Cross-domain network security policy automatic generation and protection policy collaboration method and system

Abstract

The invention provides a cross-domain network security policy automatic generation and protection policy collaboration method and system, and relates to the technical field of network security, and the method comprises the steps: collecting multi-domain security event data; constructing a security threat map; generating a cross-domain security risk score by using a deep learning algorithm; determining an inter-domain access control rule set and an intra-domain protection strategy according to the score; forming a cross-domain collaborative protection strategy; deploying a strategy on the multi-domain security device; establishing an inter-domain information sharing channel; monitoring the strategy effect; optimizing the strategy by using a reinforcement learning algorithm; and updating to each domain security device. According to the method, the effectiveness of cross-domain network security protection is improved.

Description

Technical Field

[0001] The present invention relates to network security technology, and in particular to a method and system for automatically generating cross-domain network security policies and coordinating protection policies. Background Art

[0002] Traditional network security protection strategies mostly focus on defending against security threats within a single domain, lacking a comprehensive assessment and coordinated protection mechanism for security risks across multiple network domains. This results in the protection measures between network domains often being independent of each other when facing cross-domain attacks, making it difficult to form an effective joint defense system.

[0003] Existing security policy formulation methods usually rely on manual experience and are unable to respond to rapidly changing network attack methods in a timely manner. Due to the lack of in-depth analysis and automated learning capabilities for massive security event data, security policy updates often lag behind the emergence of new attacks, reducing the real-time and effectiveness of protection.

[0004] Current network security protection solutions generally lack real-time sharing of security information between domains and collaborative defense mechanisms. It is difficult for security threat intelligence between network domains to interact in a timely manner, and it is impossible to form a unified security situation awareness, which makes it difficult to quickly discover and effectively block cross-domain attacks. At the same time, due to the lack of continuous monitoring and optimization of the execution effect of protection strategies, it is difficult to ensure the long-term effectiveness of protection measures. Summary of the invention

[0005] The embodiments of the present invention provide a method and system for automatically generating cross-domain network security policies and coordinating protection policies, which can solve the problems in the prior art.

[0006] According to a first aspect of the embodiments of the present invention,

[0007] Provides cross-domain network security policy automatic generation and protection policy coordination methods, including:

[0008] Collect security event data of multiple network domains, the security event data including network attack type, attack source address, attack target, and attack time; construct a security threat map based on the security event data, the security threat map records network attack paths, attack characteristics, and attack impact range; use a deep learning algorithm to analyze the security threat map to generate a cross-domain network security risk score, the cross-domain network security risk score includes an inter-domain security risk coefficient and an intra-domain security vulnerability index;

[0009] According to the inter-domain security risk coefficient, an inter-domain access control rule set is determined, and the inter-domain access control rule set includes a source domain whitelist, a target domain access permission, and an inter-domain traffic threshold; according to the intra-domain security vulnerability index, an intra-domain protection strategy is generated, and the intra-domain protection strategy includes asset reinforcement rules, traffic cleaning rules, and attack feature identification rules; the inter-domain access control rule set and the intra-domain protection strategy are combined to form a cross-domain collaborative protection strategy;

[0010] The cross-domain collaborative protection strategy is deployed on security devices in multiple network domains; an inter-domain security information sharing channel is established to exchange security threat intelligence in real time; the protection effect of the cross-domain collaborative protection strategy is monitored and strategy execution feedback data is obtained; based on the strategy execution feedback data, the cross-domain collaborative protection strategy is optimized and adjusted using a reinforcement learning algorithm to improve the effectiveness of the protection strategy; and the optimized protection strategy is synchronously updated to the security devices in each network domain.

[0011] In an optional embodiment,

[0012] Collect security event data from multiple network domains, the security event data including network attack type, attack source address, attack target, and attack time; construct a security threat map based on the security event data, the security threat map records the network attack path, attack characteristics, and attack impact range, including:

[0013] Dual network card security probes are deployed in multiple network domains. The dual network card security probes obtain network traffic through network mirroring technology. The dual network card security probes use zero-copy technology to capture data packets. The dual network card security probes set a Ri ng Buffer cache mechanism. The dual network card security probes collect network layer attack features, application layer threat data and terminal abnormal behavior to generate security event data. The dual network card security probes collect network traffic data, and the network traffic data includes data packet size distribution information, protocol type information, port information and session status information.

[0014] Performing feature engineering processing on the security event data and the network traffic data, wherein the feature engineering processing includes data standardization processing and feature extraction processing; constructing the data processed by the feature engineering into a multidimensional feature vector, wherein the multidimensional feature vector includes traffic feature dimension information, session feature dimension information, behavior feature dimension information, and context feature dimension information; storing the multidimensional feature vector using a compressed sparse matrix storage structure; performing dimensionality reduction processing on the multidimensional feature vector using a principal component analysis algorithm, and screening key features based on an information gain algorithm, constructing feature cross terms, and generating a feature matrix;

[0015] A security threat graph is constructed based on the feature matrix, and attacker information nodes, attack method information nodes and attack target information nodes are extracted from the feature matrix, and the attacker information nodes, attack method information nodes and attack target information nodes are used as entity nodes; a timing dependency graph is constructed, and attack path information is identified based on the timing dependency graph, and the attack path information is used as an entity relationship; a graph propagation algorithm is used to calculate the influence propagation intensity between each node, and a node influence propagation relationship is constructed; the entity nodes, the entity relationships and the node influence propagation relationships are integrated to form a security threat knowledge graph.

[0016] In an optional embodiment,

[0017] The security threat map is analyzed using a deep learning algorithm to generate a cross-domain network security risk score, which includes an inter-domain security risk coefficient and an intra-domain security vulnerability index including:

[0018] Constructing a graph attention network model, the graph attention network model includes a node feature embedding layer, a multi-head attention layer and a graph convolution layer, wherein the node feature embedding layer converts the attacker node features, the attack method node features and the target node features into a feature vector, the multi-head attention layer aggregates information on the feature vector, and the graph convolution layer extracts local structural features of the feature vector;

[0019] The feature vector is converted into a query vector, a key vector and a value vector using a linear transformation matrix, an attention score is calculated based on the query vector and the key vector, and the attention score is matrix multiplied with the value vector to obtain an attention weight; the graph convolution layer is used to perform feature aggregation on the nodes with the attention weight, and the original feature information is retained through residual connections, and the aggregated features are normalized;

[0020] Based on the graph attention network model, the inter-domain attack path characteristics, the inter-domain abnormal traffic characteristics and the inter-domain trust relationship characteristics are analyzed, and the inter-domain attack path characteristics, the inter-domain abnormal traffic characteristics and the inter-domain trust relationship characteristics are feature fused to generate an inter-domain security risk coefficient; the intra-domain asset vulnerability information, the intra-domain security protection capability information and the intra-domain threat exposure degree information are analyzed, and the intra-domain security vulnerability index is generated based on the intra-domain asset vulnerability information, the intra-domain security protection capability information and the intra-domain threat exposure degree information; the inter-domain security risk coefficient and the intra-domain security vulnerability index are weightedly fused to generate a cross-domain network security risk score.

[0021] In an optional embodiment,

[0022] Based on the graph attention network model, the inter-domain attack path features, the inter-domain abnormal traffic features and the inter-domain trust relationship features are analyzed, and the inter-domain attack path features, the inter-domain abnormal traffic features and the inter-domain trust relationship features are feature fused to generate the inter-domain security risk coefficient, including:

[0023] Constructing a path representation learning model, wherein the path representation learning model performs node sequence encoding on the attack path between the source domain and the target domain, calculates the importance weight of the attack path, generates a path vector representation based on the node sequence encoding and the importance weight, and accumulates the path vector representation to generate a path embedding matrix;

[0024] Extracting traffic statistical features between the source domain and the target domain, extracting time series features from the traffic statistical features using a long short-term memory network, identifying abnormal traffic patterns based on the time series features, and generating an abnormality degree score;

[0025] Analyzing historical interaction information between the source domain and the target domain, calculating a security policy matching degree between the source domain and the target domain, and generating a trust score based on the historical interaction information and the security policy matching degree;

[0026] The path embedding matrix, the abnormality degree score and the trust score are standardized to obtain a standardized feature vector, the attention weight of the standardized feature vector is calculated, and the standardized feature vector is nonlinearly transformed using a multilayer perceptron to obtain a conversion feature vector; the conversion feature vector is weightedly fused with the attention weight, and an inter-domain security risk coefficient is generated through a deep neural network. The deep neural network includes an input layer, a hidden layer and an output layer. The output of the hidden layer is input to the output layer after random inactivation processing. The output layer uses a sigmoid activation function to output the inter-domain security risk coefficient.

[0027] In an optional embodiment,

[0028] Analyzing the intra-domain asset vulnerability information, the intra-domain security protection capability information, and the intra-domain threat exposure degree information, and generating the intra-domain security vulnerability index based on the intra-domain asset vulnerability information, the intra-domain security protection capability information, and the intra-domain threat exposure degree information includes:

[0029] A multi-level vulnerability assessment method is used to analyze the vulnerability information of assets within the domain. The multi-level vulnerability assessment method includes assessing operating system vulnerabilities, patch status, and system configuration at the system level, assessing security flaws of Web applications, databases, and middleware components at the application level, and assessing protocol implementation flaws, port exposure, and network topology vulnerabilities at the network level. The weights of the assessment results at each level are determined through the hierarchical analysis method and weighted fusion is used to generate a comprehensive score for asset vulnerability.

[0030] Analyze the security protection capability information in the domain based on the protection depth and breadth assessment framework, conduct in-depth assessment of the deployment of boundary protection, access control, intrusion detection, and malicious code protection mechanisms, conduct quantitative assessment based on the coverage, response timeliness, and protection accuracy of protection measures, conduct breadth assessment of the completeness of the security management system, emergency response capabilities, and security operation and maintenance levels, construct a protection capability assessment matrix based on the depth assessment results and the breadth assessment results, normalize the protection capability assessment matrix, and perform weighted calculation to obtain a security protection capability score;

[0031] Establish a threat assessment model based on multi-source data fusion to analyze the threat exposure information within the domain, collect the open ports, service types and access control policies of the assets within the domain, analyze the historical security event data to extract attack features and establish a threat probability prediction model, combine external threat intelligence to assess the threat type and severity, and quantify various threats through the threat scoring engine to obtain threat exposure indicators;

[0032] The asset vulnerability comprehensive score, the security protection capability score and the threat exposure index are normalized to obtain a normalized score, and a cross-term weight coefficient is introduced to construct a nonlinear combination function. Based on the normalized score and the cross-term weight coefficient, an intra-domain security vulnerability index is generated, and the intra-domain security vulnerability index is mapped to a discrete risk level through a hierarchical mapping mechanism.

