Operation management method and system for network security equipment and electronic equipment

Abstract

The invention relates to the technical field of network security, and discloses an operation management method and system for network security equipment and electronic equipment, and the method comprises the steps of equipment health degree evaluation, equipment resource scheduling and network security protection. The equipment health degree evaluation comprises the steps of evaluating the health state of the equipment in real time, and triggering an early warning mechanism when the health state of the equipment is abnormal; the equipment resource scheduling comprises the following steps: dynamically allocating equipment resources according to network traffic and application requirements; the network security protection comprises the steps of monitoring network security in equipment operation, and calling a preset defense strategy to perform security disposal when a security threat event is detected. The system and the electronic equipment correspond to the method. By the adoption of the network equipment operation management method and device, comprehensive supervision measures can be provided for healthy operation of the equipment, resource supply of the equipment in the operation process is improved, active safety protection is provided for the equipment, and an efficient, intelligent and safe network equipment operation management solution is achieved.

Description

Technical Field

[0001] The present application relates to the field of network security technology, and specifically to an operation management method, system and electronic device for network security equipment. Background Art

[0002] Network security equipment refers to hardware devices used to protect the network and its data from illegal access, attack, destruction or theft. When network security equipment fails, it may cause network service interruption, security protection failure and other problems. In serious cases, it may even lead to data leakage or network attack. Therefore, it is very important to detect and handle network security equipment failures in a timely manner.

[0003] Common methods of avoiding network security device anomalies include:

[0004] 1. Check the physical connection: First, check whether the power supply of the device is normal, whether the network cable is loose or damaged, etc. Sometimes a simple physical connection problem can cause the device to not work properly.

[0005] 2. Log in to the device management interface: Try to log in to the device management interface through a browser or other management tools to view the system's operating status, log records and other information, and understand specific error codes or warning information.

[0006] 3. Consult documents and online resources: Look up the meaning and solution of the relevant error code according to the manual provided by the device manufacturer or the technical support documents on the official website.

[0007] 4. Regular maintenance and updates: In order to prevent equipment problems, network security equipment should be maintained regularly, including software upgrades, firmware updates, etc., to ensure that it is always in the best working condition.

[0008] 5. Implement redundancy solutions: For critical businesses, you can consider deploying redundant equipment. Once the main equipment fails, the backup equipment can take over immediately to ensure business continuity.

[0009] Although the above methods can promote the stable operation of network security equipment to a certain extent, most of these methods require active operation by the management party to be implemented, so they have a high lag, and the network environment is in a rapidly changing state. Therefore, whether there is an abnormality in the equipment or whether the equipment is running stably, timely disposal is required to provide maximum efficiency. Therefore, a reliable and efficient network security equipment operation management technology is urgently needed. Summary of the invention

[0010] The purpose of this application is to provide an operation management method, system and electronic device for network security equipment to solve the technical problems raised in the above background technology.

[0011] To achieve the above objectives, the present application discloses the following technical solutions: a method for operation management of network security equipment, including equipment health assessment, equipment resource scheduling and network security protection;

[0012] The equipment health assessment includes: real-time assessment of the health status of the equipment, and triggering an early warning mechanism when the health status of the equipment is abnormal;

[0013] The device resource scheduling includes: dynamically allocating device resources according to network traffic and application requirements;

[0014] The network security protection includes: monitoring the network security during device operation, and when a security threat event is detected, calling a preset defense strategy for security disposal.

[0015] Preferably, the real-time evaluation of the health status of the device specifically includes:

[0016] Collect indicator information of equipment;

[0017] Extract key features from the collected indicator information according to the preset feature extraction rules;

[0018] The health score of the device is calculated and compared with a preset score threshold. When the health score of a device is less than the score threshold, the health status of the device is defined as abnormal; otherwise, the health status of the device is defined as normal.

[0019] Preferably, the dynamic allocation of device resources according to network traffic and application requirements specifically includes:

[0020] Based on network traffic and application requirements, use machine learning models to predict the future resource requirements of devices. j ;

[0021] The current resource usage of the device O j and resource consumption E j Conduct collection;

[0022] The time it takes for a device to complete a task T j Conduct collection;

[0023] Based on resource demand D j , resource possession O j , Resource consumption E j and the time consumed T j Adaptability to equipment F j Perform calculations;

[0024] According to the fitness of each device, the genetic algorithm is used to allocate the resources in the resource pool P.

[0025] Preferably, the fitness F j Calculated by the following formula:

[0026]

[0027] Among them, α, β and γ are weight coefficients.

