Artificial intelligence-driven adaptive firewall rule optimization method and system

Abstract

This invention provides an artificial intelligence-driven adaptive firewall rule optimization method and system, which relates to the field of artificial intelligence technology. The method involves collecting network traffic data, system log data, and security event data, extracting multidimensional feature vectors through deep packet inspection, natural language processing, and correlation analysis; constructing a deep neural network model based on the multidimensional feature vectors, including a feature encoding layer, a time series analysis layer, and a rule prediction layer, to generate a set of rule policies; performing parallel verification testing on the set of rule policies, optimizing the rule policies using a genetic algorithm, and dynamically adjusting model weight parameters based on real-time changes in the network environment before issuing the rules. This invention achieves intelligent adaptive optimization of firewall rules, improves rule matching efficiency, and reduces false positive and false negative rates.

Description

Technical Field

[0001] The present invention relates to artificial intelligence technology, and in particular to an artificial intelligence-driven adaptive firewall rule optimization method and system. Background Art

[0002] With the rapid development of network technology and the continuous evolution of network attack methods, firewalls, as a key infrastructure for network security protection, have a direct impact on the effectiveness of their rule configuration. Traditional firewall rule configuration relies mainly on manual adjustments based on administrator experience, making it difficult to adapt to complex and changing network environments. In recent years, the application of artificial intelligence technology in the field of network security has become increasingly widespread, providing a new technical approach for the intelligent optimization of firewall rules.

[0003] Existing firewall rule optimization methods lack the ability to comprehensively analyze multi-source heterogeneous data and rely solely on a single data source for rule adjustment, resulting in one-sided rule optimization results that fail to fully reflect the security status of the network environment. Existing technologies fail to effectively utilize the temporal characteristics of network traffic and lack in-depth analysis of the evolution of network attack behavior, making it difficult to predict and defend against complex attacks with temporal correlations. Existing rule optimization methods use static optimization strategies and are unable to dynamically adjust rule parameters based on real-time changes in the network environment, resulting in delayed rule updates and impacting protection effectiveness.

[0004] The present invention aims to solve technical problems existing in existing firewall rule optimization methods, such as insufficient multi-source data analysis capabilities, insufficient utilization of temporal characteristics, and lack of dynamic rule adjustment capabilities. It provides an adaptive firewall rule optimization method based on artificial intelligence, which realizes multi-source fusion analysis of network traffic data, system log data and security event data, fully utilizes the temporal characteristics of network behavior, and can optimize rule strategies in real time according to changes in the network environment, thereby improving the protection effect of the firewall. Summary of the Invention

[0005] The embodiments of the present invention provide an artificial intelligence-driven adaptive firewall rule optimization method and system, which can solve the problems in the prior art.

[0006] According to a first aspect of the embodiments of the present invention,

[0007] Provides AI-driven adaptive firewall rule optimization methods, including:

[0008] Collect network traffic data, system log data, and security event data from the firewall system, perform deep packet inspection on the network traffic data, and extract network protocol features, data packet size features, and data packet time interval features; perform natural language processing on the system log data to extract system operation features, user behavior features, and resource access features; perform correlation analysis on the security event data to extract attack pattern features, threat level features, and attack source features, and construct all the extracted features into a multidimensional feature vector;

[0009] A deep neural network model is constructed based on the multidimensional feature vector, and the deep neural network model includes a feature encoding layer, a time series analysis layer, and a rule prediction layer; the feature encoding layer uses an autoencoder to reduce the dimension of the multidimensional feature vector; the time series analysis layer uses a long short-term memory network to perform time series correlation analysis on the feature data after dimensionality reduction; the rule prediction layer generates a firewall rule policy set based on the time series analysis results based on a reinforcement learning algorithm, each rule policy includes a source address filtering rule, a destination address filtering rule, a protocol type filtering rule, a port filtering rule, and a data packet content filtering rule;

[0010] The rule strategy set is verified and tested in parallel, and the false alarm rate, missed alarm rate and rule execution efficiency of each rule strategy are recorded to construct a rule evaluation index matrix. Based on the rule evaluation index matrix, a genetic algorithm is used to optimize the rule strategy, and new rule combinations are generated through crossover and mutation operations to iteratively optimize the rule strategy set. According to real-time changes in the network environment, the weight parameters of the deep neural network model are dynamically adjusted, and the optimized rule strategy is sent to the firewall system in real time to achieve adaptive optimization of firewall rules.

[0011] Collect network traffic data, system log data, and security event data from the firewall system, perform deep packet inspection on the network traffic data, and extract network protocol features, data packet size features, and data packet time interval features, including:

[0012] The data collection module deployed in the firewall system collects network traffic data, system log data, and security event data, wherein the network traffic data is collected by a network probe with a double buffer mechanism, and the network probe uses zero-copy technology to directly transfer data packets from the network card buffer to the user space. The system log data is collected by a log collection agent program, and the security event data is collected by a security event monitoring module. The collected network traffic data, system log data, and security event data are stored in a data buffer pool.

[0013] Reading network traffic data from the data buffer pool, performing deep packet inspection on the network traffic data, first reassembling discrete data packets using a sliding window algorithm to obtain a complete data stream, then performing seven-layer protocol parsing on the complete data stream based on a state machine and feature matching mechanism to obtain a protocol parsing result, then performing session reconstruction on the protocol parsing result using a bidirectional state tracking technology to obtain a session data stream, and transmitting the session data stream to a feature extraction module;

[0014] Based on a preset protocol field dependency graph, protocol features are extracted from the session data stream to obtain a protocol feature set including a protocol type identifier, a protocol version number, and a protocol option field. Adaptive binning calculation and multi-dimensional statistical analysis are performed on the session data stream to obtain a data packet size feature set including data packet size distribution, data packet size mean, and data packet size variance. Timing analysis is performed on the session data stream using a multi-scale sliding time window to obtain a time interval feature set including arrival time series, periodic patterns, and burst traffic characteristics.

[0015] Performing natural language processing on the system log data to extract system operation features, user behavior features, and resource access features; performing correlation analysis on the security event data to extract attack pattern features, threat level features, and attack source features, and constructing all the extracted features into a multidimensional feature vector including:

[0016] A distributed log collection architecture is used to collect system log data and security event data in the firewall system, and the system log data and security event data are converted into standard format data through the log formatting module and stored in the data processing module;

[0017] Performing natural language processing on the system log data in the data processing module, segmenting the system log data using a word segmenter to obtain a segmentation sequence, performing part-of-speech tagging on the segmentation sequence based on a security domain dictionary to obtain a tag sequence, performing syntactic analysis on the tag sequence using a dependency syntax analyzer to obtain a syntax tree, extracting system operation features from the syntax tree, wherein the system operation features include an operation subject, an operation type, and an operation object; constructing a user behavior sequence based on the system operation features, extracting user behavior features from the user behavior sequence, wherein the user behavior features include an operation time feature, an operation frequency feature, and an operation preference feature; constructing a resource access graph based on the user behavior features, extracting resource access features from the resource access graph, wherein the resource access features include an access permission feature, an access scope feature, and an access frequency feature;

[0018] Performing correlation analysis on the security event data in the data processing module, clustering the security event data using a spatiotemporal correlation algorithm to obtain an event chain, analyzing the event chain based on a causal reasoning method to construct an attack scenario graph, extracting attack pattern features from the attack scenario graph, the attack pattern features including attack step features, attack technology features, and attack tool features; constructing a threat scoring model based on asset importance, vulnerability severity, and attack impact scope, and extracting threat level features from the threat scoring model using a fuzzy comprehensive evaluation method, the threat level features including threat level features, threat trend features, and threat impact features; extracting attack source features by analyzing the attack source IP reputation, geographic location, and behavioral patterns, the attack source features including geographic features, organizational features, and tactical features;

[0019] The system operation features, user behavior features, resource access features, attack mode features, threat level features, and attack source features are subjected to feature vectorization processing, including: one-hot encoding discrete features to obtain discrete feature vectors, normalizing continuous features to obtain continuous feature vectors, merging the discrete feature vectors and continuous feature vectors to construct an original feature vector, using a principal component analysis method to reduce the dimension of the original feature vector to obtain a reduced dimension feature vector, calculating the importance of each feature in the reduced dimension feature vector through information gain to obtain a feature importance index, and selecting features whose feature importance index exceeds a preset threshold to construct a multidimensional feature vector.