[0033] In an optional embodiment,

[0034] According to the inter-domain security risk coefficient, an inter-domain access control rule set is determined, and the inter-domain access control rule set includes a source domain whitelist, a target domain access permission, and an inter-domain traffic threshold; according to the intra-domain security vulnerability index, an intra-domain protection strategy is generated, and the intra-domain protection strategy includes asset reinforcement rules, traffic cleaning rules, and attack feature identification rules; combining the inter-domain access control rule set and the intra-domain protection strategy to form a cross-domain collaborative protection strategy includes:

[0035] A multi-dimensional reputation evaluation model is established according to the historical communication quality, abnormal event frequency and security compliance score of the source domain, the source domain reputation is calculated based on the multi-dimensional reputation evaluation model, the source domain reputation is compared with a dynamic threshold, and when the source domain reputation exceeds the dynamic threshold, the source domain IP address segment is added to the source domain whitelist, and the source domain reputation is updated using a time decay mechanism;

[0036] The target domain assets are divided into security levels to establish a resource access matrix, and access roles are assigned according to the source domain identity attributes and security levels. The access roles include read permissions, write permissions, and execute permissions. The target domain access permissions are generated through role inheritance mechanisms and constraint rules.

[0037] Collect historical inter-domain traffic data to establish a traffic baseline model, the traffic baseline model includes the total traffic volume, traffic distribution characteristics and periodic change rules, calculate the alarm threshold and blocking threshold in combination with the inter-domain security risk coefficient to obtain the inter-domain traffic threshold, and combine the source domain whitelist, the target domain access rights and the inter-domain traffic threshold to generate an inter-domain access control rule set;

[0038] Formulate operating system security baseline configuration, patch distribution strategy and system service management rules at the system level; formulate middleware security parameter configuration, application access control strategy and data protection rules at the application level; formulate port management strategy, protocol restriction rules and network isolation strategy at the network level; and generate asset reinforcement rules;

[0039] Establish a normal traffic model that includes protocol distribution characteristics, data packet length distribution, and session behavior characteristics. Filter illegal messages through protocol compliance checks. Filter abnormal traffic based on traffic feature identification and behavior analysis. Adjust filtering strategies based on the security vulnerability index within the domain to generate traffic cleaning rules.

[0040] Analyze known attack samples to extract attack feature strings and behavior patterns to establish a feature library, use AC automaton algorithm to achieve multi-mode matching, identify unknown attack features through deep learning of traffic data, formulate disposal rules based on the threat level of attack features to generate attack feature identification rules, and combine the asset reinforcement rules, traffic cleaning rules and attack feature identification rules to generate a domain protection strategy;

[0041] A policy dependency graph of the inter-domain access control rule set and the intra-domain protection policy is established, direct and indirect policy conflicts are detected through a graph traversal algorithm, the detected conflicts are arbitrated based on policy priorities and security risk assessment results, and the arbitrated inter-domain access control rule set and the intra-domain protection policy are combined to form a cross-domain collaborative protection strategy.

[0042] In an optional embodiment,

[0043] According to the feedback data from the strategy execution, optimizing and adjusting the cross-domain collaborative protection strategy using a reinforcement learning algorithm includes:

[0044] Collect rule hit rate, false interception rate and access delay time at the inter-domain access control layer, collect attack detection rate, protection success rate and system resource overhead at the intra-domain protection layer, obtain the rule hit rate, false interception rate, access delay time, attack detection rate, protection success rate and system resource overhead in real time through distributed data collection probes to form raw data, clean, normalize and feature extract the raw data to obtain a policy execution state vector;

[0045] The protection environment is modeled as a Markov decision process, the strategy execution state vector is constructed as a state space, the strategy parameter adjustment options are constructed as an action space, the reward function is designed based on the protection effect and resource overhead, a two-layer LSTM structure is used to extract time series features, and the attention mechanism is combined to process the correlation of different protection dimensions. The Q value of the action is adjusted through the fully connected layer output;

[0046] Construct an experience pool to store historical strategy adjustment samples, wherein the historical strategy adjustment samples include the current state, executed action, immediate reward, and next state, assign sampling weights to the historical strategy adjustment samples according to the time delta error, and implement priority experience playback based on the sampling weights;

[0047] Maintaining the main network parameters and the target network parameters, using the main network parameters for online learning, and soft-updating the target network parameters by adjusting the target network update frequency and update step size to achieve gradient clipping and prevent policy parameter oscillation;

[0048] Design a segmented attenuation curve for the exploration rate. In the early stage of training, the first attenuation rate is used for random exploration. In the middle stage of training, the second attenuation rate is used to increase strategy utilization. In the late stage of training, the third attenuation rate is used to keep the strategy stable. When it is detected that the strategy performance has dropped, the exploration rate is increased to perform local search.

[0049] Collect false alarm rate, false alarm rate, response time, CPU utilization, memory usage and network bandwidth to build evaluation indicators, calculate the statistical characteristics of the evaluation indicators within a sliding time window, obtain a comprehensive score through indicator normalization and weighted combination, and adjust the reward function weight and the exploration rate segmented attenuation curve based on the comprehensive score;

[0050] The optimized protection strategy is simulated and stress-tested in the test environment to obtain test results. The reliability of the strategy is verified based on the test results. The verified protection strategy is pushed to the production environment through grayscale release, and the system status parameters are monitored. When the system status parameters are abnormal, a multi-level rollback mechanism is triggered.

[0051] According to a second aspect of the embodiments of the present invention,

[0052] Provides a cross-domain network security policy automatic generation and protection policy collaboration system, including:

[0053] The first unit is used to collect security event data of multiple network domains, wherein the security event data includes network attack type, attack source address, attack target, and attack time; construct a security threat map based on the security event data, wherein the security threat map records network attack paths, attack characteristics, and attack impact range; analyze the security threat map using a deep learning algorithm to generate a cross-domain network security risk score, wherein the cross-domain network security risk score includes an inter-domain security risk coefficient and an intra-domain security vulnerability index;

[0054] The second unit is used to determine an inter-domain access control rule set according to the inter-domain security risk coefficient, wherein the inter-domain access control rule set includes a source domain whitelist, a target domain access permission, and an inter-domain traffic threshold; generate an intra-domain protection strategy according to the intra-domain security vulnerability index, wherein the intra-domain protection strategy includes asset reinforcement rules, traffic cleaning rules, and attack feature identification rules; and combine the inter-domain access control rule set and the intra-domain protection strategy to form a cross-domain collaborative protection strategy;

[0055] The third unit is used to deploy the cross-domain collaborative protection strategy on security devices in multiple network domains; establish an inter-domain security information sharing channel to exchange security threat intelligence in real time; monitor the protection effect of the cross-domain collaborative protection strategy and obtain strategy execution feedback data; optimize and adjust the cross-domain collaborative protection strategy based on the strategy execution feedback data using a reinforcement learning algorithm to improve the effectiveness of the protection strategy; and synchronously update the optimized protection strategy to the security devices in each network domain.

[0056] According to a third aspect of the embodiments of the present invention,

[0057] An electronic device is provided, comprising:

[0058] processor;

[0059] a memory for storing processor-executable instructions;

[0060] The processor is configured to call the instructions stored in the memory to execute the aforementioned method.

[0061] A fourth aspect of the embodiments of the present invention is:

[0062] A computer-readable storage medium is provided, on which computer program instructions are stored. When the computer program instructions are executed by a processor, the aforementioned method is implemented.

[0063] The beneficial effects of this application are as follows:

[0064] 1. Improve the intelligence and automation of cross-domain network security protection:

[0065] The present invention collects security event data from multiple network domains, constructs a security threat map, and uses a deep learning algorithm to analyze it, automatically generating a cross-domain network security risk score. Based on these scores, the system can automatically determine the inter-domain access control rule set and the intra-domain protection strategy to form a cross-domain collaborative protection strategy. This method greatly improves the intelligence and automation of cross-domain network security protection, reduces manual intervention, and improves efficiency.

[0066] 2. Realize collaborative protection of cross-domain network security:

[0067] The present invention establishes an inter-domain security information sharing channel and realizes real-time threat intelligence exchange between multiple network domains. At the same time, by deploying collaborative protection strategies on security devices in multiple network domains, unified cross-domain protection is achieved. This collaborative protection mechanism significantly improves the effect of overall network security protection and can better deal with cross-domain network attacks.

[0068] 3. Continuously optimize protection strategies to improve protection effects:

[0069] The present invention uses a reinforcement learning algorithm to continuously optimize and adjust the cross-domain collaborative protection strategy by monitoring the execution effect of the protection strategy and obtaining feedback data. This continuous learning and optimization mechanism ensures that the protection strategy can adapt to the ever-changing network security threats and maintain high efficiency and timeliness. The optimized strategy will be synchronized and updated to the security devices of each network domain in a timely manner, thereby continuously improving the overall protection effect. BRIEF DESCRIPTION OF THE DRAWINGS

[0070] Figure 1 A schematic diagram of a process of a method for automatically generating a cross-domain network security policy and coordinating a protection policy according to an embodiment of the present invention;

[0071] Figure 2 It is a schematic diagram of the structure of the cross-domain network security policy automatic generation and protection policy collaboration system according to an embodiment of the present invention. DETAILED DESCRIPTION

[0072] In order to make the purpose, technical solution and advantages of the embodiments of the present invention clearer, the technical solution in the embodiments of the present invention will be clearly and completely described below in conjunction with the drawings in the embodiments of the present invention. Obviously, the described embodiments are only part of the embodiments of the present invention, not all of the embodiments. Based on the embodiments of the present invention, all other embodiments obtained by ordinary technicians in this field without creative work are within the scope of protection of the present invention.

[0073] The technical solution of the present invention is described in detail with specific embodiments below. The following specific embodiments can be combined with each other, and the same or similar concepts or processes may not be described in detail in some embodiments.

[0074] Figure 1 FIG. 1 is a flow chart of a method for automatically generating a cross-domain network security policy and coordinating a protection policy according to an embodiment of the present invention. Figure 1 As shown, the method includes:

[0075] S101. Collect security event data of multiple network domains, the security event data including network attack type, attack source address, attack target, and attack time; construct a security threat map based on the security event data, the security threat map records the network attack path, attack characteristics, and attack impact range; use a deep learning algorithm to analyze the security threat map to generate a cross-domain network security risk score, the cross-domain network security risk score includes an inter-domain security risk coefficient and an intra-domain security vulnerability index;

[0076] S102. According to the inter-domain security risk coefficient, determine an inter-domain access control rule set, the inter-domain access control rule set includes a source domain whitelist, target domain access rights and an inter-domain traffic threshold; according to the intra-domain security vulnerability index, generate an intra-domain protection strategy, the intra-domain protection strategy includes asset reinforcement rules, traffic cleaning rules and attack feature identification rules; combine the inter-domain access control rule set and the intra-domain protection strategy to form a cross-domain collaborative protection strategy;

[0077] S103. Deploy the cross-domain collaborative protection strategy on security devices in multiple network domains; establish an inter-domain security information sharing channel to exchange security threat intelligence in real time; monitor the protection effect of the cross-domain collaborative protection strategy and obtain strategy execution feedback data; optimize and adjust the cross-domain collaborative protection strategy based on the strategy execution feedback data using a reinforcement learning algorithm to improve the effectiveness of the protection strategy; and synchronously update the optimized protection strategy to the security devices in each network domain.

[0078] The specific implementation method of the cross-domain network security strategy automatic generation and protection strategy collaboration method is as follows:

[0079] First, collect security event data from multiple network domains. Specifically, by deploying security probes in each network domain, collect network traffic, system logs, application logs and other data in real time. Preprocess and normalize the collected raw data to extract key information including network attack type, attack source address, attack target, attack time, etc. For example, SQL injection attack events can be extracted from the Web application firewall log, including information such as the attack source IP is 1.2.3.4, the attack target is the internal database server 10.0.0.1, and the attack time is 2023-01-01 12:00:00.