[0028] Preferably, when multiple devices have the same resource requirements, the device with greater fitness will be given priority in obtaining the required resources.

[0029] Preferably, when the resource demand of a device to complete a task exceeds a preset allocation threshold, the device collaborates with other devices to execute the task.

[0030] Preferably, the monitoring of network security during device operation specifically includes:

[0031] Use deep learning technology to train the behavior recognition model to identify the behavior of the device and determine whether the device's behavior is a normal behavior pattern or an abnormal behavior pattern. When the device's behavior is identified as an abnormal behavior pattern, it is defined as a security threat event for the device.

[0032] Preferably, when a security threat event is detected, calling a preset defense strategy for security disposal specifically includes:

[0033] Build a library of coping strategies;

[0034] Analyze the abnormal behavior patterns of the device and match the analysis results in the response strategy library;

[0035] The matched defense strategy is called to handle the security threat events that occur on the device.

[0036] In a second aspect, the present application discloses an operation management system for a network security device, which is applicable to the operation management method for a network security device as described above, and the system includes:

[0037] The equipment health assessment module is configured to: assess the health status of the equipment in real time and trigger an early warning mechanism when the health status of the equipment is abnormal;

[0038] Device resource scheduling module: dynamically allocates device resources based on network traffic and application requirements;

[0039] Network security protection module: monitors the network security of the device during operation, and when a security threat event is detected, calls the preset defense strategy for security disposal.

[0040] In a third aspect, the present application discloses an electronic device, comprising:

[0041] at least one memory and at least one processor;

[0042] The memory is communicatively connected to the processor;

[0043] The memory stores a computer program that can be executed by the processor. When the computer program is executed, the operation management method for a network security device as described above is implemented.

[0044] Beneficial effects: The operation management method, system and electronic device for network security equipment of the present application combine hardware status monitoring and software performance evaluation to provide comprehensive supervision measures for the healthy operation of the equipment. Secondly, through the setting of a dynamic resource allocation and scheduling mechanism, the resource supply of the equipment during operation is improved, providing reliable resource support for the stable operation of the equipment. At the same time, by utilizing active security monitoring, active security protection based on behavioral analysis is realized, thus realizing an efficient, intelligent and secure network equipment operation management solution. BRIEF DESCRIPTION OF THE DRAWINGS

[0045] In order to more clearly illustrate the embodiments of the present application or the technical solutions in the prior art, the drawings required for use in the embodiments or the description of the prior art will be briefly introduced below. Obviously, the drawings described below are only some embodiments of the present application. For those skilled in the art, other drawings can be obtained based on these drawings without paying any creative work.

[0046] Figure 1 A schematic block diagram of the process of an operation management method for a network security device provided in an embodiment of the present application. DETAILED DESCRIPTION

[0047] The technical solutions in the embodiments of the present application are described clearly and completely below. Obviously, the described embodiments are only part of the embodiments of the present application, not all of the embodiments. Based on the embodiments in the present application, all other embodiments obtained by ordinary technicians in this field without creative work are within the scope of protection of the present application.

[0048] In this article, the term "comprising" is intended to cover non-exclusive inclusion, so that a process, method, article or device including a series of elements includes not only those elements, but also includes other elements not explicitly listed, or also includes elements inherent to such process, method, article or device. In the absence of more restrictions, the elements defined by the sentence "comprising..." do not exclude the presence of other identical elements in the process, method, article or device including the elements.

[0049] In a first aspect, this embodiment provides Figure 1 A method for operation management of network security equipment is shown, including equipment health assessment, equipment resource scheduling and network security protection.

[0050] The following is an introduction to the specific contents of each step.

[0051] 1. Equipment Health Assessment

[0052] Includes: real-time evaluation of the health status of the equipment, and triggering an early warning mechanism when the health status of the equipment is abnormal.

[0053] Among them, real-time evaluation of the health status of the equipment is achieved through the following steps:

[0054] Collect indicator information of equipment;

[0055] Extract key features from the collected indicator information according to the preset feature extraction rules;

[0056] The health score of the device is calculated and compared with a preset score threshold. When the health score of a device is less than the score threshold, the health status of the device is defined as abnormal; otherwise, the health status of the device is defined as normal.