[0020] A deep neural network model is constructed based on the multidimensional feature vector, and the deep neural network model includes a feature encoding layer, a time series analysis layer, and a rule prediction layer; the feature encoding layer uses an autoencoder to reduce the dimension of the multidimensional feature vector; the time series analysis layer uses a long short-term memory network to perform time series correlation analysis on the feature data after dimension reduction; the rule prediction layer generates a firewall rule policy set based on the time series analysis results based on a reinforcement learning algorithm, and each rule policy includes a source address filtering rule, a destination address filtering rule, a protocol type filtering rule, a port filtering rule, and a data packet content filtering rule, including:

[0021] Constructing a deep neural network model based on the multidimensional feature vector, the deep neural network model comprising a feature encoding layer, a time series analysis layer, and a rule prediction layer, and inputting the multidimensional feature vector into the deep neural network model;

[0022] The feature coding layer uses an autoencoder to perform dimensionality reduction processing on the multidimensional feature vector, the autoencoder includes an encoder and a decoder, the encoder is provided with three hidden layers, the number of neurons in the three hidden layers is 1024, 512, and 256, respectively, each hidden layer is provided with a dropout layer to prevent overfitting, the dropout rate of the dropout layer is 0.3, and Gaussian noise is added to the input layer of the autoencoder to improve the robustness of the model, and the key information of the multidimensional feature vector is extracted by minimizing the reconstruction error to obtain the feature data after dimensionality reduction;

[0023] The time series analysis layer uses a long short-term memory network to perform time series correlation analysis on the feature data after dimensionality reduction. The long short-term memory network includes two layers of bidirectional long short-term memory structures. Each layer of bidirectional long short-term memory structure contains 128 memory units. The memory units include a forget gate, an input gate, and an output gate. The forget gate is used to control the degree of forgetting of historical information. The input gate is used to determine the degree of retention of current input information. The output gate is used to manage the output of information. The attention weights of different time steps are calculated based on the hidden state at the current moment to obtain the time series analysis results;

[0024] The rule prediction layer is based on a reinforcement learning algorithm and generates a firewall rule policy set according to the timing analysis results. The reinforcement learning algorithm adopts a dual network architecture, including a policy network and a value network. The policy network adopts an Actor-Critic framework to generate rule policies. The Actor network in the Actor-Critic framework outputs the probability distribution of the rule field, and the Critic network in the Actor-Critic framework estimates the value of the rule. An experience replay pool is set to store interaction data for training. The online network of the policy network and the value network regularly synchronizes parameters with the target network. Each rule policy in the firewall rule policy set includes source address filtering rules, destination address filtering rules, protocol type filtering rules, port filtering rules, and data packet content filtering rules.

[0025] The rule prediction layer generates a firewall rule policy set based on the time series analysis results based on a reinforcement learning algorithm. The reinforcement learning algorithm adopts a dual network architecture, including a policy network and a value network. The policy network uses an actor-critic framework to generate rule policies. The actor network in the actor-critic framework outputs the probability distribution of rule fields, and the critic network in the actor-critic framework estimates the value of the rules. An experience replay pool is set to store interaction data for training. The online network of the policy network and the value network regularly synchronizes parameters with the target network, including:

[0026] Receive the timing analysis results output by the timing analysis layer, input the timing analysis results into the rule prediction layer, and the rule prediction layer generates a firewall rule policy set based on the reinforcement learning algorithm;

[0027] Constructing a dual network architecture of the reinforcement learning algorithm, wherein the dual network architecture includes a policy network and a value network, wherein the policy network uses an actor-critic framework to generate rule strategies;

[0028] The timing analysis results are input into the Actor network in the Actor-Critic framework. After being processed by a three-layer fully connected network, the Actor network outputs the probability distribution of the rule field. The Softmax function is used to output the value probability of discrete fields such as source address, destination address, and port number, and the normal distribution function is used to output the mean parameter and variance parameter of continuous fields such as threshold and timeout.

[0029] Inputting the timing analysis results into the Critic network in the Actor-Critic framework, the Critic network estimates the value of the rule through a two-layer fully connected network, and provides a benchmark parameter for the strategy update of the Actor network;

[0030] Constructing a fixed-capacity experience replay pool to store interaction data, including the current state, executed actions, rewards, and next state, and randomly sampling training data from the experience replay pool;

[0031] The loss function of the critic network is constructed based on the mean square error of the temporal difference error, the policy gradient method is used to update the parameters of the actor network, and the online network parameters of the policy network and the value network are regularly synchronized to the target network according to the preset soft update coefficient.

[0032] Parallel verification testing is performed on the rule strategy set, and the false alarm rate, missed alarm rate, and rule execution efficiency of each rule strategy are recorded to construct a rule evaluation index matrix. Based on the rule evaluation index matrix, a genetic algorithm is used to optimize the rule strategy, and new rule combinations are generated through crossover and mutation operations. Iterative optimization of the rule strategy set includes:

[0033] Conduct parallel validation tests on the rule strategy set, record the false alarm rate, missed alarm rate, and rule execution efficiency of each rule strategy, and construct a rule evaluation index matrix. The rule evaluation index matrix includes rule strategy index matrix values and rule strategy index weight values, and the rule strategy index weight values are calculated using the hierarchical analysis method.

[0034] Normalizing the rule evaluation indicator matrix, calculating the rule strategy indicator matrix value using the Min-Max normalization method, and performing weighted summation on the normalized rule strategy indicator matrix values based on the rule strategy indicator weight values to obtain a comprehensive score for each rule strategy;

[0035] Based on the rule evaluation index matrix, a genetic algorithm is used to optimize the rule strategy, and the rule strategy is encoded into a chromosome sequence, wherein the chromosome sequence includes a source address field, a target address field, a protocol type field, a port number field, and a content feature field, and the chromosome sequence is encoded in a binary encoding manner;

[0036] A fitness function is designed based on the comprehensive score of the rule strategy, and a tournament selection strategy is used to select the individuals with the highest fitness from the population to enter the next generation. A new rule combination is generated through a two-point crossover operation, where the intersection of the two-point crossover operation is aligned with the rule field boundary. A mutation operator based on rule grammar constraints is used to perform a mutation operation, mutating the address field within the legal IP address range, the port field within the commonly used port list, and the protocol field within the predefined protocol type.

[0037] The rule strategy set is iteratively optimized. In each round of iteration, the individual with the highest fitness in the population is directly copied to the next generation through the elite retention strategy. When the change in the optimal fitness of the population for multiple consecutive generations is less than a preset threshold, the iteration is terminated and the individual with the highest fitness is selected to update the rule strategy set.

[0038] According to a second aspect of the embodiments of the present invention,

[0039] Provides an AI-driven adaptive firewall rule optimization system, including:

[0040] The first unit is configured to collect network traffic data, system log data, and security event data from the firewall system, perform deep packet inspection on the network traffic data to extract network protocol features, data packet size features, and data packet time interval features; perform natural language processing on the system log data to extract system operation features, user behavior features, and resource access features; perform correlation analysis on the security event data to extract attack pattern features, threat level features, and attack source features, and construct all the extracted features into a multidimensional feature vector;

[0041] The second unit is used to construct a deep neural network model based on the multidimensional feature vector, and the deep neural network model includes a feature encoding layer, a time series analysis layer, and a rule prediction layer; the feature encoding layer uses an autoencoder to reduce the dimension of the multidimensional feature vector; the time series analysis layer uses a long short-term memory network to perform time series correlation analysis on the feature data after dimensionality reduction; the rule prediction layer generates a firewall rule policy set based on the time series analysis results based on a reinforcement learning algorithm, each rule policy includes a source address filtering rule, a destination address filtering rule, a protocol type filtering rule, a port filtering rule, and a data packet content filtering rule;

[0042] The third unit is used to perform parallel verification tests on the rule strategy set, record the false alarm rate, missed alarm rate and rule execution efficiency of each rule strategy, and construct a rule evaluation index matrix; based on the rule evaluation index matrix, a genetic algorithm is used to optimize the rule strategy, and new rule combinations are generated through crossover and mutation operations, and the rule strategy set is iteratively optimized; according to real-time changes in the network environment, the weight parameters of the deep neural network model are dynamically adjusted, and the optimized rule strategy is sent to the firewall system in real time to achieve adaptive optimization of firewall rules.

[0043] According to a third aspect of the embodiments of the present invention,

[0044] An electronic device is provided, comprising:

[0045] processor;

[0046] a memory for storing processor-executable instructions;

[0047] The processor is configured to call the instructions stored in the memory to execute the aforementioned method.