[0080] Next, a security threat map is constructed based on the collected security event data. The specific implementation method is: first, import various types of security event data into a graph database, such as Neo4j. Then define the node and relationship model of the map. The nodes include attack sources, attack targets, attack types, etc., and the relationships include attack paths, impact ranges, etc. Through the query language of the graph database, such as Cypher, the security event data is correlated and analyzed to identify attack links and attack patterns. For example, it can be found that the attack sources 1.2.3.4 successively attack the Web server, application server, and database server, forming a complete attack link. Finally, the analysis results are visualized to form an intuitive security threat map.

[0081] Then, the security threat graph is analyzed using a deep learning algorithm to generate a cross-domain network security risk score. The specific steps are as follows: First, the graph data is converted into a format that can be processed by the graph neural network. Then, a graph convolutional neural network model is designed to extract features and learn representations of the graph. The input of the model is the node features and edge features of the graph, and the output is a low-dimensional vector representation of the node. Based on the learned vector representation, the inter-domain node similarity is calculated as the inter-domain security risk coefficient, and the intra-domain node clustering coefficient is calculated as the intra-domain security vulnerability index. Finally, a cross-domain network security risk score containing the inter-domain security risk coefficient and the intra-domain security vulnerability index is obtained.

[0082] Determine the inter-domain access control rule set based on the inter-domain security risk coefficient. The specific method is as follows: First, set the risk threshold based on the inter-domain security risk coefficient, and add the source domains with risk coefficients below the threshold to the whitelist. Then, for domains with higher risk coefficients, refine the access control, such as only allowing access to specific services or ports. Finally, set differentiated traffic thresholds for different inter-domain links based on historical traffic data and risk coefficients. For example, for an inter-domain link with a risk coefficient of 0.8, the traffic threshold can be set to 80% of the average traffic.

[0083] Generate a domain protection strategy based on the domain security vulnerability index. Specifically, first, prioritize domain assets based on the vulnerability index and formulate reinforcement rules for high-risk assets, such as closing non-essential ports and updating patches. Second, set traffic cleaning rules to filter and clean abnormal traffic. Finally, extract attack features based on historical attack data and generate attack feature identification rules. For example, for SQL injection attacks, regular expression rules containing special character sequences can be generated.

[0084] The inter-domain access control rule set and the intra-domain protection policy are combined to form a cross-domain collaborative protection policy. The specific implementation method is as follows: First, the two types of policies are converted into a unified policy description language, such as XACML. Then, the two types of policies are merged through a policy combination algorithm, such as a weighted linear combination. Finally, the combined policy is conflict-detected and resolved to ensure the consistency and enforceability of the policy.

[0085] Deploy cross-domain collaborative protection policies on security devices in multiple network domains. The specific steps include: First, convert the policy into a configuration format that can be recognized by various security devices, such as the ACL syntax of Cisco firewalls. Then, issue the policy configuration through the API interface or management protocol (such as NETCONF) of the security device. Finally, verify whether the policy deployment is successful and perform necessary rollback processing.

[0086] Establish inter-domain security information sharing channels to exchange security threat intelligence in real time. The specific implementation method is: first, deploy threat intelligence platforms such as MISP in each domain. Then, connect the threat intelligence platforms of each domain through encrypted VPN tunnels. Finally, based on standard protocols such as STIX / TAXI I, realize the automatic exchange and update of threat indicators.

[0087] Monitor the protection effect of cross-domain collaborative protection strategies and obtain policy execution feedback data. The specific method includes: first, deploy a policy execution monitoring module on each security device to collect data such as the number of policy hits and blocking events. Then, aggregate the monitoring data to a centralized security management platform for analysis. Finally, generate a policy execution feedback report containing indicators such as policy effectiveness and false alarm rate.

[0088] According to the feedback data of strategy execution, the cross-domain collaborative protection strategy is optimized and adjusted using the reinforcement learning algorithm. The specific steps are as follows: First, the protection strategy is parameterized, such as the inter-domain traffic threshold, the attack feature matching threshold, etc. Then, a reinforcement learning environment is constructed, the strategy parameters are used as the action space, and the protection effect index is used as the reward function. Then, a policy gradient algorithm such as PPO is used to continuously optimize the strategy parameters by interacting with the environment. Finally, the optimal strategy parameters learned are updated to the protection strategy.

[0089] The optimized protection strategy is synchronously updated to the security devices in each network domain. The specific implementation method is: first, the optimized strategy is converted into an incremental update instruction. Then, the update instruction is issued to the security devices in each domain through the security management platform. Finally, the security device executes the update operation and returns the update result. If the update fails, it is rolled back.

[0090] The beneficial effects of this method include three aspects:

[0091] 1. It realizes the global perception and quantitative assessment of cross-domain network security situation. By constructing a security threat map and deep learning analysis, it can accurately depict the security association relationship and risk propagation path between multiple network domains, providing data support for the formulation of protection strategies.

[0092] 2. Improved the automation and intelligence level of cross-domain collaborative protection. Automatically generate and optimize protection strategies based on machine learning algorithms, reducing the workload and error rate of manual configuration. At the same time, through the sharing of inter-domain threat intelligence, the foresight and coordination of protection are enhanced.

[0093] 3. Enhanced the adaptability and effectiveness of the protection strategy. The strategy is dynamically optimized using reinforcement learning methods, so that it can be adaptively adjusted according to changes in the network environment and the evolution of attack patterns, continuously improving the protection effect.

[0094] In an optional implementation, security event data of multiple network domains are collected, the security event data including network attack type, attack source address, attack target, and attack time; a security threat map is constructed based on the security event data, the security threat map records the network attack path, attack characteristics, and attack impact range, including:

[0095] Dual network card security probes are deployed in multiple network domains. The dual network card security probes obtain network traffic through network mirroring technology. The dual network card security probes use zero-copy technology to capture data packets. The dual network card security probes set a Ri ng Buffer cache mechanism. The dual network card security probes collect network layer attack features, application layer threat data and terminal abnormal behavior to generate security event data. The dual network card security probes collect network traffic data, and the network traffic data includes data packet size distribution information, protocol type information, port information and session status information.

[0096] Performing feature engineering processing on the security event data and the network traffic data, wherein the feature engineering processing includes data standardization processing and feature extraction processing; constructing the data processed by the feature engineering into a multidimensional feature vector, wherein the multidimensional feature vector includes traffic feature dimension information, session feature dimension information, behavior feature dimension information, and context feature dimension information; storing the multidimensional feature vector using a compressed sparse matrix storage structure; performing dimensionality reduction processing on the multidimensional feature vector using a principal component analysis algorithm, and screening key features based on an information gain algorithm, constructing feature cross terms, and generating a feature matrix;

[0097] A security threat graph is constructed based on the feature matrix, and attacker information nodes, attack method information nodes and attack target information nodes are extracted from the feature matrix, and the attacker information nodes, attack method information nodes and attack target information nodes are used as entity nodes; a timing dependency graph is constructed, and attack path information is identified based on the timing dependency graph, and the attack path information is used as an entity relationship; a graph propagation algorithm is used to calculate the influence propagation intensity between each node, and a node influence propagation relationship is constructed; the entity nodes, the entity relationships and the node influence propagation relationships are integrated to form a security threat knowledge graph.

[0098] The present invention provides a method for constructing a security threat map based on multi-network domain security event data. The method first deploys dual network card security probes in multiple network domains and obtains network traffic through network mirroring technology. The dual network card security probes use zero copy technology to capture data packets and set a Ri ng Buffer cache mechanism to improve data collection efficiency.

[0099] Specifically, the dual network card security probe collects network layer attack characteristics, application layer threat data and terminal abnormal behavior to generate security event data. Security event data includes network attack type, attack source address, attack target, attack time and other information. At the same time, the dual network card security probe also collects network traffic data, including data packet size distribution information, protocol type information, port information and session status information.

[0100] For example, for a DDoS attack, security event data may contain the following information:

[0101] Attack type: DDoS;

[0102] Attack source addresses: 192.168.1.100, 192.168.1.101, 192.168.1.102;

[0103] Attack target: 10.0.0.1;

[0104] Attack time: 2023-05-01 10:30:00;

[0105] The corresponding network traffic data may include:

[0106] Packet size: 80% less than 100 bytes;

[0107] Protocol type: 90% TCP, 10% UDP;

[0108] Target port: 80% is port 80;

[0109] Session status: 95% is in SYN_SENT status;

[0110] Next, feature engineering is performed on the collected security event data and network traffic data. Feature engineering includes data standardization and feature extraction. Data standardization can use the minimum-maximum scaling method to map feature values ​​of different dimensions to the [0,1] interval. Feature extraction can use statistical analysis methods to extract representative features from the original data.

[0111] After feature engineering, the data is constructed into a multi-dimensional feature vector. The multi-dimensional feature vector includes traffic feature dimension information, session feature dimension information, behavior feature dimension information, and context feature dimension information. For example:

[0112] Traffic characteristics: [0.8, 0.9, 0.8, 0.95] represent the small packet ratio, TCP protocol ratio, 80 port ratio, and SYN_SENT status ratio respectively;

[0113] Session characteristics: [100, 3, 60] represent the average session duration, average number of session packets, and average number of session bytes, respectively;

[0114] Behavior characteristics: [1, 0, 1] respectively indicate whether there is scanning behavior, whether there is brute force cracking, and whether there is an abnormal connection;

[0115] Context features: [0.8, 0.6] represent the source IP reputation and target asset importance respectively;

[0116] In order to efficiently store and process these high-dimensional sparse feature vectors, a compressed sparse row (CSR) storage structure is used. CSR uses three one-dimensional arrays to represent sparse matrices: the data array stores the non-zero element values, the column index array stores the column numbers of the non-zero elements, and the row offset array stores the position of the first non-zero element in each row in the data array.

[0117] Next, the principal component analysis (PCA) algorithm is used to reduce the dimensionality of the multidimensional feature vector. PCA maps the original high-dimensional data to a low-dimensional space through linear transformation while retaining the main information of the data. The specific steps include calculating the covariance matrix, solving the eigenvalues ​​and eigenvectors, selecting the principal components, etc. For example, the original 100-dimensional features can be reduced to 20 dimensions while retaining 95% of the information.

[0118] Then, the key features are selected based on the information gain algorithm. Information gain measures the contribution of features to classification. The information gain of each feature is calculated and the feature subset with the highest information gain is selected. For example, the top 10 features with information gain can be selected as key features.

[0119] Based on the selected key features, construct feature cross terms and generate feature matrices. Feature cross terms can capture the nonlinear relationship between features and improve the expressiveness of the model. For example, you can perform a second-order polynomial expansion on numerical features and perform one-hot encoding on categorical features and then combine them in pairs.

