheus monitoring detected an average response time increase of 5ms and an error rate increase of 0.1%, both within acceptable limits. This was gradually expanded to 1,000 servers. The security policy library, containing 1,000 WAF rules, 500 access control policies, and 200 encryption schemes, was used to match policies against 50 newly added web servers and 10 database servers, with an average of 20 rules per asset. A graph-based conflict detection algorithm constructed a policy relationship graph consisting of 5,000 nodes, identifying 30 potential conflicts. 25 of these conflicts were resolved through rule prioritization, with the remaining 5 requiring manual intervention.

[0180] Preferably, when an asset changes, the associated policy entries are retrieved from the security policy configuration library for the deleted asset information, the policy deletion operation is performed, and the policy dependency graph is updated to ensure policy integrity. Then, the Nessus vulnerability scanning tool is used to check for security vulnerabilities that appear after the policy is deleted and generate a risk assessment report.

[0181] As an example, deleting the policies associated with 100 retired servers resulted in an updated dependency graph with 200 fewer nodes and 500 fewer edges. A Nessus scan revealed 15 medium-severity vulnerabilities and 5 high-severity vulnerabilities, generating a 50-page risk assessment report.

[0182] Step S5: Based on the second asset information, analyze the degree of change in the asset size of the current asset to be processed. If the degree of change is greater than a preset value, dynamically adjust the security protection strategy of the current asset to be processed.

[0183] As a preferred solution, step S5 includes step S51 to step S52, and each step is specifically as follows:

[0184] Step S51 , using an autoregressive integrated moving average model (ARIMA model) and combining it with the second asset information, calculates the asset quantity change rate of the current asset to be processed and predicts the asset change trend of the current asset to be processed.

[0185] As an example, nearly 30 days of data are input into the ARIMA model, and the asset growth rate forecast for the next 7 days is 15%, which exceeds the preset threshold of 10%.

[0186] In step S52, if the asset quantity change rate of the current assets to be processed is greater than the preset value, it is determined that the asset scale has changed significantly. At this time, the security policy evaluation model is started to re-evaluate the security protection strategy, database access control and data encryption measures corresponding to the current assets to be processed, generate new configuration parameter recommendations, and dynamically adjust the security protection strategy of the current assets to be processed.

[0187] Among them, the security policy evaluation model is pre-built based on the random forest algorithm.

[0188] As an example, the random forest model uses 100 decision trees, considers 50 features such as request frequency and data sensitivity, re-evaluates 2,000 security rules, and adjusts the parameters of 300 rules.

[0189] Preferably, a dynamically evolving asset security association graph is constructed with assets as nodes and business and security associations as edges. This captures the complex interactions and dependency changes between assets in real time, identifies potential security risk propagation paths and weak links, and quantitatively assesses the importance and vulnerability of each asset node, guiding security protection priority sorting and resource allocation. Specifically, the aforementioned process includes steps S011 to S018, each of which is as follows:

[0190] Step S011: Obtain stored asset information and construct an initial asset security association map based on the asset information.

[0191] The asset information includes asset nodes and business security association edges. The initial asset security association graph is used to represent the security relationship between assets.

[0192] Specifically, the Neo4j graph database is used to store and manage asset information, with each asset as a node and business and security associations as edges to construct an initial asset security association graph.

[0193] As an example, the initial construction of the Neo4j graph database contains a security association graph with 10,000 asset nodes and 50,000 association edges.

[0194] In step S012, Apache Kafka is used to collect large-scale asset data generated by real-time status changes of assets in real time, and then the large-scale asset data is processed through Apache Flink to obtain graph data stream update information.

[0195] As an example, Apache Kafka is configured with 100 partitions and receives 50,000 asset status update messages per second. Apache Flink, with a parallelism of 50, processes the data stream in real time with an average latency of less than 100 milliseconds.

[0196] Step S013: dynamically update the initial asset security association graph according to the graph data stream update information, and use the depth-first search (DFS) algorithm to analyze the complex interactions and dependencies between asset nodes based on the initial asset security association graph.

[0197] As an example, the depth-first search algorithm identifies 200 critical paths in the graph and calculates that the average path length is 5 hops and the longest path is 12 hops.

[0198] Step S014, calculate the shortest path between nodes and obtain connectivity information between assets. If the connectivity information meets the preset conditions, it is determined to be a critical path and a security risk propagation channel is obtained.