[0048] According to a fourth aspect of the embodiments of the present invention,

[0049] A computer-readable storage medium is provided, on which computer program instructions are stored. When the computer program instructions are executed by a processor, the method described above is implemented.

[0050] The beneficial effects of this application are as follows:

[0051] 1. Improve the accuracy of firewall rules: Through deep learning and multi-dimensional feature analysis, malicious traffic and attack behaviors can be identified more accurately, reducing false positive and false negative rates, thereby improving the protection effect of the firewall.

[0052] 2. Achieve adaptive optimization of firewall rules: This method can dynamically adjust model parameters and rule policies according to real-time changes in the network environment, achieving automatic optimization of firewall rules without manual intervention, reducing operation and maintenance costs and improving the ability to respond to emerging threats.

[0053] 3. Improve the execution efficiency of firewall rules: Through parallel verification testing and genetic algorithm optimization, more efficient rule combinations can be screened out, reducing firewall resource consumption and improving overall performance. BRIEF DESCRIPTION OF THE DRAWINGS

[0054] Figure 1 This is a flow chart of an artificial intelligence-driven adaptive firewall rule optimization method according to an embodiment of the present invention;

[0055] Figure 2 This is a schematic diagram of the structure of an artificial intelligence-driven adaptive firewall rule optimization system according to an embodiment of the present invention. DETAILED DESCRIPTION

[0056] To make the objectives, technical solutions, and advantages of the embodiments of the present invention more clear, the technical solutions in the embodiments of the present invention will be clearly and completely described below in conjunction with the accompanying drawings in the embodiments of the present invention. Obviously, the described embodiments are only part of the embodiments of the present invention, not all of the embodiments. Based on the embodiments of the present invention, all other embodiments obtained by ordinary technicians in this field without making creative efforts shall fall within the scope of protection of the present invention.

[0057] The following specific embodiments are used to describe the technical solution of the present invention in detail. The following specific embodiments can be combined with each other, and the same or similar concepts or processes may not be described in detail in some embodiments.

[0058] Figure 1 This is a flow chart of the artificial intelligence-driven adaptive firewall rule optimization method according to an embodiment of the present invention. Figure 1 As shown, the method includes:

[0059] S11. Collect network traffic data, system log data, and security event data from the firewall system, perform deep packet inspection on the network traffic data to extract network protocol features, packet size features, and packet time interval features; perform natural language processing on the system log data to extract system operation features, user behavior features, and resource access features; perform correlation analysis on the security event data to extract attack pattern features, threat level features, and attack source features, and construct all extracted features into a multidimensional feature vector;

[0060] S12. Construct a deep neural network model based on the multidimensional feature vector, the deep neural network model comprising a feature encoding layer, a time series analysis layer, and a rule prediction layer; the feature encoding layer uses an autoencoder to perform dimensionality reduction processing on the multidimensional feature vector; the time series analysis layer uses a long short-term memory network to perform time series correlation analysis on the feature data after dimensionality reduction; the rule prediction layer uses a reinforcement learning algorithm to generate a firewall rule policy set based on the time series analysis results, each rule policy comprising a source address filtering rule, a destination address filtering rule, a protocol type filtering rule, a port filtering rule, and a packet content filtering rule;

[0061] S13. Perform parallel verification tests on the rule strategy set, record the false alarm rate, missed alarm rate and rule execution efficiency of each rule strategy, and construct a rule evaluation index matrix; based on the rule evaluation index matrix, use a genetic algorithm to optimize the rule strategy, generate new rule combinations through crossover and mutation operations, and iteratively optimize the rule strategy set; dynamically adjust the weight parameters of the deep neural network model according to real-time changes in the network environment, and send the optimized rule strategy to the firewall system in real time to achieve adaptive optimization of firewall rules.

[0062] In an optional embodiment, collecting network traffic data, system log data, and security event data from a firewall system, performing deep packet inspection on the network traffic data, and extracting network protocol features, data packet size features, and data packet time interval features include:

[0063] The data collection module deployed in the firewall system collects network traffic data, system log data, and security event data, wherein the network traffic data is collected by a network probe with a double buffer mechanism, and the network probe uses zero-copy technology to directly transfer data packets from the network card buffer to the user space. The system log data is collected by a log collection agent program, and the security event data is collected by a security event monitoring module. The collected network traffic data, system log data, and security event data are stored in a data buffer pool.

[0064] Reading network traffic data from the data buffer pool, performing deep packet inspection on the network traffic data, first reassembling discrete data packets using a sliding window algorithm to obtain a complete data stream, then performing seven-layer protocol parsing on the complete data stream based on a state machine and feature matching mechanism to obtain a protocol parsing result, then performing session reconstruction on the protocol parsing result using a bidirectional state tracking technology to obtain a session data stream, and transmitting the session data stream to a feature extraction module;

[0065] Based on a preset protocol field dependency graph, protocol features are extracted from the session data stream to obtain a protocol feature set including a protocol type identifier, a protocol version number, and a protocol option field. Adaptive binning calculation and multi-dimensional statistical analysis are performed on the session data stream to obtain a data packet size feature set including data packet size distribution, data packet size mean, and data packet size variance. Timing analysis is performed on the session data stream using a multi-scale sliding time window to obtain a time interval feature set including arrival time series, periodic patterns, and burst traffic characteristics.

[0066] Collecting network traffic, system logs, and security event data from the firewall system, and performing deep packet inspection on network traffic to extract multi-dimensional features, helps improve network security situational awareness capabilities. The following describes its implementation in detail:

[0067] First, deploy the data collection module. This module consists of three submodules: a network probe for collecting network traffic data, a log collection agent for collecting system log data, and a security event monitoring module for collecting security event data. The network probe uses a dual-buffer mechanism and zero-copy technology to transfer data packets directly from the network card buffer to user space, reducing the number of data copies and improving collection efficiency. For example, when the first buffer is full, the network probe automatically switches to the second buffer for data collection while simultaneously transferring the data in the first buffer to the data buffer pool to prevent data loss. The log collection agent reads log files generated by the firewall system in real time, such as login logs and policy configuration logs, and sends the log data to the data buffer pool. The security event monitoring module is responsible for monitoring security events generated by the firewall system, such as intrusion detection alerts and virus interception events, and sends this event information to the data buffer pool. The data buffer pool is used to temporarily store the three types of collected data for subsequent processing.

[0068] Next, network traffic data is read from the data buffer pool for deep packet inspection. First, a sliding window algorithm is used to reassemble discrete data packets. For example, the window size is set to 1000 bytes. When the total size of the received data packets reaches or exceeds the window size, these data packets are combined into a complete data stream. Then, the complete data stream is parsed through the seven-layer protocol based on the state machine and feature matching mechanism. For example, the application layer protocol to which the data stream belongs, such as HTTP, HTTPS, FTP, etc., is determined based on the port number, protocol identifier, and other information in the data packet, and the values of each protocol field are parsed. Next, the bidirectional state tracking technology is used to reconstruct the session based on the protocol parsing results. For example, by tracking the establishment and disconnection process of the TCP connection, multiple data streams belonging to the same session are combined to form a complete session data stream. Finally, the session data stream is transmitted to the feature extraction module.

[0069] In the feature extraction module, protocol features are first extracted based on a preset protocol field dependency graph. For example, for the HTTP protocol, the protocol field dependency graph defines the dependencies between fields such as the request method, URL, and User-Agent. Based on this dependency graph, the complete HTTP request information, such as "GET / index.html HTTP / 1.1," can be extracted. This yields a protocol feature set that includes the protocol type identifier (e.g., HTTP), the protocol version number (e.g., 1.1), and the protocol option fields (e.g., User-Agent). Next, adaptive binning and multi-dimensional statistical analysis are performed on the session data stream to obtain a packet size feature set. For example, packet sizes are divided into multiple intervals, the number of packets within each interval is counted, and statistics such as the mean and variance of the packet sizes are calculated. For example, the packet size distribution within a session might be: 50 packets in the 0-100 byte range, 100 packets in the 100-200 byte range, and so on. Finally, time series analysis of the session data stream is performed using a multi-scale sliding time window to obtain a time interval feature set. For example, using time windows of varying sizes to collect data on packet arrival times, we can analyze the periodicity and burst characteristics of packet arrivals. For example, within a 1-second window, we might observe periodic changes in packet arrival times, while within a 1-minute window, we might detect bursts.

[0070] The beneficial effects of this program are reflected in three aspects:

[0071] 1. Improved data collection efficiency. The use of a double buffer mechanism and zero-copy technology reduces the number of data copies, increases data collection speed, and can better cope with high-traffic environments.