[0120] Finally, a security threat map is constructed based on the feature matrix. First, attacker information nodes, attack method information nodes, and attack target information nodes are extracted from the feature matrix and these nodes are used as entity nodes. For example:

[0121] Attacker node: {IP: 192.168.1.100, Geographic location: Beijing, China, Threat level: High};

[0122] Attack method node: {Type: DDoS, Protocol: TCP, Duration: 30 minutes};

[0123] Attack target node: {IP: 10.0.0.1, Service: Web Server, Importance: Core};

[0124] Then, a timing dependency graph is constructed, and attack path information is identified based on the timing dependency graph, using the attack path information as an entity relationship. The timing dependency graph can be constructed by analyzing the time sequence and causal relationship of events. For example, the following attack paths can be identified:

[0125] 192.168.1.100->Port scan->10.0.0.1:80->DDoS attack->Web service interruption;

[0126] Next, the graph propagation algorithm is used to calculate the influence propagation strength between nodes and construct the node influence propagation relationship. The graph propagation algorithm simulates the diffusion process of information in the graph and can evaluate the correlation and influence between nodes. For example, the following influence propagation relationship can be obtained:

[0127] 192.168.1.100->10.0.0.1, impact intensity: 0.8;

[0128] DDoS attack->Web service interruption, impact intensity: 0.9;

[0129] Finally, the entity nodes, entity relationships, and node influence propagation relationships are integrated to form a security threat knowledge graph. The knowledge graph organizes and represents entities, attributes, and relationships related to security threats in a graph structure, supporting complex queries and reasoning.

[0130] The beneficial effects of the method of the present invention are mainly reflected in the following three aspects:

[0131] 1. Efficiency of data collection and processing: By deploying dual network card security probes, using zero-copy technology and Ri ngBuffer cache mechanism, efficient data collection is achieved. At the same time, the storage and processing efficiency of feature data is improved by using compressed sparse matrix storage structure and principal component analysis algorithm.

[0132] 2. Effectiveness of feature extraction and selection: Through feature engineering processing, multi-dimensional feature vector construction, information gain feature selection and other technologies, the most representative and discriminative features are extracted from massive raw data, laying a solid foundation for the subsequent construction of security threat maps.

[0133] 3. Comprehensiveness of security threat representation: The constructed security threat map not only contains basic entity information such as attackers, attack methods, and attack targets, but also depicts the attack path and impact propagation relationship through temporal dependency graphs and graph propagation algorithms, comprehensively and three-dimensionally describing all aspects of network security threats, which helps to deeply understand and analyze complex network attack behaviors.

[0134] In an optional implementation, the security threat map is analyzed using a deep learning algorithm to generate a cross-domain network security risk score, wherein the cross-domain network security risk score includes an inter-domain security risk coefficient and an intra-domain security vulnerability index including:

[0135] Constructing a graph attention network model, the graph attention network model includes a node feature embedding layer, a multi-head attention layer and a graph convolution layer, wherein the node feature embedding layer converts the attacker node features, the attack method node features and the target node features into a feature vector, the multi-head attention layer aggregates information on the feature vector, and the graph convolution layer extracts local structural features of the feature vector;

[0136] The feature vector is converted into a query vector, a key vector and a value vector using a linear transformation matrix, an attention score is calculated based on the query vector and the key vector, and the attention score is matrix multiplied with the value vector to obtain an attention weight; the graph convolution layer is used to perform feature aggregation on the nodes with the attention weight, and the original feature information is retained through residual connections, and the aggregated features are normalized;

[0137] Based on the graph attention network model, the inter-domain attack path characteristics, the inter-domain abnormal traffic characteristics and the inter-domain trust relationship characteristics are analyzed, and the inter-domain attack path characteristics, the inter-domain abnormal traffic characteristics and the inter-domain trust relationship characteristics are feature fused to generate an inter-domain security risk coefficient; the intra-domain asset vulnerability information, the intra-domain security protection capability information and the intra-domain threat exposure degree information are analyzed, and the intra-domain security vulnerability index is generated based on the intra-domain asset vulnerability information, the intra-domain security protection capability information and the intra-domain threat exposure degree information; the inter-domain security risk coefficient and the intra-domain security vulnerability index are weightedly fused to generate a cross-domain network security risk score.

[0138] This embodiment provides a method for analyzing a security threat map using a deep learning algorithm to generate a cross-domain network security risk score. The method includes the following steps:

[0139] First, a graph attention network model is constructed. The model includes a node feature embedding layer, a multi-head attention layer, and a graph convolution layer. The node feature embedding layer converts the attacker node features, attack method node features, and target node features into feature vectors. Specifically, for the attacker node, its IP address, geographic location, historical attack behavior and other features are extracted; for the attack method node, its attack type, attack tool, attack frequency and other features are extracted; for the target node, its system type, open port, patch status and other features are extracted. Then, these discrete features are converted into continuous feature vectors through a fully connected neural network, for example, the IP address "192.168.1.1" is converted into a 128-dimensional vector.

[0140] The multi-head attention layer aggregates information on the feature vector. First, the linear transformation matrix is ​​used to transform the feature vector into a query vector, a key vector, and a value vector. For example, for a 128-dimensional feature vector, three 128x64 transformation matrices are used to obtain a 64-dimensional query vector, a key vector, and a value vector. Then, the attention score is calculated based on the query vector and the key vector. The specific method is to perform a dot product operation on the query vector and the key vector, and then normalize it with softmax to obtain the attention score. Then, the attention score is matrix multiplied with the value vector to obtain the attention weight.

[0141] The graph convolution layer extracts the local structural features of the feature vector. The graph convolution layer is used to aggregate the features of nodes with attention weights, and the original feature information is retained through residual connections, and the aggregated features are normalized. Specifically, for each central node, the features of its first-order neighbor nodes are aggregated, and the neighbor node features are weighted according to the attention weights during aggregation. Then the aggregated features are residually connected with the original features of the central node, and finally the new feature representation of the node is obtained through layer normalization.

[0142] Next, we analyze the inter-domain attack path features, inter-domain abnormal traffic features, and inter-domain trust relationship features based on the constructed graph attention network model. For the inter-domain attack path features, we extract the attack links between different domains, including the attack path length, node connectivity, etc.; for the inter-domain abnormal traffic features, we analyze the abnormal patterns of inter-domain traffic, such as burst traffic, abnormal port access, etc.; for the inter-domain trust relationship features, we extract the strength of the trust relationship between different domains. These features are input into the graph attention network model for processing to obtain the fused inter-domain feature representation.

[0143] Then, the inter-domain attack path features, inter-domain abnormal traffic features, and inter-domain trust relationship features are fused to generate the inter-domain security risk coefficient. Specifically, these three types of features can be fused in a weighted summation manner, and the weights can be adjusted according to the actual importance. For example, the attack path feature weight can be set to 0.4, the abnormal traffic feature weight to 0.3, and the trust relationship feature weight to 0.3 to obtain the final inter-domain security risk coefficient.

[0144] At the same time, analyze the vulnerability information of assets in the domain, the security protection capability information in the domain, and the threat exposure information in the domain. For asset vulnerability information, count the number and severity of vulnerabilities of assets in the domain; for security protection capability information, evaluate the deployment and effectiveness of security devices such as firewalls and intrusion detection systems in the domain; for threat exposure information, analyze the degree to which assets in the domain are exposed to the Internet. Based on this information, the domain security vulnerability index can be generated by weighted average, for example, setting the asset vulnerability weight to 0.4, the security protection capability weight to 0.3, and the threat exposure weight to 0.3.

[0145] Finally, the inter-domain security risk coefficient and the intra-domain security vulnerability index are weighted and fused to generate a cross-domain network security risk score. The fusion can be performed in a linear combination manner. For example, the weight of the inter-domain security risk coefficient is set to 0.6 and the weight of the intra-domain security vulnerability index is set to 0.4 to obtain the final cross-domain network security risk score. This score can be used to measure the security status of the entire cross-domain network and provide decision support for security managers.

[0146] The beneficial effects of this embodiment include the following three aspects:

[0147] First, by constructing a graph attention network model, we can effectively capture the complex relationships between nodes in the security threat graph, improving the effect of feature extraction and information aggregation. The multi-head attention mechanism can learn the correlation between nodes from different perspectives, and the graph convolution layer can make full use of the graph structure information to more accurately characterize the propagation characteristics of network security threats.

[0148] Secondly, the security status of the cross-domain network is comprehensively considered by combining inter-domain features with intra-domain features. Inter-domain features reflect the interactions and potential threats between different domains, while intra-domain features reflect the security protection capabilities of a single domain. The integration of the two can more comprehensively assess the security risks of the entire cross-domain network.

[0149] Finally, the final security risk score is generated by weighted fusion, which is highly flexible and interpretable. By adjusting the weights of different features, the key security factors can be highlighted according to actual needs. It also makes it easier for security managers to understand the source of the score results and helps to formulate targeted security strategies.

[0150] In an optional implementation, based on the graph attention network model, the inter-domain attack path features, the inter-domain abnormal traffic features, and the inter-domain trust relationship features are analyzed, and the inter-domain attack path features, the inter-domain abnormal traffic features, and the inter-domain trust relationship features are feature fused to generate an inter-domain security risk coefficient, including:

[0151] Constructing a path representation learning model, wherein the path representation learning model performs node sequence encoding on the attack path between the source domain and the target domain, calculates the importance weight of the attack path, generates a path vector representation based on the node sequence encoding and the importance weight, and accumulates the path vector representation to generate a path embedding matrix;

[0152] Extracting traffic statistical features between the source domain and the target domain, extracting time series features from the traffic statistical features using a long short-term memory network, identifying abnormal traffic patterns based on the time series features, and generating an abnormality degree score;

[0153] Analyzing historical interaction information between the source domain and the target domain, calculating a security policy matching degree between the source domain and the target domain, and generating a trust score based on the historical interaction information and the security policy matching degree;

[0154] The path embedding matrix, the abnormality degree score and the trust score are standardized to obtain a standardized feature vector, the attention weight of the standardized feature vector is calculated, and the standardized feature vector is nonlinearly transformed using a multilayer perceptron to obtain a conversion feature vector; the conversion feature vector is weightedly fused with the attention weight, and an inter-domain security risk coefficient is generated through a deep neural network. The deep neural network includes an input layer, a hidden layer and an output layer. The output of the hidden layer is input to the output layer after random inactivation processing. The output layer uses a sigmoid activation function to output the inter-domain security risk coefficient.

[0155] This embodiment provides a method for analyzing inter-domain security risks based on a graph attention network model. The method includes the following steps:

[0156] First, a path representation learning model is constructed to analyze the attack path between the source domain and the target domain. Specifically, a depth-first search algorithm is used to traverse all possible attack paths between the source domain and the target domain, and the nodes on each path are sequentially encoded. For example, assuming that there is an attack path A->B->C->D, it can be encoded as [1,2,3,4]. Then, the importance weight of each attack path is calculated, and a comprehensive evaluation can be performed based on factors such as path length and node importance. Taking the above path as an example, assume that the calculated importance weight is 0.8. Next, the node sequence encoding is combined with the importance weight to generate a path vector representation. For example, [1,2,3,4]*0.8=[0.8,1.6,2.4,3.2]. Finally, all path vector representations are accumulated to obtain a path embedding matrix. Assuming that there are 3 attack paths in total, the final path embedding matrix dimension is 3×4.