[0199] As an example, the shortest path and connectivity between nodes are calculated, critical paths and potential security risk propagation channels are identified, and a risk propagation path report containing risk propagation probability and impact range is generated. The risk propagation path report contains 500 high-risk propagation channels, and each channel is marked with the propagation probability and potential impact range.

[0200] In step S015, the importance score of each asset node is calculated based on the PageRank algorithm, and the historical security event data and vulnerability scanning results of the SIEM system are processed using the random forest algorithm to evaluate the vulnerability index of the node.

[0201] As an example, the PageRank algorithm was iterated 10 times with a convergence threshold of 0.001 to produce a list of the top 100 important nodes. The SIEM system provides nearly 90 days of security event data, including 1 million log records. A vulnerability scan covering all assets revealed 5,000 medium- and low-risk vulnerabilities and 500 high-risk vulnerabilities. The random forest model uses 100 decision trees and considers 20 features, such as attack frequency and number of vulnerabilities, to generate a vulnerability index between 0 and 1.

[0202] Step S016: Generate a node importance and vulnerability matrix based on the importance score of each asset node and the vulnerability index of the node.

[0203] Step S017: Based on the node importance and vulnerability matrix, and the security risk propagation channel, a genetic algorithm is used to perform multi-objective optimization, and a balanced solution between protection effect and resource consumption is obtained through multi-objective optimization.

[0204] As an example, the genetic algorithm population size is set to 1000, the evolution is 500 generations, the crossover rate is 0.8, the mutation rate is 0.1, and the optimization objectives include maximizing the protection coverage and minimizing the resource consumption.

[0205] In step S018, the optimization result - the balance plan between protection effect and resource consumption - is converted into specific security policy configuration and resource scheduling instructions through the Security Orchestration and Automated Response (SOAR) platform, forming a security protection priority ranking and resource allocation plan, realizing dynamic adjustment of protection strategy and intelligent allocation of resources.

[0206] As an example, the SOAR platform receives the optimization results and generates 1,000 security policy configuration instructions and 200 resource scheduling tasks).

[0207] As a preferred solution, an embodiment of the present invention provides an asset security policy adaptive adjustment method, which also includes a policy conflict response process. The process includes steps S6 to S9, and each step is specifically as follows:

[0208] Step S6: deploy a distributed log collector to obtain security event logs from the assets to be processed, and transmit the security event logs to the ELK central log analysis platform in real time through the Kafka message queue.

[0209] As an example, the ELK platform processes 100,000 logs per second.

[0210] Step S7: Based on the security event log, identify policy conflicts and abnormal behavior patterns between assets to generate reports related to the associated events.

[0211] As a preferred solution, step S7 includes steps S71 to S73, and the details of each step are as follows:

[0212] Step S71 , parse and standardize the security event log to obtain standardized log data, thereby achieving unified conversion of data formats.

[0213] As an example, using Logstash, we converted security event logs in 10 different formats into JSON, with a field standardization rate of 99.5%.

[0214] Step S72: Using the Apriori algorithm, association rule mining is performed on the standardized log data.

[0215] In this embodiment, the minimum support and confidence thresholds are pre-set, and then the Apriori algorithm is used to perform real-time correlation analysis on the standardized security event data, identify policy conflicts and abnormal behavior patterns between assets, and generate correlation event reports and risk scores based on the CVSS scoring system.

[0216] As an example, the Apriori algorithm mined association rules from 10 million event data items with a minimum support of 0.1 and a confidence threshold of 0.8, discovering 500 high-confidence rules. The CVSS scoring system assigns a risk score of 0-10 to each event based on factors such as impact scope and attack complexity.

[0217] Step S73 , based on the association rule mining results, determine whether each security event is a related event, and generate a report related to the related events by combining all the related events and the standardized log data corresponding to all the related events.

[0218] In this embodiment, if the association rule mining result meets the preset minimum support and confidence thresholds, the security event is determined to be a correlation event to identify policy conflicts and abnormal behavior patterns between assets.

[0219] Step S8: Use the pre-built decision tree model to classify the related events and match them with the response plans to obtain a preliminary response execution plan.

[0220] In this embodiment, an XACML (Extensible Access Control Markup Language) engine is used to process complex multi-policy conflict scenarios to build a decision tree model. The decision tree model is then used to automatically classify and match response plans for related events to generate a preliminary response execution plan.

[0221] As an example, the XACML engine processes 1,000 policy conflict scenarios per second with a 95% resolution rate. The decision tree model contains 100 leaf nodes, covering 200 response options, with an average decision time of less than 50 milliseconds.