[0072] 2. Implemented deep packet inspection and multi-dimensional feature extraction. Through seven-layer protocol parsing, session reconstruction, protocol feature extraction, packet size feature extraction, and time interval feature extraction, it achieves in-depth analysis of network traffic, enabling a more comprehensive portrayal of network behavior.

[0073] 3. Enhanced network security situational awareness. The extracted multi-dimensional features can be used for security analysis tasks such as anomaly detection and intrusion identification, improving the ability to detect and respond to network security threats.

[0074] In an optional embodiment, natural language processing is performed on the system log data to extract system operation features, user behavior features, and resource access features; correlation analysis is performed on the security event data to extract attack pattern features, threat level features, and attack source features, and all the extracted features are constructed into a multidimensional feature vector, including:

[0075] A distributed log collection architecture is used to collect system log data and security event data in the firewall system, and the system log data and security event data are converted into standard format data through the log formatting module and stored in the data processing module;

[0076] Performing natural language processing on the system log data in the data processing module, segmenting the system log data using a word segmenter to obtain a segmentation sequence, performing part-of-speech tagging on the segmentation sequence based on a security domain dictionary to obtain a tag sequence, performing syntactic analysis on the tag sequence using a dependency syntax analyzer to obtain a syntax tree, extracting system operation features from the syntax tree, wherein the system operation features include an operation subject, an operation type, and an operation object; constructing a user behavior sequence based on the system operation features, extracting user behavior features from the user behavior sequence, wherein the user behavior features include an operation time feature, an operation frequency feature, and an operation preference feature; constructing a resource access graph based on the user behavior features, extracting resource access features from the resource access graph, wherein the resource access features include an access permission feature, an access scope feature, and an access frequency feature;

[0077] Performing correlation analysis on the security event data in the data processing module, clustering the security event data using a spatiotemporal correlation algorithm to obtain an event chain, analyzing the event chain based on a causal reasoning method to construct an attack scenario graph, extracting attack pattern features from the attack scenario graph, the attack pattern features including attack step features, attack technology features, and attack tool features; constructing a threat scoring model based on asset importance, vulnerability severity, and attack impact scope, and extracting threat level features from the threat scoring model using a fuzzy comprehensive evaluation method, the threat level features including threat level features, threat trend features, and threat impact features; extracting attack source features by analyzing the attack source IP reputation, geographic location, and behavioral patterns, the attack source features including geographic features, organizational features, and tactical features;

[0078] The system operation features, user behavior features, resource access features, attack mode features, threat level features, and attack source features are subjected to feature vectorization processing, including: one-hot encoding discrete features to obtain discrete feature vectors, normalizing continuous features to obtain continuous feature vectors, merging the discrete feature vectors and continuous feature vectors to construct an original feature vector, using a principal component analysis method to reduce the dimension of the original feature vector to obtain a reduced dimension feature vector, calculating the importance of each feature in the reduced dimension feature vector through information gain to obtain a feature importance index, and selecting features whose feature importance index exceeds a preset threshold to construct a multidimensional feature vector.

[0079] A distributed log collection architecture collects system log data and security event data from the firewall system. Multiple log collection agents are deployed, each responsible for collecting logs from different firewall nodes and transmitting the collected raw log data to a central log server in real time. For example, Fluentd can be used as a log collection agent, configured to monitor changes to firewall log files and transmit new logs to a Kafka message queue via TCP / IP. Security event data can be sent directly to the Kafka message queue via the syslog protocol.

[0080] The log formatting module converts system log data and security event data into a standard format. It reads raw log data and security event data from the Kafka message queue, extracts key fields using methods such as regular expressions, and converts them into a unified JSON format.

[0081] The data processing module processes the standard format data and stores the log data in JSON format in the Elasticsearch database for subsequent analysis and query.

[0082] Perform natural language processing on system log data. Use the jieba word segmenter to segment the system log data. For example, segment "user login successfully" into "user", "login", and "success". Then, perform part-of-speech tagging on the word segmentation sequence based on the security domain dictionary (including words such as "login", "access", and "reject" and their parts of speech). For example, "user / n login / v success / a" is used as the tag sequence. Use the HanLP dependency parser to perform syntactic analysis on the tag sequence to obtain a syntactic tree. For example, a syntactic tree structure with "login" as the root node, "user" as the subject, and "success" as the complement is obtained. Extract system operation features from the syntactic tree. For example, extract the operation subject as "user", the operation type as "login", and the operation object as empty.

[0083] Construct a user behavior sequence based on system operation characteristics. Arrange the system operation characteristics of the same user in chronological order. For example, user A's behavior sequence is "login, access file A, access file B, log out." Extract user behavior characteristics from the user behavior sequence. For example, extract user A's operation time characteristic of weekday daytime, operation frequency characteristic of medium, and operation preference characteristic of accessing files.

[0084] Build a resource access graph based on user behavior characteristics. Consider users and resources as nodes and user access behaviors as edges to construct the resource access graph. For example, if user A accesses files A and B, connections are established between user A and both files A and B. Extract resource access features from the resource access graph. For example, extract the access permission feature for file A as limited to user A, the access scope feature as internal network, and the access frequency feature as high.

[0085] Perform correlation analysis on security event data. Use a spatiotemporal correlation algorithm to cluster security event data, grouping security events that are close in time and location together to form an event chain. For example, multiple failed login attempts initiated by the same source IP within a short period of time are aggregated into an event chain. Analyze event chains based on causal reasoning methods and construct an attack scenario graph. For example, based on the sequence of events and dependencies in the event chain, construct an attack scenario graph, indicating that after an attacker attempts to log in with a weak password and fails, they attempt to log in with a brute force cracking tool. Extract attack pattern features from the attack scenario graph. For example, extract attack step features as weak password login attempts and brute force cracking, attack technology features as password guessing and brute force cracking, and attack tool features as hydra.

[0086] A threat scoring model is constructed by combining asset importance, vulnerability severity, and attack impact. For example, if a server's asset importance is high, the remote code execution vulnerability's severity is high, and the attack impact is the entire network, the attack incident will have a high threat score. A fuzzy comprehensive evaluation method is used to extract threat level features from the threat scoring model. For example, the threat level feature is high, the threat trend feature is rising, and the threat impact feature is business interruption.

[0087] Attack source features are extracted by analyzing the attack source IP's reputation, geographic location, and behavioral patterns. For example, if the attack source IP is marked as malicious, located in a specific country, and exhibits continuous port scanning, the extracted attack source features are: the geographic feature is that country, the organizational feature is a suspected hacker group, and the tactical feature is reconnaissance.

[0088] Vectorize the extracted features. One-hot encode discrete features. For example, encode the operation types "login," "access," and "logout" as [1, 0, 0], [0, 1, 0], and [0, 0, 1]. Normalize continuous features. For example, normalize access frequency to a value between 0 and 1. Merge the discrete and continuous feature vectors to construct the original feature vector. Use principal component analysis to reduce the dimensionality of the original feature vector. Calculate the importance of each feature in the reduced feature vector using information gain. Select features whose feature importance exceeds a preset threshold to construct a multidimensional feature vector.

[0089] Beneficial effects:

[0090] 1. Improve the accuracy and efficiency of threat detection: Through multi-dimensional feature vectors, the network security situation can be more comprehensively portrayed, thereby improving the accuracy and efficiency of threat detection and reducing false positives and missed negatives.

[0091] 2. Enhance the response speed of security incidents: By performing correlation analysis on security incidents and constructing attack scenario graphs, attack patterns and sources can be identified more quickly, thereby speeding up the response to security incidents and reducing losses.

[0092] 3. Improve proactive security protection: By analyzing user behavior and resource access, potential security risks can be identified and corresponding protective measures can be taken, thereby improving the proactive nature of security protection and preventing problems before they occur.