[0157] Secondly, extract the traffic statistics features between the source domain and the target domain, including traffic size, number of packets, connection duration, etc. Organize these features into time series data, for example, count them every 5 minutes, and get a feature sequence of 288 time points within 24 hours. Then, use the long short-term memory network to extract the time series features of the traffic statistics. Specifically, set the input layer, forget gate, input gate, output gate and hidden state, and extract the time series features through multiple rounds of iterations. Based on the extracted time series features, a clustering algorithm is used to identify abnormal traffic patterns. For example, the K-means algorithm is used to cluster traffic patterns into two categories: normal and abnormal. Finally, calculate the similarity between the current traffic and the abnormal pattern, and generate an abnormality score between 0 and 1.

[0158] Next, analyze the historical interaction information of the source domain and the target domain, including the interaction frequency, interaction duration, interaction type, etc. For example, count the average number of daily interactions between the two domains, the average duration of a single interaction, the proportion of data exchange types, etc. in the past 30 days. At the same time, calculate the security policy matching degree of the two domains, including the consistency of access control policy, encryption policy, authentication policy, etc. For example, perform a weighted summation of multiple security policies to obtain a matching score between 0 and 1. Based on the historical interaction information and security policy matching degree, a fuzzy reasoning method is used to generate a trust score between 0 and 1.

[0159] Then, the path embedding matrix, anomaly score and trust score are standardized. The maximum and minimum normalization method is used to map each eigenvalue to the interval [0,1] to obtain a standardized eigenvector. Next, the attention weight of the standardized eigenvector is calculated. Specifically, a multi-layer feedforward neural network is used to perform a nonlinear transformation on the eigenvector to obtain the attention score. The attention score is normalized by the softmax function to obtain the final attention weight. For example, [0.4, 0.3, 0.3]. Then, a multi-layer perceptron is used to perform a nonlinear transformation on the standardized eigenvector. Two hidden layers are set, and each layer uses the ReLU activation function to obtain the converted eigenvector.

[0160] Finally, the transformed feature vector is weightedly fused with the attention weight. The feature vector is multiplied by the corresponding attention weight using element-wise multiplication, and then the results are added to obtain the fused feature vector. The fused feature vector is input into the deep neural network to generate the final inter-domain security risk coefficient. The deep neural network includes an input layer, two hidden layers, and an output layer. The hidden layer uses the ReLU activation function and performs 50% random inactivation at the output to prevent overfitting. The output layer uses the sigmoid activation function to map the result to between 0 and 1 to obtain the final inter-domain security risk coefficient.

[0161] The beneficial effects of this embodiment include:

[0162] 1) By constructing a path representation learning model, the attack path characteristics between the source domain and the target domain are comprehensively analyzed, and the inter-domain topological structure information is effectively captured.

[0163] 2) Combining long short-term memory network and clustering algorithm, accurate identification of abnormal traffic between domains is achieved, improving the accuracy of anomaly detection.

[0164] 3) The graph attention mechanism and deep neural network are used to adaptively fuse multi-dimensional features to generate more comprehensive and accurate inter-domain security risk assessment results.

[0165] In an optional implementation, analyzing the intra-domain asset vulnerability information, the intra-domain security protection capability information, and the intra-domain threat exposure degree information, and generating the intra-domain security vulnerability index based on the intra-domain asset vulnerability information, the intra-domain security protection capability information, and the intra-domain threat exposure degree information includes:

[0166] A multi-level vulnerability assessment method is used to analyze the vulnerability information of assets within the domain. The multi-level vulnerability assessment method includes assessing operating system vulnerabilities, patch status, and system configuration at the system level, assessing security flaws of Web applications, databases, and middleware components at the application level, and assessing protocol implementation flaws, port exposure, and network topology vulnerabilities at the network level. The weights of the assessment results at each level are determined through the hierarchical analysis method and weighted fusion is used to generate a comprehensive score for asset vulnerability.

[0167] Analyze the security protection capability information in the domain based on the protection depth and breadth assessment framework, conduct in-depth assessment of the deployment of boundary protection, access control, intrusion detection, and malicious code protection mechanisms, conduct quantitative assessment based on the coverage, response timeliness, and protection accuracy of protection measures, conduct breadth assessment of the completeness of the security management system, emergency response capabilities, and security operation and maintenance levels, construct a protection capability assessment matrix based on the depth assessment results and the breadth assessment results, normalize the protection capability assessment matrix, and perform weighted calculation to obtain a security protection capability score;

[0168] Establish a threat assessment model based on multi-source data fusion to analyze the threat exposure information within the domain, collect the open ports, service types and access control policies of the assets within the domain, analyze the historical security event data to extract attack features and establish a threat probability prediction model, combine external threat intelligence to assess the threat type and severity, and quantify various threats through the threat scoring engine to obtain threat exposure indicators;

[0169] The asset vulnerability comprehensive score, the security protection capability score and the threat exposure index are normalized to obtain a normalized score, and a cross-term weight coefficient is introduced to construct a nonlinear combination function. Based on the normalized score and the cross-term weight coefficient, an intra-domain security vulnerability index is generated, and the intra-domain security vulnerability index is mapped to a discrete risk level through a hierarchical mapping mechanism.

[0170] In this embodiment, firstly, the vulnerability information of the assets in the domain, the security protection capability information in the domain and the threat exposure degree information in the domain are collected. For the vulnerability information of the assets in the domain, a multi-level vulnerability assessment method is used for analysis. The method includes three levels of assessment:

[0171] System-level assessment: Perform vulnerability scans on the operating system to detect known CVE vulnerabilities, such as the MS17-010 EternalBlue vulnerability in the Windows system; analyze patch installation status and count the proportion of important security patches that are not installed; check system configuration compliance, such as whether password complexity and account lockout policies meet baseline standards.

[0172] Application-level assessment: Penetration testing of Web applications to identify common vulnerabilities such as SQL injection and XSS; security configuration checks on databases, such as default passwords and minimum permission settings; version checks and security configuration analysis on middleware such as Tomcat and JBoss.

[0173] Network-level assessment: Perform fuzz testing on network protocol implementations to identify potential protocol vulnerabilities; scan and analyze open ports to assess the security risks of unnecessary open ports; draw network topology diagrams to identify topological vulnerabilities such as single points of failure and improper network segmentation.

[0174] The weights of the three-level assessment results are determined using the analytic hierarchy process. Assume that the weight of the system layer is 0.4, the application layer is 0.3, and the network layer is 0.3. The scores of each layer are standardized to the range of 0-100, and then weighted to obtain the comprehensive score of asset vulnerability.

[0175] Next, we analyze the security protection capability information in the domain based on the protection depth and breadth assessment framework. In terms of depth assessment:

[0176] Boundary protection: Evaluate the deployment of firewalls, intrusion prevention systems, etc., and check the rationality of ACL configuration;

[0177] Access control: Analyze the strictness of identity authentication and authorization management, such as whether two-factor authentication is used;

[0178] Intrusion detection: Check IDS / IPS coverage and evaluate the comprehensiveness and timeliness of detection rules;

[0179] Malicious code protection: evaluate the terminal security software deployment rate, virus database update timeliness, etc.

[0180] Each protection measure is quantitatively scored based on coverage (0-100%), response time (seconds, minutes, hours) and accuracy (false alarm rate, missed alarm rate).

[0181] In terms of breadth assessment:

[0182] Security management system: Check whether a complete information security management system has been established, including security policies, operating procedures, etc.;

[0183] Emergency response capability: evaluate the completeness of emergency plans, the frequency and effectiveness of emergency drills;

[0184] Security operation and maintenance level: Analyze the standardization degree of security operation and maintenance processes, the timeliness of handling security incidents, etc.

[0185] The depth assessment and breadth assessment results are constructed into a matrix, normalized and weighted to obtain the security protection capability score.

[0186] Then, a threat assessment model based on multi-source data fusion is established to analyze the threat exposure information within the domain. First, the asset information within the domain is collected, including open ports, running services, access control policies, etc. Secondly, historical security event data is analyzed to extract attack features such as attack IP, attack method, attack target, etc., and a threat probability prediction model based on machine learning is established. Then, external threat intelligence is combined to evaluate the severity of different types of threats. Finally, the threat scoring engine is used to quantify various types of threats to obtain threat exposure indicators.

[0187] The comprehensive score of asset vulnerability, security protection capability score and threat exposure index are normalized by Min-Max to obtain a normalized score between 0 and 1. The cross-term weight coefficients alpha, beta and gamma are introduced to construct a nonlinear combination function:

[0188] I index=a*V+b*D+c*T+al pha*V*D+beta*D*T+gamma*T*V;

[0189] Among them, V, D, and T are normalized vulnerability, protection capability, and threat indicators, respectively, and a, b, and c are weight coefficients of each indicator. The security vulnerability index within the domain is calculated by this function.

[0190] Finally, a hierarchical mapping mechanism is established to map continuous index values ​​to discrete risk levels. For example, 0-0.2 can be mapped to "low risk", 0.2-0.4 to "medium-low risk", 0.4-0.6 to "medium risk", 0.6-0.8 to "medium-high risk", and 0.8-1 to "high risk".

[0191] The beneficial effects of this embodiment include:

[0192] 1) A multi-level and multi-dimensional assessment method is adopted to comprehensively assess the vulnerability of assets, security protection capabilities and threat exposure within the domain, thereby improving the accuracy and comprehensiveness of security assessments.

[0193] 2) The cross-term weight coefficient is introduced to construct a nonlinear combination function, which more accurately describes the interaction between various factors and improves the scientific nature of the vulnerability index.

[0194] 3) Mapping continuous indexes to discrete risk levels facilitates intuitive understanding and quick decision-making, and improves the operability and practicality of the assessment results.

[0195] In an optional implementation, for the inter-domain security risk coefficient, an inter-domain access control rule set is determined, the inter-domain access control rule set includes a source domain whitelist, a target domain access permission, and an inter-domain traffic threshold; for the intra-domain security vulnerability index, an intra-domain protection strategy is generated, the intra-domain protection strategy includes asset reinforcement rules, traffic cleaning rules, and attack feature identification rules; combining the inter-domain access control rule set and the intra-domain protection strategy to form a cross-domain collaborative protection strategy includes:

[0196] A multi-dimensional reputation evaluation model is established according to the historical communication quality, abnormal event frequency and security compliance score of the source domain, the source domain reputation is calculated based on the multi-dimensional reputation evaluation model, the source domain reputation is compared with a dynamic threshold, and when the source domain reputation exceeds the dynamic threshold, the source domain IP address segment is added to the source domain whitelist, and the source domain reputation is updated using a time decay mechanism;

[0197] The target domain assets are divided into security levels to establish a resource access matrix, and access roles are assigned according to the source domain identity attributes and security levels. The access roles include read permissions, write permissions, and execute permissions. The target domain access permissions are generated through role inheritance mechanisms and constraint rules.

[0198] Collect historical inter-domain traffic data to establish a traffic baseline model, the traffic baseline model includes the total traffic volume, traffic distribution characteristics and periodic change rules, calculate the alarm threshold and blocking threshold in combination with the inter-domain security risk coefficient to obtain the inter-domain traffic threshold, and combine the source domain whitelist, the target domain access rights and the inter-domain traffic threshold to generate an inter-domain access control rule set;

[0199] Formulate operating system security baseline configuration, patch distribution strategy and system service management rules at the system level; formulate middleware security parameter configuration, application access control strategy and data protection rules at the application level; formulate port management strategy, protocol restriction rules and network isolation strategy at the network level; and generate asset reinforcement rules;

[0200] Establish a normal traffic model that includes protocol distribution characteristics, data packet length distribution, and session behavior characteristics. Filter illegal messages through protocol compliance checks. Filter abnormal traffic based on traffic feature identification and behavior analysis. Adjust filtering strategies based on the security vulnerability index within the domain to generate traffic cleaning rules.