[0222] Step S9: dynamically optimize the preliminary response execution plan based on the historical response effect data of the preliminary response execution plan to determine the optimal response action sequence.

[0223] The optimal response action sequence includes a number of response actions related to policy conflicts and the execution order of each response action related to policy conflicts.

[0224] In this example, a Q-learning reinforcement learning algorithm is used to dynamically adjust the ε value based on the balanced exploration and exploitation of the ε-greedy strategy to obtain historical response effect data. Based on this historical response effect data, the initial response execution plan is dynamically optimized to select the optimal response action sequence.

[0225] As an example, the Q-learning algorithm uses a learning rate of α = 0.1, a discount factor of γ = 0.9, an initial ε of 0.3, and decays by 10% every 1,000 iterations. After 100,000 interactions, the response accuracy of the reinforcement learning model increases from an initial 70% to 95%.

[0226] Preferably, the Apache Airflow workflow orchestration tool is used to achieve full process automation from alarm analysis to disposal execution, integrate with the security orchestration platform through the RESTful API interface, issue execution instructions, realize automated processing and policy adjustment, and form a closed-loop security management system.

[0227] As an example, Apache Airflow orchestrated 50 task nodes to build a complete incident response workflow, reducing average execution time from 30 minutes to 5 minutes. The security orchestration platform processes 200 automated tasks per minute through a RESTful API, including firewall rule updates, account lockouts, and network segment isolation, achieving an 80% automation rate for the entire response process.

[0228] Please refer to Figure 2 , which is a schematic diagram of the structure of an asset security protection strategy adaptive adjustment system provided by an embodiment of the present invention. The system includes a data acquisition module M1, a strategy conflict detection module M2, a script generation module M3, an asset deployment module M4, and a strategy adjustment module M5. The details of each module are as follows:

[0229] The data acquisition module M1 is used to obtain first asset information of an asset to be processed in a hybrid cloud environment, and generate multiple security protection policies corresponding to the asset to be processed based on the first asset information; wherein the asset to be processed is an on-cloud asset or an off-cloud asset;

[0230] The policy conflict detection module M2 is used to perform conflict detection and conflict classification on each security protection policy, obtain the corresponding conflict policy list, and use the conflict policy list to perform real-time correlation analysis on the policy conflicts between assets and security event logs to obtain policy conflict solutions.

[0231] The script generation module M3 is used to use the policy orchestration engine to combine all security protection policies and the policy description information corresponding to all security protection policies to generate corresponding configuration scripts;

[0232] The asset deployment module M4 is used to control the automatic deployment of the assets to be processed based on the configuration script, and obtain the second asset information of the assets to be processed that have completed the automatic deployment;

[0233] The policy adjustment module M5 is configured to analyze the degree of change in the asset size of the current asset to be processed based on the second asset information, and dynamically adjust the security protection policy of the current asset to be processed if the degree of change is greater than a preset value.

[0234] Those skilled in the art will clearly understand that, for the convenience and brevity of description, the specific working process of the system described above can refer to the corresponding process in the aforementioned method embodiment, and will not be repeated here.

[0235] Compared with the prior art, the embodiments of the present invention have the following beneficial effects:

[0236] The present invention provides a method and system for adaptively adjusting asset security protection strategies, which obtains first asset information of cloud assets or off-cloud assets in a hybrid cloud environment, and generates multiple security protection strategies corresponding to the asset based on the first asset information, then performs conflict detection and conflict classification on each security protection strategy to obtain a corresponding conflict strategy list, and fully considers the background and impact of security incidents on strategy conflicts, uses the conflict strategy list to perform real-time correlation analysis between strategy conflicts and security event logs between assets, and obtains strategy conflict resolution solutions to improve the effectiveness of strategy conflict resolution solutions, and through conflict detection, conflict classification and real-time correlation analysis of security policies, can quickly identify and locate potential strategy conflicts, thereby improving the response speed and processing capabilities to security incidents. In addition, a policy orchestration engine is used to combine all security protection policies and the policy description information corresponding to all security protection policies to generate corresponding configuration scripts, which greatly improves the deployment efficiency of asset security protection policies and reduces manual intervention and operational errors. Then, based on the configuration script, the asset is controlled for automatic deployment, and the second asset information of the asset that has completed the automatic deployment is obtained. Finally, based on the second asset information, the degree of change in the current asset scale of the asset is analyzed. If the degree of change is greater than the preset value, the current security protection policy of the asset is dynamically adjusted to ensure the security of assets on or off the cloud in different scales and complex environments, so as to enhance the adaptability and flexibility of the system, and reduce security risks caused by human negligence or outdated policies, thereby improving overall security.