[0093] In an optional embodiment, a deep neural network model is constructed based on the multidimensional feature vector, and the deep neural network model includes a feature encoding layer, a time series analysis layer, and a rule prediction layer; the feature encoding layer uses an autoencoder to reduce the dimension of the multidimensional feature vector; the time series analysis layer uses a long short-term memory network to perform time series correlation analysis on the feature data after dimensionality reduction; the rule prediction layer generates a firewall rule policy set based on the time series analysis results based on a reinforcement learning algorithm, and each rule policy includes a source address filtering rule, a destination address filtering rule, a protocol type filtering rule, a port filtering rule, and a data packet content filtering rule, including:

[0094] Constructing a deep neural network model based on the multidimensional feature vector, the deep neural network model comprising a feature encoding layer, a time series analysis layer, and a rule prediction layer, and inputting the multidimensional feature vector into the deep neural network model;

[0095] The feature coding layer uses an autoencoder to perform dimensionality reduction processing on the multidimensional feature vector, the autoencoder includes an encoder and a decoder, the encoder is provided with three hidden layers, the number of neurons in the three hidden layers is 1024, 512, and 256, respectively, each hidden layer is provided with a dropout layer to prevent overfitting, the dropout rate of the dropout layer is 0.3, and Gaussian noise is added to the input layer of the autoencoder to improve the robustness of the model, and the key information of the multidimensional feature vector is extracted by minimizing the reconstruction error to obtain the feature data after dimensionality reduction;

[0096] The time series analysis layer uses a long short-term memory network to perform time series correlation analysis on the feature data after dimensionality reduction. The long short-term memory network includes two layers of bidirectional long short-term memory structures. Each layer of bidirectional long short-term memory structure contains 128 memory units. The memory units include a forget gate, an input gate, and an output gate. The forget gate is used to control the degree of forgetting of historical information. The input gate is used to determine the degree of retention of current input information. The output gate is used to manage the output of information. The attention weights of different time steps are calculated based on the hidden state at the current moment to obtain the time series analysis results;

[0097] The rule prediction layer is based on a reinforcement learning algorithm and generates a firewall rule policy set according to the timing analysis results. The reinforcement learning algorithm adopts a dual network architecture, including a policy network and a value network. The policy network adopts an Actor-Critic framework to generate rule policies. The Actor network in the Actor-Critic framework outputs the probability distribution of the rule field, and the Critic network in the Actor-Critic framework estimates the value of the rule. An experience replay pool is set to store interaction data for training. The online network of the policy network and the value network regularly synchronizes parameters with the target network. Each rule policy in the firewall rule policy set includes source address filtering rules, destination address filtering rules, protocol type filtering rules, port filtering rules, and data packet content filtering rules.

[0098] In order to realize intelligent firewall rule generation, a firewall rule generation method based on deep neural network is proposed. This method uses multi-dimensional feature vectors to construct a deep neural network model, which includes a feature encoding layer, a time series analysis layer, and a rule prediction layer.

[0099] First, the collected network traffic data is preprocessed to extract multi-dimensional feature vectors. These features can include source IP address, destination IP address, port number, protocol type, packet size, connection duration, etc.

[0100] Next, the multidimensional feature vector is input into the feature encoding layer of the deep neural network model. This layer uses an autoencoder to reduce the dimensionality of the multidimensional feature vector. The autoencoder consists of an encoder and a decoder. The encoder contains three hidden layers, with 1024, 512, and 256 neurons, respectively. Each hidden layer is followed by a dropout layer with a dropout rate of 0.3 to prevent overfitting. To improve the robustness of the model, Gaussian noise is added to the input layer of the autoencoder. By minimizing the reconstruction error between the input feature vector and the decoder output, the autoencoder can extract key information from the multidimensional feature vector and obtain reduced-dimensionality feature data.

[0101] The reduced feature data is then input into the time series analysis layer. This layer uses a long short-term memory (LSTM) network to perform temporal correlation analysis on the reduced feature data. This LSTM network consists of two layers of bidirectional LSTM architecture, each containing 128 memory cells. Each memory cell includes a forget gate, an input gate, and an output gate. The forget gate controls the degree of forgetting of historical information, the input gate determines the degree of retention of current input information, and the output gate manages information output. The LSTM network can analyze the temporal variation of feature data. For example, if feature data from multiple consecutive time steps consistently shows an unusually high access frequency for a particular IP address, the LSTM network can capture this temporal correlation. The time series analysis results are obtained by calculating the attention weights for different time steps based on the current hidden state.

[0102] Finally, the timing analysis results are input into the rule prediction layer. The rule prediction layer generates a set of firewall rule policies based on a reinforcement learning algorithm. The reinforcement learning algorithm employs a dual network architecture, consisting of a policy network and a value network. The policy network uses an actor-critic framework to generate rule policies. The actor network outputs a probability distribution of rule fields, and the critic network estimates the value of the rules. The experience replay pool stores interaction data for training. The online network of the policy network and the value network periodically synchronizes parameters with the target network. Each rule policy in the generated firewall rule policy set includes source address filtering rules, destination address filtering rules, protocol type filtering rules, port filtering rules, and packet content filtering rules. For example, if, based on the timing analysis results, a source IP address is found to continuously access a specific destination port, the rule prediction layer may generate a rule to block that source IP address from accessing that destination port.

[0103] The beneficial effects of this method can be summarized in the following three aspects:

[0104] 1. Improve the accuracy of firewall rules: By analyzing multi-dimensional feature vectors through deep neural network models, network attack behaviors can be more accurately identified, thereby generating more effective firewall rules.

[0105] 2. Enhance the adaptability of firewall rules: Reinforcement learning algorithms can dynamically adjust rule strategies according to changes in the network environment, improving the adaptability of firewall rules.

[0106] 3. Reduce the configuration burden on administrators: Automated rule generation methods can reduce the burden on administrators to manually configure firewall rules and improve network security management efficiency.

[0107] In an optional embodiment, the rule prediction layer generates a firewall rule policy set based on the time series analysis results based on a reinforcement learning algorithm. The reinforcement learning algorithm adopts a dual network architecture, including a policy network and a value network. The policy network uses an actor-critic framework to generate rule policies. The actor network in the actor-critic framework outputs a probability distribution of rule fields, and the critic network in the actor-critic framework estimates the value of the rules. An experience replay pool is set to store interaction data for training. The online network of the policy network and the value network periodically synchronizes parameters with the target network, including:

[0108] Receive the timing analysis results output by the timing analysis layer, input the timing analysis results into the rule prediction layer, and the rule prediction layer generates a firewall rule policy set based on the reinforcement learning algorithm;

[0109] Constructing a dual network architecture of the reinforcement learning algorithm, wherein the dual network architecture includes a policy network and a value network, wherein the policy network uses an actor-critic framework to generate rule strategies;

[0110] The timing analysis results are input into the Actor network in the Actor-Critic framework. After being processed by a three-layer fully connected network, the Actor network outputs the probability distribution of the rule field. The Softmax function is used to output the value probability of discrete fields such as source address, destination address, and port number, and the normal distribution function is used to output the mean parameter and variance parameter of continuous fields such as threshold and timeout.

[0111] Inputting the timing analysis results into the Critic network in the Actor-Critic framework, the Critic network estimates the value of the rule through a two-layer fully connected network, and provides a benchmark parameter for the strategy update of the Actor network;

[0112] Constructing a fixed-capacity experience replay pool to store interaction data, including the current state, executed actions, rewards, and next state, and randomly sampling training data from the experience replay pool;

[0113] The loss function of the critic network is constructed based on the mean square error of the temporal difference error, the policy gradient method is used to update the parameters of the actor network, and the online network parameters of the policy network and the value network are regularly synchronized to the target network according to the preset soft update coefficient.

[0114] A firewall rule generation method based on reinforcement learning is proposed. Its core idea is to use the reinforcement learning algorithm to dynamically generate a firewall rule policy set according to the time series analysis results of network traffic.

[0115] First, we perform a time series analysis of network traffic to extract key features, such as source address, destination address, port number, access frequency, and packet size. For example, analyzing the network traffic over the past hour revealed that the source address 192.168.1.100 frequently accessed port 80 of the destination address 10.0.0.1, and the packet sizes were abnormally large.

[0116] These time series analysis results are then fed into the rule prediction layer, which is built on a reinforcement learning algorithm. The reinforcement learning algorithm uses a dual network architecture, consisting of a policy network and a value network.

[0117] The policy network uses the actor-critic framework to generate rule policies. The actor network in the actor-critic framework receives timing analysis results as input. The actor network consists of a three-layer fully connected network. After processing by the three-layer fully connected network, the actor network outputs the probability distribution of the rule field. For discrete fields such as source address, destination address, and port number, the actor network uses the softmax function to output the probability of each possible value. For example, the possible source address values are 192.168.1.100, 192.168.1.101, and so on. The actor network outputs the probability of each source address. For continuous fields such as thresholds and timeouts, the actor network uses the normal distribution function to output the mean and variance. For example, for the timeout, the actor network outputs a normal distribution with a mean of 60 seconds and a variance of 5 seconds.