[0057] Specifically, when obtaining the health score of a device, the following solutions can be used:

[0058] (1) Select a set of key features that can fully reflect the health status of the device. These key features may include but are not limited to CPU utilization x1, memory usage x2, network traffic x3, error log frequency x4, response time x5, etc. Assume that

[0059] (2) For each feature x i (When the key features are only CPU utilization x1, memory usage x2, network traffic x3, error log frequency x4, response time x5, i = 1 to 5), calculate its average value u over a period of time i ,assumed,

[0060] (3) Calculate the standard deviation σ of each feature i ,assumed,

[0061] (4) Each feature is normalized using the standard deviation and mean value. at this time,

[0062] (5) Define the ideal state value I corresponding to each characteristic of the equipment, assuming that And the normalized ideal state value I' corresponding to each feature is calculated according to the standard deviation and the average value. At this time,

[0063] (6) Calculate the covariance matrix Q between the features. The covariance matrix can be the result obtained by calculating the covariance matrix in the prior art. It reflects the correlation between the features and helps to eliminate the redundant information between the features. Assume that the covariance matrix is ​​known and is simplified to the unit matrix here.

[0064] (7) Calculate the Mahalanobis distance D between the current state of the device and the ideal state M , Among them, Q -1 is the inverse matrix of the covariance matrix, and the symbol T represents the transpose of the matrix. At this time,

[0065] (8) The health score H can be calculated by the Mahalanobis distance D M For example, an exponential decay function is used for conversion. Assume λ = 1, then H = e -1×2.236 ≈0.105.

[0066] The above scheme eliminates the dimensional differences between features through adaptive scaling transformation and considers the correlation between features through Mahalanobis distance, thereby achieving a comprehensive and dynamic assessment of the health status of the equipment. It can improve the accuracy and robustness of the health score and ensure the rationality and interpretability of the health score.

[0067] In addition, for the early warning mechanism, a reasonable health score threshold can be set based on the historical data of the equipment and expert experience. The set score threshold can be, for example, 0.8. When the health score is lower than the set score threshold, an early warning is triggered, such as an early warning notification. Among them, the early warning notification method can be diverse, such as: sending an email to the operation and maintenance personnel or management personnel; sending a text message to a designated mobile phone; displaying the alarm information on the monitoring system interface, accompanied by a sound prompt; calling the automated operation and maintenance tool through the API to trigger further diagnosis and processing operations.

[0068] 2. Equipment Resource Scheduling

[0069] Including: Dynamically allocate device resources according to network traffic and application requirements to improve resource utilization efficiency. The dynamic allocation of resources specifically includes:

[0070] Based on network traffic and application requirements, use machine learning models to predict the future resource requirements of devices. j ;

[0071] The current resource usage of the device O j and resource consumption E j Conduct collection;

[0072] The time it takes for a device to complete a task T j For collection, here, when the aforementioned response time is the response time for a task, the consumption time T j It can be the same as the corresponding response time;

[0073] Based on resource demand D j , resource possession O j , Resource consumption E j and the time consumed T j Adaptability to equipment F j Calculate; fitness F j Calculated by the following formula: Among them, α, β and γ are weight coefficients used to balance the influence of various factors. Indicates resource utilization rate. The larger the value, the more fully the resource is utilized. The smaller the resource consumption value, the lower the energy consumption. Indicates the speed of task completion. The larger the value, the faster the task is completed. In addition, the choice of weight coefficient can be adjusted according to the actual application scenario. For example, if you want to maximize resource utilization, you can set α to be larger; if you want to minimize energy consumption, you can set β to be larger; if you want to speed up task completion, you can set γ to be larger;

[0074] According to the fitness of each device, the genetic algorithm is used to allocate resources in the resource pool P. The resource pool P contains all available network resources, and the resource pool can be dynamically increased or decreased according to changes in network traffic. In the resource allocation process, the goal of resource allocation is to maximize the overall fitness.

[0075] As a preferred implementation, a corresponding competition and cooperation mechanism can be set up, that is, when the resource requirements of multiple devices are the same, the device with greater fitness will have priority in obtaining the required resources; and when the resource requirements required for a device to complete a task exceed a preset allocation threshold, the device will collaborate with other devices to execute the task.

[0076] 3. Network security protection

[0077] It includes: monitoring the network security of the equipment during operation, and when a security threat event is detected, calling the preset defense strategy for security disposal.

[0078] Among them, the network security during equipment operation is monitored, including:

[0079] Use deep learning technology to train the behavior recognition model to identify the behavior of the device and determine whether the device's behavior is a normal behavior pattern or an abnormal behavior pattern. When the device's behavior is identified as an abnormal behavior pattern, it is defined as a security threat event for the device.