[0201] Analyze known attack samples to extract attack feature strings and behavior patterns to establish a feature library, use AC automaton algorithm to achieve multi-mode matching, identify unknown attack features through deep learning of traffic data, formulate disposal rules based on the threat level of attack features to generate attack feature identification rules, and combine the asset reinforcement rules, traffic cleaning rules and attack feature identification rules to generate a domain protection strategy;

[0202] A policy dependency graph of the inter-domain access control rule set and the intra-domain protection policy is established, direct and indirect policy conflicts are detected through a graph traversal algorithm, the detected conflicts are arbitrated based on policy priorities and security risk assessment results, and the arbitrated inter-domain access control rule set and the intra-domain protection policy are combined to form a cross-domain collaborative protection strategy.

[0203] This embodiment provides a method for generating a cross-domain collaborative protection strategy, comprising the following steps:

[0204] First, the inter-domain security risk factor is analyzed to determine the inter-domain access control rule set, which includes three main components: source domain whitelist, target domain access rights, and inter-domain traffic threshold.

[0205] Specifically, a multi-dimensional reputation evaluation model is established to calculate the reputation of the source domain. The model comprehensively considers multiple dimensions such as the historical communication quality, abnormal event frequency, and security compliance score of the source domain. For example, the historical communication quality can be quantified by analyzing indicators such as the communication success rate and average response time in the past 30 days; the abnormal event frequency can count the number of malicious traffic, attack attempts, and other events detected in the past 90 days; the security compliance score can be evaluated based on factors such as whether the source domain has passed security certification and whether necessary security measures have been deployed.

[0206] These indicators are weighted to obtain the comprehensive reputation score of the source domain, ranging from 0 to 100 points. A dynamic threshold is set, with an initial value of 80 points, which is adjusted every 7 days based on the overall security situation. When the reputation of a source domain exceeds the dynamic threshold, the IP address segment of the source domain is added to the whitelist. At the same time, a time decay mechanism is used to decay the reputation score by 1% every 24 hours to ensure that changes in the security status of the source domain are reflected in a timely manner.

[0207] For the assets in the target domain, first divide the security level, for example, divide the assets into four levels: public, internal, confidential, and top secret. Then establish a resource access matrix, with the horizontal axis representing the resource type and the vertical axis representing the access role. According to the identity attributes of the source domain (such as ordinary users, administrators, etc.) and security level, assign the corresponding access role. The access role includes three basic permissions: read, write, and execute.

[0208] Through the role inheritance mechanism, high-level roles can inherit the permissions of low-level roles. For example, the administrator role inherits all permissions of the ordinary user role. At the same time, set constraint rules, such as mutual exclusion rules (prohibiting the same user from having both the auditor and system administrator roles at the same time), cardinality rules (limiting the number of roles to 3 at the same time), etc. Finally, a detailed list of target domain access permissions is generated.

[0209] Collect at least 90 days of inter-domain historical traffic data and establish a traffic baseline model. The model includes: total traffic volume (such as an average traffic volume of 10GB per hour), traffic distribution characteristics (such as TCP accounts for 70%, HTTP accounts for 20%, and other protocols account for 10%), periodic change rules (such as 9:00-18:00 on weekdays is the peak period), etc. Combined with the inter-domain security risk factor, calculate the alarm threshold (such as 1.5 times the baseline) and the blocking threshold (such as 2 times the baseline) to obtain the inter-domain traffic threshold.

[0210] The source domain whitelist, target domain access rights, and inter-domain traffic threshold are combined to generate a complete set of inter-domain access control rules. For example, the IP segment 192.168.1.0 / 24 in the whitelist is allowed to access the Web server with a security level of "internal" in the target domain, but an alarm is triggered when the total traffic from the IP segment to the target domain exceeds 100Mbps, and it is blocked when it exceeds 150Mbps.

[0211] Next, based on the domain security vulnerability index, a domain protection strategy is generated. The strategy includes asset reinforcement rules, traffic cleaning rules, and attack feature identification rules.

[0212] Asset reinforcement rules cover three levels: system, application, and network. The system level includes: operating system security baseline configuration (such as disabling guest accounts and setting the principle of least privilege), patch distribution strategy (such as key patches must be installed within 24 hours), and system service management rules (such as shutting down unnecessary services). The application level includes: middleware security parameter configuration (such as disabling directory browsing on web servers), application access control strategy (such as limiting remote access to databases), and data protection rules (such as encrypted storage of sensitive data). The network level includes: port management strategy (such as opening only necessary ports), protocol restriction rules (such as disabling telnet), and network isolation strategy (such as VLAN division).

[0213] Traffic cleaning rules are formulated based on the normal traffic model. The model includes protocol distribution characteristics (such as HTTP should account for 15%-25%), packet length distribution (such as the average length of TCP packets is between 500-1500 bytes) and session behavior characteristics (such as the number of single IP connections does not exceed 100). Filter non-standard format messages through protocol compliance checks; filter abnormal traffic based on traffic feature identification and behavior analysis, such as SYN Flood attacks. Adjust the strictness of the filtering policy according to the security vulnerability index within the domain to generate the final traffic cleaning rules.

[0214] The attack feature recognition rules first analyze known attack samples, extract feature strings (such as specific pay-l oad content) and behavior patterns (such as a large number of failed login attempts in a short period of time), and establish a feature library. The AC automaton algorithm is used to achieve efficient multi-pattern matching. At the same time, deep learning is performed on traffic data to identify unknown attack features. According to the threat level of the attack feature (such as high, medium, and low), corresponding disposal rules (such as blocking, alarming, and recording) are formulated. Finally, a complete set of attack feature recognition rules is generated.

[0215] Combine asset reinforcement rules, traffic cleaning rules and attack feature identification rules to form a domain protection strategy.

[0216] Finally, the inter-domain access control rule set and the intra-domain protection strategy are integrated to generate a cross-domain collaborative protection strategy. First, a policy dependency graph is established, where nodes represent specific rules and edges represent dependencies between rules. Through graph traversal algorithms such as depth-first search, direct conflicts between policies (such as rule A allows an operation while rule B prohibits it) and indirect conflicts (such as rule chains produce contradictory results) are detected.

[0217] For detected conflicts, arbitration is performed based on predefined policy priorities (such as security over availability) and security risk assessment results. For example, when the inter-domain access control rule allows a certain IP to access, and the attack signature identification rule detects that the IP has malicious behavior, a decision is made based on the risk assessment results to determine whether to block the IP's access. In this way, policy conflicts are resolved, and a consistent and efficient cross-domain collaborative protection strategy is ultimately formed.

[0218] The beneficial effects of this method are mainly reflected in the following three aspects:

[0219] 1. Improved the accuracy and effectiveness of cross-domain security protection. Through multi-dimensional evaluation of source domain reputation, dynamically adjust the whitelist; combine asset security level and role inheritance mechanism to achieve fine-grained access control; formulate reasonable traffic thresholds based on historical traffic models and security risk factors. These measures significantly improve the accuracy of inter-domain access control and effectively prevent misjudgment and missed judgment.

[0220] 2. Enhanced the comprehensiveness and adaptability of domain protection. Comprehensive asset reinforcement rules are formulated from the three levels of system, application, and network; based on normal traffic models and protocol characteristics, accurate abnormal traffic filtering is achieved; combined with known attack features and machine learning technology, the ability to identify unknown threats is improved. At the same time, the protection strategy is dynamically adjusted according to the security vulnerability index within the domain, so that the protection measures can adapt to the ever-changing security situation.

[0221] 3. Achieved consistency and coordination of cross-domain protection strategies. By establishing a policy dependency graph, policy conflicts are systematically detected and resolved; policy arbitration is performed based on priority and risk assessment to ensure consistency of cross-domain collaborative protection strategies. This approach not only improves the overall protection effect, but also reduces the complexity of policy management, which is conducive to security operations in large-scale network environments.

[0222] In an optional implementation, optimizing and adjusting the cross-domain collaborative protection strategy using a reinforcement learning algorithm according to the strategy execution feedback data includes:

[0223] Collect rule hit rate, false interception rate and access delay time at the inter-domain access control layer, collect attack detection rate, protection success rate and system resource overhead at the intra-domain protection layer, obtain the rule hit rate, false interception rate, access delay time, attack detection rate, protection success rate and system resource overhead in real time through distributed data collection probes to form raw data, clean, normalize and feature extract the raw data to obtain a policy execution state vector;

[0224] The protection environment is modeled as a Markov decision process, the strategy execution state vector is constructed as a state space, the strategy parameter adjustment options are constructed as an action space, the reward function is designed based on the protection effect and resource overhead, a two-layer LSTM structure is used to extract time series features, and the attention mechanism is combined to process the correlation of different protection dimensions. The Q value of the action is adjusted through the fully connected layer output;

[0225] Construct an experience pool to store historical strategy adjustment samples, wherein the historical strategy adjustment samples include the current state, executed action, immediate reward, and next state, assign sampling weights to the historical strategy adjustment samples according to the time delta error, and implement priority experience playback based on the sampling weights;

[0226] Maintaining the main network parameters and the target network parameters, using the main network parameters for online learning, and soft-updating the target network parameters by adjusting the target network update frequency and update step size to achieve gradient clipping and prevent policy parameter oscillation;

[0227] Design a segmented attenuation curve for the exploration rate. In the early stage of training, the first attenuation rate is used for random exploration. In the middle stage of training, the second attenuation rate is used to increase strategy utilization. In the late stage of training, the third attenuation rate is used to keep the strategy stable. When it is detected that the strategy performance has dropped, the exploration rate is increased to perform local search.

[0228] Collect false alarm rate, false alarm rate, response time, CPU utilization, memory usage and network bandwidth to build evaluation indicators, calculate the statistical characteristics of the evaluation indicators within a sliding time window, obtain a comprehensive score through indicator normalization and weighted combination, and adjust the reward function weight and the exploration rate segmented attenuation curve based on the comprehensive score;

[0229] The optimized protection strategy is simulated and stress-tested in the test environment to obtain test results. The reliability of the strategy is verified based on the test results. The verified protection strategy is pushed to the production environment through grayscale release, and the system status parameters are monitored. When the system status parameters are abnormal, a multi-level rollback mechanism is triggered. Specific implementation method:

[0231] First, relevant indicator data are collected at the inter-domain access control level and the intra-domain protection level. At the inter-domain access control level, the rule hit rate, false interception rate, and access delay time are collected. The rule hit rate indicates the proportion of successful interception or release of access control rules, the false interception rate indicates the proportion of legal accesses that are incorrectly intercepted, and the access delay time indicates the processing time of access requests. At the intra-domain protection level, the attack detection rate, protection success rate, and system resource overhead are collected. The attack detection rate indicates the proportion of successfully detected attacks, the protection success rate indicates the proportion of successfully blocked attacks, and the system resource overhead indicates the consumption of resources such as CPU and memory during the protection process.