[0118] The critic network in the actor-critic framework also receives timing analysis results as input. The critic network consists of two fully connected layers. The critic network estimates the value of the current rule, providing a baseline parameter for updating the actor network's policies. For example, the critic network estimates the value of the current rule, "Block source address 192.168.1.100 from accessing port 80 of destination address 10.0.0.1," as 0.8, indicating high rule effectiveness.

[0119] To train the reinforcement learning model, a fixed-capacity experience replay pool is constructed to store interaction data. Interaction data includes the current state (time series analysis results), executed actions (generated rules), rewards (rule effectiveness evaluation results), and the next state (new time series analysis results). For example, "Current state: Source address 192.168.1.100 frequently accesses port 80 of target address 10.0.0.1; Action: Block source address 192.168.1.100 from accessing port 80 of target address 10.0.0.1; Reward: 0.9; Next state: Source address 192.168.1.100 stops accessing port 80 of target address 10.0.0.1" is stored in the experience replay pool.

[0120] Training data is randomly sampled from the experience replay pool and used to update the parameters of the policy and value networks. The critic network's loss function is constructed based on the mean squared error of the temporal difference (TD) error. The actor network's parameters are updated using a policy gradient method. To stabilize the training process, the online network parameters of the policy and value networks are periodically synchronized with the target network using a preset soft update coefficient. For example, every 100 steps, the online network parameters are updated to the target network by a coefficient of 0.1.

[0121] The beneficial effects of this method are reflected in the following three aspects:

[0122] 1. Strong adaptability: It can dynamically adjust firewall rules according to changes in network traffic without manual intervention, effectively responding to new network attacks.

[0123] 2. High accuracy: Utilizes reinforcement learning algorithms to learn the patterns of network traffic, generate more accurate firewall rules, and reduce false positives and missed reports.

[0124] 3. High efficiency: Automatically generate firewall rules, save labor costs and improve security protection efficiency.

[0125] In an optional embodiment, the rule strategy set is subjected to parallel verification testing, the false alarm rate, missed alarm rate, and rule execution efficiency of each rule strategy are recorded, and a rule evaluation index matrix is constructed; based on the rule evaluation index matrix, a genetic algorithm is used to optimize the rule strategy, and new rule combinations are generated through crossover and mutation operations. Iteratively optimizing the rule strategy set includes:

[0126] Conduct parallel validation tests on the rule strategy set, record the false alarm rate, missed alarm rate, and rule execution efficiency of each rule strategy, and construct a rule evaluation index matrix. The rule evaluation index matrix includes rule strategy index matrix values and rule strategy index weight values, and the rule strategy index weight values are calculated using the hierarchical analysis method.

[0127] Normalizing the rule evaluation indicator matrix, calculating the rule strategy indicator matrix value using the Min-Max normalization method, and performing weighted summation on the normalized rule strategy indicator matrix values based on the rule strategy indicator weight values to obtain a comprehensive score for each rule strategy;

[0128] Based on the rule evaluation index matrix, a genetic algorithm is used to optimize the rule strategy, and the rule strategy is encoded into a chromosome sequence, wherein the chromosome sequence includes a source address field, a target address field, a protocol type field, a port number field, and a content feature field, and the chromosome sequence is encoded in a binary encoding manner;

[0129] A fitness function is designed based on the comprehensive score of the rule strategy, and a tournament selection strategy is used to select the individuals with the highest fitness from the population to enter the next generation. A new rule combination is generated through a two-point crossover operation, where the intersection of the two-point crossover operation is aligned with the rule field boundary. A mutation operator based on rule grammar constraints is used to perform a mutation operation, mutating the address field within the legal IP address range, the port field within the commonly used port list, and the protocol field within the predefined protocol type.

[0130] The rule strategy set is iteratively optimized. In each round of iteration, the individual with the highest fitness in the population is directly copied to the next generation through the elite retention strategy. When the change in the optimal fitness of the population for multiple consecutive generations is less than a preset threshold, the iteration is terminated and the individual with the highest fitness is selected to update the rule strategy set.

[0131] The rule policy optimization method is used to optimize the rule policy set in the fields of network security, content filtering, etc., and improve the efficiency and accuracy of rule matching.

[0132] First, conduct parallel validation testing on the rule policy set. Prepare a test dataset containing a variety of network traffic data, including both normal and malicious traffic samples. For example, this dataset may contain 10,000 normal access records and 2,000 malicious attack records. Apply each rule in the rule policy set to the test dataset and record each rule's false positive rate, false negative rate, and execution efficiency. The false positive rate refers to the proportion of normal traffic identified as malicious. For example, if a rule falsely identifies 100 normal traffic instances as malicious, the false positive rate is 100 / 10,000 = 1%. The false negative rate refers to the proportion of malicious traffic identified as normal. For example, if a rule falsely identifies 200 malicious traffic instances as normal, the false negative rate is 200 / 2,000 = 10%. Execution efficiency refers to the average time required for each rule to process a piece of traffic data. For example, a rule may take 0.1 milliseconds to process a piece of traffic data. Record these metrics in the rule evaluation metric matrix.

[0133] Next, a rule evaluation indicator matrix is constructed. This matrix contains the rule strategy indicator matrix values and the rule strategy indicator weights. The rule strategy indicator matrix values represent the false alarm rate, false negative rate, and execution efficiency of each rule recorded in the previous step. The rule strategy indicator weights are calculated using the Analytic Hierarchy Process (AHP). For example, expert scoring determines the relative importance of false alarm rate, false negative rate, and execution efficiency. Ultimately, a weight of 0.5 for false alarm rate, 0.3 for false negative rate, and 0.2 for execution efficiency was determined.

[0134] Next, the rule evaluation indicator matrix is normalized. The Min-Max normalization method is used to calculate the rule strategy indicator matrix values. Then, based on the rule strategy indicator weights, the normalized rule strategy indicator matrix values are weighted and summed to obtain the comprehensive score for each rule.

[0135] Subsequently, a genetic algorithm is used to optimize the rule strategy. The rule strategy is encoded as a chromosome sequence. The chromosome sequence includes a source address field, a destination address field, a protocol type field, a port number field, and a content feature field. The chromosome sequence is encoded using binary encoding. For example, the source address field is encoded as a 32-bit binary number, the destination address field is also encoded as a 32-bit binary number, the protocol type field is encoded as an 8-bit binary number, the port number field is encoded as a 16-bit binary number, and the content feature field is encoded as a variable-length binary number.

[0136] A fitness function is designed based on the comprehensive score of the rule strategy. A higher fitness function value indicates better performance. For example, the comprehensive score of a rule can be used directly as its fitness function value. A tournament selection strategy is used to select the individuals with the highest fitness from the population to advance to the next generation. For example, five individuals are randomly selected each time, and the individual with the highest fitness is selected to advance to the next generation.

[0137] Generate new rule combinations through a two-point crossover operation. The intersection of a two-point crossover operation aligns with the rule field boundary. For example, select two rules as parents and crossover between the source address field and the port number field to generate two new rules. Mutation operations are performed using mutation operators based on rule syntax constraints. Address fields are mutated within the legal IP address range, port fields are mutated within the list of commonly used ports, and protocol fields are mutated within predefined protocol types. For example, the source address of a rule can be mutated from 192.168.1.1 to 192.168.1.2.

[0138] Iteratively optimize the rule strategy set. In each iteration, the individuals with the highest fitness in the population are directly copied to the next generation using an elite retention strategy. For example, the top 10% of individuals are directly copied to the next generation. The iteration is terminated when the change in the optimal fitness of the population over multiple generations is less than a preset threshold. For example, the change in the optimal fitness of the population over five consecutive generations is less than 0.01. The individual with the highest fitness is selected to update the rule strategy set.

[0139] Beneficial effects:

[0140] 1. Improve rule matching efficiency: Genetic algorithms are used to optimize rule strategies, remove redundant rules, and simplify rule sets, thereby improving rule matching efficiency and reducing traffic processing time.

[0141] 2. Reduce false positive and missed negative rates: By optimizing rule strategies and adjusting rule matching conditions, you can effectively reduce false positive and missed negative rates and improve the accuracy of rules.

[0142] 3. Automated rule optimization: This method uses genetic algorithms to automatically optimize rules without manual intervention, saving labor costs and being able to adapt to the ever-changing network environment.