[0237] The specific embodiments described above further illustrate the objectives, technical solutions, and beneficial effects of the present invention. It should be understood that the above descriptions are merely specific embodiments of the present invention and are not intended to limit the scope of protection of the present invention. In particular, it should be noted that any modifications, equivalent substitutions, improvements, etc. made within the spirit and principles of the present invention should be included within the scope of protection of the present invention for those skilled in the art.

Claims

1. A method for adaptively adjusting asset security protection strategies, characterized in that: include: Obtaining first asset information of an asset to be processed in a hybrid cloud environment, and generating multiple security protection policies corresponding to the asset to be processed based on the first asset information; wherein the asset to be processed is an on-cloud asset or an off-cloud asset; Perform conflict detection and conflict classification on each of the security protection policies to obtain a corresponding conflict policy list, and use the conflict policy list to perform real-time correlation analysis on policy conflicts between assets and security event logs to obtain policy conflict resolution solutions; Using a policy orchestration engine, combining all the security protection policies and the policy description information corresponding to all the security protection policies, to generate corresponding configuration scripts; Based on the configuration script, controlling the asset to be processed to be automatically deployed, and obtaining second asset information of the asset to be processed that has completed the automatic deployment; Based on the second asset information, the degree of change in the asset size of the current asset to be processed is analyzed. If the degree of change is greater than a preset value, the security protection strategy of the current asset to be processed is dynamically adjusted.

2. The asset security protection strategy adaptive adjustment method according to claim 1, characterized in that: The policy orchestration engine is used to combine all the security protection policies and the policy description information corresponding to all the security protection policies to generate corresponding configuration scripts, specifically: Using a policy orchestration engine to parse each of the security protection policies and obtain policy description information corresponding to each of the security protection policies; Performing syntax analysis and semantic checking on the policy description information corresponding to each of the security protection policies to obtain an intermediate representation of each of the security protection policies; The configuration template library of the platform corresponding to the asset to be processed is called, and the configuration script corresponding to the intermediate representation of each security protection policy is obtained from the configuration template library.

3. The asset security protection strategy adaptive adjustment method according to claim 1, characterized in that: The step of obtaining first asset information of an asset to be processed in a hybrid cloud environment and generating multiple security protection policies corresponding to the asset to be processed based on the first asset information is as follows: Obtaining first asset information of an asset to be processed in a hybrid cloud environment, and drawing a hybrid cloud network topology map based on the first asset information; wherein the hybrid cloud network topology map includes annotations indicating connection relationships between various network areas on and off the cloud; Analyze the firewall logs and network traffic of the asset to be processed, and combine the analysis results with the hybrid cloud network topology diagram to identify the data flow path and determine the key network nodes and data exchange points; generating a plurality of security protection strategies corresponding to the asset to be processed based on the data flow path, the key network nodes, and the data exchange points; The security protection strategy includes: Deploy a Web application firewall based on the key network nodes; wherein the Web application firewall selects corresponding protection rules based on the asset location, wherein the asset location includes both on-cloud and off-cloud; According to the data flow path, deploy the IBM Guardium database audit tool on the database front end, and implement role-based fine-grained access control through the IBM Guardium database audit tool; Dynamically desensitize sensitive data fields and set corresponding desensitization rules for each user role.

4. The asset security protection strategy adaptive adjustment method according to claim 1, characterized in that: The step of controlling the asset to be processed to be automatically deployed based on the configuration script and obtaining the second asset information of the asset to be processed after the automatic deployment is completed is specifically as follows: Transferring the configuration script to the Ansible configuration management tool; Generate deployment instructions based on the configuration script using the Ansible configuration management tool, and send the deployment instructions to the asset to be processed; When a change in the cloud platform's assets is detected, Nmap is called to identify the changed assets in the cloud platform. The asset list is updated based on the identification results and the CMDB system. Based on the updated asset list, the second asset information of the current pending assets is obtained.