[0232] The above indicator data is obtained in real time through distributed data collection probes to form raw data. Data collection probes are deployed on various network nodes and protection devices to collect relevant logs and performance data through point-of-use. The raw data is cleaned to remove outliers and missing values; then normalized to convert indicators of different dimensions to a unified interval; finally, time series, statistics and other features are extracted to obtain the policy execution state vector. For example, the rule hit rate is averaged in a sliding window, and the mean and variance features of the access delay time are extracted.

[0233] Next, the protection environment is modeled as a Markov decision process. The state space is composed of the above policy execution state vector, which contains 6 dimensions. The action space is composed of policy parameter adjustment options, such as adjusting the tightness of access control rules and attack detection thresholds. The reward function is designed and calculated based on the protection effect and resource overhead. For example, the higher the protection success rate and the lower the resource overhead, the greater the reward.

[0234] A two-layer LSTM structure is used to extract time series features. The first layer of LSTM encodes the time series information of a single protection dimension, and the second layer of LSTM fuses information of different dimensions. The attention mechanism is used to process the correlation of different protection dimensions, and higher weights are given to important dimensions. The Q value of each adjustment action is output through the fully connected layer, indicating the long-term benefit of the action.

[0235] Construct an experience pool to store historical policy adjustment samples, including the current state, execution action, immediate reward, and next state quadruple. Calculate the TD error of the sample based on the time delta error. The sample with a larger TD error has a higher sampling weight. Priority experience playback is implemented based on the sampling weight, and samples with large TD errors are sampled from the experience pool first for learning.

[0236] Maintain two sets of parameters for the main network and the target network. The main network is used for online learning, and the target network is used to calculate the target Q value. Soft update the target network parameters by adjusting the update frequency and update step of the target network to avoid drastic changes in the target value. Implement gradient clipping, and truncate when the gradient exceeds the threshold to prevent policy parameter oscillation.

[0237] Design a segmented decay curve for the exploration rate, and divide the training process into three stages: early, middle, and late. In the early stage of training, a higher exploration rate and a faster first decay rate are used to conduct large-scale random exploration. In the middle of training, the exploration rate is reduced, and a slower second decay rate is used to increase the utilization of the learned strategy. In the late stage of training, the exploration rate is further reduced, and a slower third decay rate is used to maintain the stability of the strategy. When the performance of the strategy is detected to be declining, the exploration rate is appropriately increased to conduct local search to find a better strategy.

[0238] The evaluation system is constructed by collecting indicators such as false alarm rate, false alarm rate, response time, CPU utilization, memory usage and network bandwidth. The statistical characteristics of these indicators such as mean, variance and trend are calculated in the sliding time window. Different indicators are mapped to the [0,1] interval through min-max normalization, and then the comprehensive score is obtained by weighted summation. According to the changing trend of the comprehensive score, the weights of each indicator in the reward function and the parameters of the exploration rate segmented attenuation curve are dynamically adjusted.

[0239] The optimized protection strategy is simulated and stressed in the test environment. The simulation test simulates the real network environment and attack scenarios to verify the effectiveness of the strategy. The stress test uses extreme scenarios such as high concurrency and large traffic to verify the robustness of the strategy. The reliability of the strategy is evaluated based on the test results, including functional correctness, performance stability and other aspects. For the protection strategy that has passed the verification, it is gradually pushed to the production environment in a grayscale release. Deploy it in a small range first, and monitor system status parameters such as CPU utilization and memory usage. When these parameters are abnormal, a multi-level rollback mechanism is triggered, including rolling back to the last stable version, downgrading to a conservative strategy, and other measures to ensure the continuous availability of the system.

[0240] Beneficial effects:

[0241] 1. Dynamically optimize the cross-domain collaborative protection strategy through reinforcement learning algorithm, improve the protection effect and resource utilization efficiency. Adopt distributed data collection, double-layer LSTM structure and attention mechanism to achieve accurate modeling and feature extraction of complex heterogeneous environments.

[0242] 2. We designed a segmented attenuation curve for the exploration rate and a priority experience replay mechanism to improve learning efficiency while ensuring the stability of the strategy. We effectively solved the problem of strategy oscillation through technologies such as soft update of the target network and gradient clipping.

[0243] 3. A comprehensive evaluation indicator system has been established to achieve reliability verification and smooth deployment of protection strategies. Grayscale release and multi-level rollback mechanisms are adopted to ensure the stability and continuity of the production environment. The overall solution has greatly improved the intelligence and adaptability of cross-domain collaborative protection.

[0244] Figure 2 FIG. 1 is a schematic diagram of a cross-domain network security policy automatic generation and protection policy collaboration system according to an embodiment of the present invention. Figure 2 As shown, the system comprises:

[0245] The first unit is used to collect security event data of multiple network domains, wherein the security event data includes network attack type, attack source address, attack target, and attack time; construct a security threat map based on the security event data, wherein the security threat map records network attack paths, attack characteristics, and attack impact range; analyze the security threat map using a deep learning algorithm to generate a cross-domain network security risk score, wherein the cross-domain network security risk score includes an inter-domain security risk coefficient and an intra-domain security vulnerability index;

[0246] The second unit is used to determine an inter-domain access control rule set according to the inter-domain security risk coefficient, wherein the inter-domain access control rule set includes a source domain whitelist, a target domain access permission, and an inter-domain traffic threshold; generate an intra-domain protection strategy according to the intra-domain security vulnerability index, wherein the intra-domain protection strategy includes asset reinforcement rules, traffic cleaning rules, and attack feature identification rules; and combine the inter-domain access control rule set and the intra-domain protection strategy to form a cross-domain collaborative protection strategy;

[0247] The third unit is used to deploy the cross-domain collaborative protection strategy on security devices in multiple network domains; establish an inter-domain security information sharing channel to exchange security threat intelligence in real time; monitor the protection effect of the cross-domain collaborative protection strategy and obtain strategy execution feedback data; optimize and adjust the cross-domain collaborative protection strategy based on the strategy execution feedback data using a reinforcement learning algorithm to improve the effectiveness of the protection strategy; and synchronously update the optimized protection strategy to the security devices in each network domain.

[0248] According to a third aspect of the embodiments of the present invention,

[0249] An electronic device is provided, comprising:

[0250] processor;

[0251] a memory for storing processor-executable instructions;

[0252] The processor is configured to call the instructions stored in the memory to execute the aforementioned method.

[0253] A fourth aspect of the embodiments of the present invention is:

[0254] A computer-readable storage medium is provided, on which computer program instructions are stored. When the computer program instructions are executed by a processor, the aforementioned method is implemented.

[0255] The present invention may be a method, an apparatus, a system and / or a computer program product. The computer program product may include a computer-readable storage medium carrying computer-readable program instructions for executing various aspects of the present invention.

[0256] Finally, it should be noted that the above embodiments are only used to illustrate the technical solutions of the present invention, rather than to limit it. Although the present invention has been described in detail with reference to the aforementioned embodiments, those skilled in the art should understand that they can still modify the technical solutions described in the aforementioned embodiments, or replace some or all of the technical features therein with equivalents. However, these modifications or replacements do not cause the essence of the corresponding technical solutions to deviate from the scope of the technical solutions of the embodiments of the present invention.

Claims

1. A cross-domain network security strategy automatic generation and protection strategy collaboration method, characterized in that: include: Collect security event data of multiple network domains, wherein the security event data includes network attack type, attack source address, attack target, and attack time; Constructing a security threat map based on the security event data, wherein the security threat map records the network attack path, attack characteristics, and attack impact range; analyzing the security threat map using a deep learning algorithm to generate a cross-domain network security risk score, wherein the cross-domain network security risk score includes an inter-domain security risk coefficient and an intra-domain security vulnerability index; According to the inter-domain security risk coefficient, an inter-domain access control rule set is determined, and the inter-domain access control rule set includes a source domain whitelist, a target domain access permission, and an inter-domain traffic threshold; according to the intra-domain security vulnerability index, an intra-domain protection strategy is generated, and the intra-domain protection strategy includes asset reinforcement rules, traffic cleaning rules, and attack feature identification rules; the inter-domain access control rule set and the intra-domain protection strategy are combined to form a cross-domain collaborative protection strategy; The cross-domain collaborative protection strategy is deployed on security devices in multiple network domains; an inter-domain security information sharing channel is established to exchange security threat intelligence in real time; the protection effect of the cross-domain collaborative protection strategy is monitored and strategy execution feedback data is obtained; based on the strategy execution feedback data, the cross-domain collaborative protection strategy is optimized and adjusted using a reinforcement learning algorithm to improve the effectiveness of the protection strategy; and the optimized protection strategy is synchronously updated to the security devices in each network domain.

2. The method according to claim 1, characterized in that Collect security event data of multiple network domains, wherein the security event data includes network attack type, attack source address, attack target, and attack time; A security threat map is constructed based on the security event data, and the security threat map records the network attack path, attack characteristics and attack impact range, including: Dual network card security probes are deployed in multiple network domains. The dual network card security probes obtain network traffic through network mirroring technology, the dual network card security probes use zero copy technology to capture data packets, and the dual network card security probes set a Ring Buffer cache mechanism; the dual network card security probes collect network layer attack features, application layer threat data and terminal abnormal behavior to generate security event data; the dual network card security probes collect network traffic data, and the network traffic data includes data packet size distribution information, protocol type information, port information and session status information; Performing feature engineering processing on the security event data and the network traffic data, wherein the feature engineering processing includes data standardization processing and feature extraction processing; constructing the data processed by the feature engineering into a multidimensional feature vector, wherein the multidimensional feature vector includes traffic feature dimension information, session feature dimension information, behavior feature dimension information, and context feature dimension information; storing the multidimensional feature vector using a compressed sparse matrix storage structure; performing dimensionality reduction processing on the multidimensional feature vector using a principal component analysis algorithm, and screening key features based on an information gain algorithm, constructing feature cross terms, and generating a feature matrix; A security threat graph is constructed based on the feature matrix, and attacker information nodes, attack method information nodes and attack target information nodes are extracted from the feature matrix, and the attacker information nodes, attack method information nodes and attack target information nodes are used as entity nodes; a timing dependency graph is constructed, and attack path information is identified based on the timing dependency graph, and the attack path information is used as an entity relationship; a graph propagation algorithm is used to calculate the influence propagation intensity between each node, and a node influence propagation relationship is constructed; the entity nodes, the entity relationships and the node influence propagation relationships are integrated to form a security threat knowledge graph.

3. The method according to claim 1, characterized in that The security threat map is analyzed using a deep learning algorithm to generate a cross-domain network security risk score, which includes an inter-domain security risk coefficient and an intra-domain security vulnerability index including: Constructing a graph attention network model, the graph attention network model includes a node feature embedding layer, a multi-head attention layer and a graph convolution layer, wherein the node feature embedding layer converts the attacker node features, the attack method node features and the target node features into a feature vector, the multi-head attention layer aggregates information on the feature vector, and the graph convolution layer extracts local structural features of the feature vector; Using a linear transformation matrix to transform the feature vector into a query vector, a key vector, and a value vector, calculating an attention score based on the query vector and the key vector, and performing a matrix multiplication operation on the attention score and the value vector to obtain an attention weight; The graph convolution layer is used to perform feature aggregation on the nodes with the attention weights, and the original feature information is retained through residual connections, and the aggregated features are normalized; Based on the graph attention network model, the inter-domain attack path characteristics, the inter-domain abnormal traffic characteristics and the inter-domain trust relationship characteristics are analyzed, and the inter-domain attack path characteristics, the inter-domain abnormal traffic characteristics and the inter-domain trust relationship characteristics are feature-fused to generate an inter-domain security risk coefficient; the intra-domain asset vulnerability information, the intra-domain security protection capability information and the intra-domain threat exposure degree information are analyzed, and the intra-domain security vulnerability index is generated based on the intra-domain asset vulnerability information, the intra-domain security protection capability information and the intra-domain threat exposure degree information; The inter-domain security risk coefficient is weighted and fused with the intra-domain security vulnerability index to generate a cross-domain network security risk score.