[0143] Figure 2 This is a schematic diagram of the structure of the artificial intelligence-driven adaptive firewall rule optimization system according to an embodiment of the present invention. Figure 2 As shown, the system includes:

[0144] The first unit is configured to collect network traffic data, system log data, and security event data from the firewall system, perform deep packet inspection on the network traffic data to extract network protocol features, data packet size features, and data packet time interval features; perform natural language processing on the system log data to extract system operation features, user behavior features, and resource access features; perform correlation analysis on the security event data to extract attack pattern features, threat level features, and attack source features, and construct all the extracted features into a multidimensional feature vector;

[0145] The second unit is used to construct a deep neural network model based on the multidimensional feature vector, and the deep neural network model includes a feature encoding layer, a time series analysis layer, and a rule prediction layer; the feature encoding layer uses an autoencoder to reduce the dimension of the multidimensional feature vector; the time series analysis layer uses a long short-term memory network to perform time series correlation analysis on the feature data after dimensionality reduction; the rule prediction layer generates a firewall rule policy set based on the time series analysis results based on a reinforcement learning algorithm, each rule policy includes a source address filtering rule, a destination address filtering rule, a protocol type filtering rule, a port filtering rule, and a data packet content filtering rule;

[0146] The third unit is used to perform parallel verification tests on the rule strategy set, record the false alarm rate, missed alarm rate and rule execution efficiency of each rule strategy, and construct a rule evaluation index matrix; based on the rule evaluation index matrix, a genetic algorithm is used to optimize the rule strategy, and new rule combinations are generated through crossover and mutation operations, and the rule strategy set is iteratively optimized; according to real-time changes in the network environment, the weight parameters of the deep neural network model are dynamically adjusted, and the optimized rule strategy is sent to the firewall system in real time to achieve adaptive optimization of firewall rules.

[0147] According to a third aspect of the embodiments of the present invention,

[0148] An electronic device is provided, comprising:

[0149] processor;

[0150] a memory for storing processor-executable instructions;

[0151] The processor is configured to call the instructions stored in the memory to execute the aforementioned method.

[0152] According to a fourth aspect of the embodiments of the present invention,

[0153] A computer-readable storage medium is provided, on which computer program instructions are stored. When the computer program instructions are executed by a processor, the method described above is implemented.

[0154] The present invention may be a method, an apparatus, a system and / or a computer program product. The computer program product may include a computer-readable storage medium carrying computer-readable program instructions for executing various aspects of the present invention.

[0155] Finally, it should be noted that the above embodiments are only used to illustrate the technical solutions of the present invention, rather than to limit it. Although the present invention has been described in detail with reference to the above embodiments, those skilled in the art should understand that they can still modify the technical solutions described in the above embodiments, or replace some or all of the technical features therein with equivalents. However, these modifications or replacements do not cause the essence of the corresponding technical solutions to deviate from the scope of the technical solutions of the embodiments of the present invention.

Claims

1. An artificial intelligence-driven adaptive firewall rule optimization method, characterized in that: include: Collect network traffic data, system log data, and security event data from the firewall system, perform deep packet inspection on the network traffic data, and extract network protocol features, data packet size features, and data packet time interval features; Performing natural language processing on the system log data to extract system operation characteristics, user behavior characteristics, and resource access characteristics; Performing correlation analysis on the security event data, extracting attack pattern features, threat level features, and attack source features, and constructing all the extracted features into a multidimensional feature vector; A deep neural network model is constructed based on the multidimensional feature vector, and the deep neural network model includes a feature encoding layer, a time series analysis layer, and a rule prediction layer; the feature encoding layer uses an autoencoder to reduce the dimension of the multidimensional feature vector; the time series analysis layer uses a long short-term memory network to perform time series correlation analysis on the feature data after dimensionality reduction; the rule prediction layer generates a firewall rule policy set based on the time series analysis results based on a reinforcement learning algorithm, each rule policy includes a source address filtering rule, a destination address filtering rule, a protocol type filtering rule, a port filtering rule, and a data packet content filtering rule; The rule strategy set is verified and tested in parallel, and the false alarm rate, missed alarm rate and rule execution efficiency of each rule strategy are recorded to construct a rule evaluation index matrix. Based on the rule evaluation index matrix, a genetic algorithm is used to optimize the rule strategy, and new rule combinations are generated through crossover and mutation operations to iteratively optimize the rule strategy set. According to real-time changes in the network environment, the weight parameters of the deep neural network model are dynamically adjusted, and the optimized rule strategy is sent to the firewall system in real time to achieve adaptive optimization of firewall rules.

2. The method according to claim 1, characterized in that Collect network traffic data, system log data, and security event data from the firewall system, perform deep packet inspection on the network traffic data, and extract network protocol features, data packet size features, and data packet time interval features, including: The data collection module deployed in the firewall system collects network traffic data, system log data, and security event data, wherein the network traffic data is collected by a network probe with a double buffer mechanism, and the network probe uses zero-copy technology to directly transfer data packets from the network card buffer to the user space. The system log data is collected by a log collection agent program, and the security event data is collected by a security event monitoring module. The collected network traffic data, system log data, and security event data are stored in a data buffer pool. Reading network traffic data from the data buffer pool, performing deep packet inspection on the network traffic data, first reassembling discrete data packets using a sliding window algorithm to obtain a complete data stream, then performing seven-layer protocol parsing on the complete data stream based on a state machine and feature matching mechanism to obtain a protocol parsing result, then performing session reconstruction on the protocol parsing result using a bidirectional state tracking technology to obtain a session data stream, and transmitting the session data stream to a feature extraction module; Based on a preset protocol field dependency graph, protocol features are extracted from the session data stream to obtain a protocol feature set including a protocol type identifier, a protocol version number, and a protocol option field. Adaptive binning calculation and multi-dimensional statistical analysis are performed on the session data stream to obtain a data packet size feature set including data packet size distribution, data packet size mean, and data packet size variance. Timing analysis is performed on the session data stream using a multi-scale sliding time window to obtain a time interval feature set including arrival time series, periodic patterns, and burst traffic characteristics.

3. The method according to claim 1, characterized in that Performing natural language processing on the system log data to extract system operation characteristics, user behavior characteristics, and resource access characteristics; Performing correlation analysis on the security event data, extracting attack pattern features, threat level features, and attack source features, and constructing all the extracted features into a multidimensional feature vector includes: A distributed log collection architecture is used to collect system log data and security event data in the firewall system, and the system log data and security event data are converted into standard format data through the log formatting module and stored in the data processing module; Performing natural language processing on the system log data in the data processing module, segmenting the system log data using a word segmenter to obtain a segmentation sequence, performing part-of-speech tagging on the segmentation sequence based on a security domain dictionary to obtain a tag sequence, performing syntactic analysis on the tag sequence using a dependency syntax analyzer to obtain a syntax tree, extracting system operation features from the syntax tree, wherein the system operation features include an operation subject, an operation type, and an operation object; constructing a user behavior sequence based on the system operation features, extracting user behavior features from the user behavior sequence, wherein the user behavior features include an operation time feature, an operation frequency feature, and an operation preference feature; constructing a resource access graph based on the user behavior features, extracting resource access features from the resource access graph, wherein the resource access features include an access permission feature, an access scope feature, and an access frequency feature; Performing correlation analysis on the security event data in the data processing module, clustering the security event data using a spatiotemporal correlation algorithm to obtain an event chain, analyzing the event chain based on a causal reasoning method to construct an attack scenario graph, extracting attack pattern features from the attack scenario graph, the attack pattern features including attack step features, attack technology features, and attack tool features; constructing a threat scoring model based on asset importance, vulnerability severity, and attack impact scope, and extracting threat level features from the threat scoring model using a fuzzy comprehensive evaluation method, the threat level features including threat level features, threat trend features, and threat impact features; extracting attack source features by analyzing the attack source IP reputation, geographic location, and behavioral patterns, the attack source features including geographic features, organizational features, and tactical features; The system operation features, user behavior features, resource access features, attack mode features, threat level features, and attack source features are subjected to feature vectorization processing, including: one-hot encoding discrete features to obtain discrete feature vectors, normalizing continuous features to obtain continuous feature vectors, merging the discrete feature vectors and continuous feature vectors to construct an original feature vector, using a principal component analysis method to reduce the dimension of the original feature vector to obtain a reduced dimension feature vector, calculating the importance of each feature in the reduced dimension feature vector through information gain to obtain a feature importance index, and selecting features whose feature importance index exceeds a preset threshold to construct a multidimensional feature vector.