5. The asset security protection strategy adaptive adjustment method according to claim 1, characterized in that: The method analyzes the change degree of the asset size of the current asset to be processed based on the second asset information, and dynamically adjusts the security protection strategy of the current asset to be processed if the change degree is greater than a preset value, specifically: Calculate the asset quantity change rate of the current assets to be processed and predict the asset change trend of the current assets to be processed by combining the second asset information with the autoregressive integrated moving average model; If the asset quantity change rate of the current assets to be processed is greater than a preset value, the security policy evaluation model is started to re-evaluate the security protection strategy, database access control and data encryption measures corresponding to the current assets to be processed, generate new configuration parameter recommendations, and dynamically adjust the security protection strategy of the current assets to be processed; wherein, the security policy evaluation model is pre-built based on the random forest algorithm.

6. The asset security protection strategy adaptive adjustment method according to claim 1, characterized in that: The conflict detection and conflict classification of each of the security protection policies are performed to obtain a corresponding conflict policy list, and the conflict policy list is used to perform real-time correlation analysis on the policy conflicts between assets and security event logs to obtain a policy conflict solution, specifically: Based on the first asset information, abstracting the differentiated protection requirements of the assets to be processed into a policy rule set; Based on the policy rule set, determining the policy priority of each of the security protection policies and generating an initial security policy library; Conflict detection is performed on the initial security policy library. If policy conflicts are detected in the initial security policy library, logical identification analysis is performed on each of the security protection policies to obtain a list of conflicting policies. The list of conflicting policies is used to perform real-time correlation analysis on the policy conflicts between assets and security event logs to obtain a policy conflict solution.

7. The asset security protection strategy adaptive adjustment method according to claim 6, characterized in that: The initial security policy library is subjected to conflict detection. If a policy conflict is detected in the initial security policy library, each of the security protection policies is logically identified and analyzed to obtain a conflict policy list. The conflict policy list is used to perform real-time correlation analysis on the policy conflicts between assets and security event logs to obtain a policy conflict solution, specifically: Performing conflict detection on the initial security policy library. If a policy conflict is detected in the initial security policy library, using a Prolog logic reasoning engine to identify policy semantic conflicts and rule conflicts for each of the security protection policies, obtaining semantic conflicts and rule conflicts between the security protection policies, performing priority comparison on the security protection policies, obtaining priority conflicts between the security protection policies, and then combining the semantic conflicts, rule conflicts, and priority conflicts between the security protection policies to form a conflicting policy list. By utilizing the conflicting policy list, real-time correlation analysis is performed on the policy conflicts between assets and security event logs to obtain a policy conflict resolution solution.

8. The asset security protection strategy adaptive adjustment method according to claim 1, characterized in that: Also includes: Obtaining security event logs from the asset to be processed; Based on the security event log, identifying policy conflicts and abnormal behavior patterns between assets to generate reports related to the associated events; Using a pre-built decision tree model, the associated events are classified and matched with response plans to obtain a preliminary response execution plan; Based on the historical response effect data of the preliminary response execution plan, the preliminary response execution plan is dynamically optimized to determine the optimal response action sequence; wherein the optimal response action sequence includes several response actions related to the policy conflict and the execution order of each of the response actions related to the policy conflict.

9. The asset security protection strategy adaptive adjustment method according to claim 8, characterized in that: The method of identifying policy conflicts and abnormal behavior patterns between assets based on the security event log to generate reports related to associated events is as follows: Parsing and standardizing the security event log to obtain standardized log data; Using the Apriori algorithm to perform association rule mining on the standardized log data; Based on the association rule mining results, determine whether each security event is a related event, and combine all related events and the standardized log data corresponding to all related events to generate reports related to the related events.

10. An asset security protection strategy adaptive adjustment system, characterized in that: include: A data acquisition module is configured to acquire first asset information of an asset to be processed in a hybrid cloud environment, and generate a plurality of security protection policies corresponding to the asset to be processed based on the first asset information; wherein the asset to be processed is an on-cloud asset or an off-cloud asset; A policy conflict detection module is used to perform conflict detection and conflict classification on each of the security protection policies, obtain a corresponding conflict policy list, and use the conflict policy list to perform real-time correlation analysis on policy conflicts between assets and security event logs to obtain policy conflict resolution solutions; A script generation module is used to use a policy orchestration engine to combine all the security protection policies and the policy description information corresponding to all the security protection policies to generate corresponding configuration scripts; An asset deployment module, configured to control the automated deployment of the asset to be processed based on the configuration script, and obtain second asset information of the asset to be processed that has completed the automated deployment; The policy adjustment module is used to analyze the degree of change in the asset size of the current asset to be processed based on the second asset information, and dynamically adjust the security protection policy of the current asset to be processed if the degree of change is greater than a preset value.

Images