4. The method according to claim 3, characterized in that Based on the graph attention network model, the inter-domain attack path features, the inter-domain abnormal traffic features and the inter-domain trust relationship features are analyzed, and the inter-domain attack path features, the inter-domain abnormal traffic features and the inter-domain trust relationship features are feature fused. Generate inter-domain security risk factors including: Constructing a path representation learning model, wherein the path representation learning model performs node sequence encoding on the attack path between the source domain and the target domain, calculates the importance weight of the attack path, generates a path vector representation based on the node sequence encoding and the importance weight, and accumulates the path vector representation to generate a path embedding matrix; Extracting traffic statistical features between the source domain and the target domain, extracting time series features from the traffic statistical features using a long short-term memory network, identifying abnormal traffic patterns based on the time series features, and generating an abnormality degree score; Analyzing historical interaction information between the source domain and the target domain, calculating a security policy matching degree between the source domain and the target domain, and generating a trust score based on the historical interaction information and the security policy matching degree; The path embedding matrix, the abnormality degree score and the trust score are standardized to obtain a standardized feature vector, the attention weight of the standardized feature vector is calculated, and the standardized feature vector is nonlinearly transformed using a multilayer perceptron to obtain a conversion feature vector; the conversion feature vector is weightedly fused with the attention weight, and an inter-domain security risk coefficient is generated through a deep neural network. The deep neural network includes an input layer, a hidden layer and an output layer. The output of the hidden layer is input to the output layer after random inactivation processing. The output layer uses a sigmoid activation function to output the inter-domain security risk coefficient.

5. The method according to claim 3, characterized in that: Analyzing the intra-domain asset vulnerability information, the intra-domain security protection capability information, and the intra-domain threat exposure degree information, and generating the intra-domain security vulnerability index based on the intra-domain asset vulnerability information, the intra-domain security protection capability information, and the intra-domain threat exposure degree information includes: A multi-level vulnerability assessment method is used to analyze the vulnerability information of assets within the domain. The multi-level vulnerability assessment method includes assessing operating system vulnerabilities, patch status, and system configuration at the system level, assessing security flaws of Web applications, databases, and middleware components at the application level, and assessing protocol implementation flaws, port exposure, and network topology vulnerabilities at the network level. The weights of the assessment results at each level are determined through the hierarchical analysis method and weighted fusion is used to generate a comprehensive score for asset vulnerability. Analyze the security protection capability information in the domain based on the protection depth and breadth assessment framework, conduct in-depth assessment of the deployment of boundary protection, access control, intrusion detection, and malicious code protection mechanisms, conduct quantitative assessment based on the coverage, response timeliness, and protection accuracy of protection measures, conduct breadth assessment of the completeness of the security management system, emergency response capabilities, and security operation and maintenance levels, construct a protection capability assessment matrix based on the depth assessment results and the breadth assessment results, normalize the protection capability assessment matrix, and perform weighted calculation to obtain a security protection capability score; Establish a threat assessment model based on multi-source data fusion to analyze the threat exposure information within the domain, collect the open ports, service types and access control policies of the assets within the domain, analyze the historical security event data to extract attack features and establish a threat probability prediction model, combine external threat intelligence to assess the threat type and severity, and quantify various threats through the threat scoring engine to obtain threat exposure indicators; The asset vulnerability comprehensive score, the security protection capability score and the threat exposure index are normalized to obtain a normalized score, and a cross-term weight coefficient is introduced to construct a nonlinear combination function. Based on the normalized score and the cross-term weight coefficient, an intra-domain security vulnerability index is generated, and the intra-domain security vulnerability index is mapped to a discrete risk level through a hierarchical mapping mechanism.

6. The method according to claim 1, characterized in that According to the inter-domain security risk coefficient, an inter-domain access control rule set is determined, and the inter-domain access control rule set includes a source domain whitelist, a target domain access permission, and an inter-domain traffic threshold; according to the intra-domain security vulnerability index, an intra-domain protection strategy is generated, and the intra-domain protection strategy includes asset reinforcement rules, traffic cleaning rules, and attack feature identification rules; combining the inter-domain access control rule set and the intra-domain protection strategy to form a cross-domain collaborative protection strategy includes: A multi-dimensional reputation evaluation model is established according to the historical communication quality, abnormal event frequency and security compliance score of the source domain, the source domain reputation is calculated based on the multi-dimensional reputation evaluation model, the source domain reputation is compared with a dynamic threshold, and when the source domain reputation exceeds the dynamic threshold, the source domain IP address segment is added to the source domain whitelist, and the source domain reputation is updated using a time decay mechanism; The target domain assets are divided into security levels to establish a resource access matrix, and access roles are assigned according to the source domain identity attributes and security levels. The access roles include read permissions, write permissions, and execute permissions. The target domain access permissions are generated through role inheritance mechanisms and constraint rules. Collect historical inter-domain traffic data to establish a traffic baseline model, the traffic baseline model includes the total traffic volume, traffic distribution characteristics and periodic change rules, calculate the alarm threshold and blocking threshold in combination with the inter-domain security risk coefficient to obtain the inter-domain traffic threshold, and combine the source domain whitelist, the target domain access rights and the inter-domain traffic threshold to generate an inter-domain access control rule set; Formulate operating system security baseline configuration, patch distribution strategy and system service management rules at the system level; formulate middleware security parameter configuration, application access control strategy and data protection rules at the application level; formulate port management strategy, protocol restriction rules and network isolation strategy at the network level; and generate asset reinforcement rules; Establish a normal traffic model that includes protocol distribution characteristics, data packet length distribution, and session behavior characteristics. Filter illegal messages through protocol compliance checks. Filter abnormal traffic based on traffic feature identification and behavior analysis. Adjust filtering strategies based on the security vulnerability index within the domain to generate traffic cleaning rules. Analyze known attack samples to extract attack feature strings and behavior patterns to establish a feature library, use AC automaton algorithm to achieve multi-mode matching, identify unknown attack features through deep learning of traffic data, formulate disposal rules based on the threat level of attack features to generate attack feature identification rules, and combine the asset reinforcement rules, traffic cleaning rules and attack feature identification rules to generate a domain protection strategy; A policy dependency graph of the inter-domain access control rule set and the intra-domain protection policy is established, direct and indirect policy conflicts are detected through a graph traversal algorithm, the detected conflicts are arbitrated based on policy priorities and security risk assessment results, and the arbitrated inter-domain access control rule set and the intra-domain protection policy are combined to form a cross-domain collaborative protection strategy.

7. The method according to claim 1, characterized in that According to the feedback data from the strategy execution, optimizing and adjusting the cross-domain collaborative protection strategy using a reinforcement learning algorithm includes: Collect rule hit rate, false interception rate and access delay time at the inter-domain access control layer, collect attack detection rate, protection success rate and system resource overhead at the intra-domain protection layer, obtain the rule hit rate, false interception rate, access delay time, attack detection rate, protection success rate and system resource overhead in real time through distributed data collection probes to form raw data, clean, normalize and feature extract the raw data to obtain a policy execution state vector; The protection environment is modeled as a Markov decision process, the strategy execution state vector is constructed as a state space, the strategy parameter adjustment options are constructed as an action space, the reward function is designed based on the protection effect and resource overhead, a two-layer LSTM structure is used to extract time series features, and the attention mechanism is combined to process the correlation of different protection dimensions. The Q value of the action is adjusted through the fully connected layer output; Construct an experience pool to store historical strategy adjustment samples, wherein the historical strategy adjustment samples include the current state, executed action, immediate reward, and next state, assign sampling weights to the historical strategy adjustment samples according to the time delta error, and implement priority experience playback based on the sampling weights; Maintaining the main network parameters and the target network parameters, using the main network parameters for online learning, and soft-updating the target network parameters by adjusting the target network update frequency and update step size to achieve gradient clipping and prevent policy parameter oscillation; Design a segmented attenuation curve for the exploration rate. In the early stage of training, the first attenuation rate is used for random exploration. In the middle stage of training, the second attenuation rate is used to increase strategy utilization. In the late stage of training, the third attenuation rate is used to keep the strategy stable. When it is detected that the strategy performance has dropped, the exploration rate is increased to perform local search. Collect false alarm rate, false alarm rate, response time, CPU utilization, memory usage and network bandwidth to build evaluation indicators, calculate the statistical characteristics of the evaluation indicators within a sliding time window, obtain a comprehensive score through indicator normalization and weighted combination, and adjust the reward function weight and the exploration rate segmented attenuation curve based on the comprehensive score; The optimized protection strategy is simulated and stress-tested in the test environment to obtain test results. The reliability of the strategy is verified based on the test results. The verified protection strategy is pushed to the production environment through grayscale release, and the system status parameters are monitored. When the system status parameters are abnormal, a multi-level rollback mechanism is triggered.

8. A cross-domain network security strategy automatic generation and protection strategy coordination system, used to implement the method described in any one of claims 1 to 7, characterized in that: include: The first unit is used to collect security event data of multiple network domains, wherein the security event data includes network attack type, attack source address, attack target, and attack time; Constructing a security threat map based on the security event data, wherein the security threat map records the network attack path, attack characteristics, and attack impact range; analyzing the security threat map using a deep learning algorithm to generate a cross-domain network security risk score, wherein the cross-domain network security risk score includes an inter-domain security risk coefficient and an intra-domain security vulnerability index; The second unit is used to determine an inter-domain access control rule set according to the inter-domain security risk coefficient, wherein the inter-domain access control rule set includes a source domain whitelist, a target domain access permission, and an inter-domain traffic threshold; generate an intra-domain protection strategy according to the intra-domain security vulnerability index, wherein the intra-domain protection strategy includes asset reinforcement rules, traffic cleaning rules, and attack feature identification rules; and combine the inter-domain access control rule set and the intra-domain protection strategy to form a cross-domain collaborative protection strategy; The third unit is used to deploy the cross-domain collaborative protection strategy on security devices in multiple network domains; establish an inter-domain security information sharing channel to exchange security threat intelligence in real time; Monitor the protection effect of the cross-domain collaborative protection strategy and obtain strategy execution feedback data; optimize and adjust the cross-domain collaborative protection strategy using a reinforcement learning algorithm based on the strategy execution feedback data to improve the effectiveness of the protection strategy; and synchronously update the optimized protection strategy to security devices in each network domain.

9. An electronic device, characterized in that: include: processor; a memory for storing processor-executable instructions; The processor is configured to call the instructions stored in the memory to execute the method described in any one of claims 1 to 7.

10. A computer-readable storage medium having computer program instructions stored thereon, characterized in that: When the computer program instructions are executed by a processor, the method according to any one of claims 1 to 7 is implemented.

Images