4. The method according to claim 1, wherein A deep neural network model is constructed based on the multidimensional feature vector, and the deep neural network model includes a feature encoding layer, a time series analysis layer, and a rule prediction layer; the feature encoding layer uses an autoencoder to reduce the dimension of the multidimensional feature vector; the time series analysis layer uses a long short-term memory network to perform time series correlation analysis on the feature data after dimension reduction; the rule prediction layer generates a firewall rule policy set based on the time series analysis results based on a reinforcement learning algorithm, and each rule policy includes a source address filtering rule, a destination address filtering rule, a protocol type filtering rule, a port filtering rule, and a data packet content filtering rule, including: Constructing a deep neural network model based on the multidimensional feature vector, the deep neural network model comprising a feature encoding layer, a time series analysis layer, and a rule prediction layer, and inputting the multidimensional feature vector into the deep neural network model; The feature coding layer uses an autoencoder to perform dimensionality reduction processing on the multidimensional feature vector, the autoencoder includes an encoder and a decoder, the encoder is provided with three hidden layers, the number of neurons in the three hidden layers is 1024, 512, and 256, respectively, each hidden layer is provided with a dropout layer to prevent overfitting, the dropout rate of the dropout layer is 0.3, and Gaussian noise is added to the input layer of the autoencoder to improve the robustness of the model, and the key information of the multidimensional feature vector is extracted by minimizing the reconstruction error to obtain the feature data after dimensionality reduction; The time series analysis layer uses a long short-term memory network to perform time series correlation analysis on the feature data after dimensionality reduction. The long short-term memory network includes two layers of bidirectional long short-term memory structures. Each layer of bidirectional long short-term memory structure contains 128 memory units. The memory units include a forget gate, an input gate, and an output gate. The forget gate is used to control the degree of forgetting of historical information. The input gate is used to determine the degree of retention of current input information. The output gate is used to manage the output of information. The attention weights of different time steps are calculated based on the hidden state at the current moment to obtain the time series analysis results; The rule prediction layer is based on a reinforcement learning algorithm and generates a firewall rule policy set according to the timing analysis results. The reinforcement learning algorithm adopts a dual network architecture, including a policy network and a value network. The policy network adopts an Actor-Critic framework to generate rule policies. The Actor network in the Actor-Critic framework outputs the probability distribution of the rule field, and the Critic network in the Actor-Critic framework estimates the value of the rule. An experience replay pool is set to store interaction data for training. The online network of the policy network and the value network regularly synchronizes parameters with the target network. Each rule policy in the firewall rule policy set includes source address filtering rules, destination address filtering rules, protocol type filtering rules, port filtering rules, and data packet content filtering rules.

5. The method according to claim 4, characterized in that The rule prediction layer generates a firewall rule policy set based on the time series analysis results based on a reinforcement learning algorithm. The reinforcement learning algorithm adopts a dual network architecture, including a policy network and a value network. The policy network uses an actor-critic framework to generate rule policies. The actor network in the actor-critic framework outputs the probability distribution of rule fields, and the critic network in the actor-critic framework estimates the value of the rules. An experience replay pool is set to store interaction data for training. The online network of the policy network and the value network regularly synchronizes parameters with the target network, including: Receive the timing analysis results output by the timing analysis layer, input the timing analysis results into the rule prediction layer, and the rule prediction layer generates a firewall rule policy set based on the reinforcement learning algorithm; Constructing a dual network architecture of the reinforcement learning algorithm, wherein the dual network architecture includes a policy network and a value network, wherein the policy network uses an actor-critic framework to generate rule strategies; The timing analysis results are input into the Actor network in the Actor-Critic framework. After being processed by a three-layer fully connected network, the Actor network outputs the probability distribution of the rule field. The Softmax function is used to output the value probability of discrete fields such as source address, destination address, and port number, and the normal distribution function is used to output the mean parameter and variance parameter of continuous fields such as threshold and timeout. Inputting the timing analysis results into the Critic network in the Actor-Critic framework, the Critic network estimates the value of the rule through a two-layer fully connected network, and provides a benchmark parameter for the strategy update of the Actor network; Constructing a fixed-capacity experience replay pool to store interaction data, including the current state, executed actions, rewards, and next state, and randomly sampling training data from the experience replay pool; The loss function of the critic network is constructed based on the mean square error of the temporal difference error, the policy gradient method is used to update the parameters of the actor network, and the online network parameters of the policy network and the value network are regularly synchronized to the target network according to the preset soft update coefficient.

6. The method according to claim 1, characterized in that Parallel verification testing is performed on the rule strategy set, and the false alarm rate, missed alarm rate, and rule execution efficiency of each rule strategy are recorded to construct a rule evaluation index matrix. Based on the rule evaluation index matrix, a genetic algorithm is used to optimize the rule strategy, and new rule combinations are generated through crossover and mutation operations. Iterative optimization of the rule strategy set includes: Conduct parallel validation tests on the rule strategy set, record the false alarm rate, missed alarm rate, and rule execution efficiency of each rule strategy, and construct a rule evaluation index matrix. The rule evaluation index matrix includes rule strategy index matrix values and rule strategy index weight values, and the rule strategy index weight values are calculated using the hierarchical analysis method. Normalizing the rule evaluation indicator matrix, calculating the rule strategy indicator matrix value using the Min-Max normalization method, and performing weighted summation on the normalized rule strategy indicator matrix values based on the rule strategy indicator weight values to obtain a comprehensive score for each rule strategy; Based on the rule evaluation index matrix, a genetic algorithm is used to optimize the rule strategy, and the rule strategy is encoded into a chromosome sequence, wherein the chromosome sequence includes a source address field, a target address field, a protocol type field, a port number field, and a content feature field, and the chromosome sequence is encoded in a binary encoding manner; A fitness function is designed based on the comprehensive score of the rule strategy, and a tournament selection strategy is used to select the individuals with the highest fitness from the population to enter the next generation. A new rule combination is generated through a two-point crossover operation, where the intersection of the two-point crossover operation is aligned with the rule field boundary. A mutation operator based on rule grammar constraints is used to perform a mutation operation, mutating the address field within the legal IP address range, the port field within the commonly used port list, and the protocol field within the predefined protocol type. The rule strategy set is iteratively optimized. In each round of iteration, the individual with the highest fitness in the population is directly copied to the next generation through the elite retention strategy. When the change in the optimal fitness of the population for multiple consecutive generations is less than a preset threshold, the iteration is terminated and the individual with the highest fitness is selected to update the rule strategy set.

7. An artificial intelligence-driven adaptive firewall rule optimization system, used to implement the method of any one of claims 1 to 6, characterized in that: include: The first unit is used to collect network traffic data, system log data and security event data in the firewall system, perform deep packet inspection on the network traffic data, and extract network protocol features, data packet size features, and data packet time interval features; Performing natural language processing on the system log data to extract system operation characteristics, user behavior characteristics, and resource access characteristics; Performing correlation analysis on the security event data, extracting attack pattern features, threat level features, and attack source features, and constructing all the extracted features into a multidimensional feature vector; The second unit is used to construct a deep neural network model based on the multidimensional feature vector, and the deep neural network model includes a feature encoding layer, a time series analysis layer, and a rule prediction layer; the feature encoding layer uses an autoencoder to reduce the dimension of the multidimensional feature vector; the time series analysis layer uses a long short-term memory network to perform time series correlation analysis on the feature data after dimensionality reduction; the rule prediction layer generates a firewall rule policy set based on the time series analysis results based on a reinforcement learning algorithm, each rule policy includes a source address filtering rule, a destination address filtering rule, a protocol type filtering rule, a port filtering rule, and a data packet content filtering rule; The third unit is used to perform parallel verification tests on the rule strategy set, record the false alarm rate, missed alarm rate and rule execution efficiency of each rule strategy, and construct a rule evaluation index matrix; based on the rule evaluation index matrix, a genetic algorithm is used to optimize the rule strategy, and new rule combinations are generated through crossover and mutation operations, and the rule strategy set is iteratively optimized; according to real-time changes in the network environment, the weight parameters of the deep neural network model are dynamically adjusted, and the optimized rule strategy is sent to the firewall system in real time to achieve adaptive optimization of firewall rules.

8. An electronic device, characterized in that: include: processor; a memory for storing processor-executable instructions; The processor is configured to call the instructions stored in the memory to execute the method according to any one of claims 1 to 6.

9. A computer-readable storage medium having computer program instructions stored thereon, characterized in that: When the computer program instructions are executed by a processor, the method according to any one of claims 1 to 6 is implemented.

Images