[0080] When a security threat event is detected, the preset defense strategy is called to perform security disposal, including:

[0081] Build a library of coping strategies;

[0082] Analyze the abnormal behavior patterns of the device and match the analysis results with the response strategy library;

[0083] The matched defense strategy is called to handle security threat events that occur on the device, such as blocking malicious IP addresses, restricting access to specific ports, etc.

[0084] In this embodiment, network security protection can be implemented by using any network security monitoring technology in the prior art, which will not be elaborated in this text.

[0085] In summary, the operation management method for network security equipment in this embodiment combines hardware status monitoring and software performance evaluation to provide comprehensive supervision measures for the healthy operation of the equipment. Secondly, through the setting of a dynamic resource allocation and scheduling mechanism, the resource supply of the equipment during operation is improved, providing reliable resource support for the stable operation of the equipment. At the same time, by utilizing active security monitoring, active security protection based on behavioral analysis is realized, thus realizing an efficient, intelligent and secure network equipment operation management solution.

[0086] In a second aspect, the present embodiment provides an operation management system for a network security device, to which the aforementioned operation management method for a network security device is applicable, and the system includes:

[0087] The equipment health assessment module is configured to: assess the health status of the equipment in real time and trigger an early warning mechanism when the health status of the equipment is abnormal;

[0088] Device resource scheduling module: dynamically allocates device resources based on network traffic and application requirements;

[0089] Network security protection module: monitors the network security of the device during operation, and when a security threat event is detected, calls the preset defense strategy for security disposal.

[0090] It should be noted that the operation and management system for network security devices in this embodiment corresponds to the aforementioned operation and management method for network security devices. Therefore, the contents that are not specifically disclosed in the operation and management system for network security devices (including specific plans, functional configurations, and technical effects, etc.) can refer to the corresponding records in the aforementioned operation and management method for network security devices, and this text will not go into details here.

[0091] In a third aspect, this embodiment provides an electronic device, including:

[0092] at least one memory and at least one processor;

[0093] The memory is communicatively connected to the processor;

[0094] The memory stores a computer program that can be executed by the processor. When the computer program is executed, the aforementioned operation management method for a network security device is implemented.

[0095] It should be noted that the electronic device of this embodiment corresponds to the aforementioned operation management method for network security equipment. Therefore, the content that is not specifically disclosed in the electronic device (including specific schemes, functional configurations, and technical effects, etc.) can refer to the corresponding records in the aforementioned operation management method for network security equipment, and this text will not go into details here.

[0096] In the embodiments provided in the present application, it should be understood that the embodiments described herein can be implemented in hardware, software, firmware, middleware, code or any appropriate combination thereof. For hardware implementation, the processor can be implemented in one or more of the following units: application specific integrated circuit (ASIC), digital signal processor (DSP), digital signal processing device (DSPD), programmable logic device (PLD), field programmable gate array (FPGA), processor, controller, microcontroller, microprocessor, other electronic units designed to implement the functions described herein or their combination. For software implementation, part or all of the flow of the embodiment can be completed by instructing the relevant hardware through a computer program. When implemented, the above program can be stored in a computer-readable storage medium or transmitted as one or more instructions or codes on a computer-readable storage medium. Computer-readable storage media include computer storage media and communication media, wherein the communication medium includes any medium that is convenient for transmitting a computer program from one place to another. The storage medium can be any available medium that a computer can access. The computer-readable storage medium can include but is not limited to RAM, ROM, EEPROM, CD-ROM or other optical disk storage, disk storage medium or other magnetic storage device, or any other medium that can be used to carry or store the desired program code in the form of an instruction or data structure and can be accessed by a computer.

[0097] Finally, it should be noted that the above is only a preferred embodiment of the present application and is not intended to limit the present application. Although the present application has been described in detail with reference to the aforementioned embodiments, it is still possible for those skilled in the art to modify the technical solutions described in the aforementioned embodiments or to make equivalent substitutions for some of the technical features therein. Any modifications, equivalent substitutions, improvements, etc. made within the spirit and principles of the present application shall be included in the protection scope of the present application.

Claims

1. A method for operation management of network security equipment, characterized in that: Including equipment health assessment, equipment resource scheduling and network security protection; The equipment health assessment includes: real-time assessment of the equipment health status, and triggering an early warning mechanism when the equipment health status is abnormal; The device resource scheduling includes: dynamically allocating device resources according to network traffic and application requirements; The network security protection includes: monitoring the network security during device operation, and when a security threat event is detected, calling a preset defense strategy for security disposal.

2. The operation management method for network security equipment according to claim 1, characterized in that: The real-time evaluation of the health status of the device specifically includes: Collect indicator information of equipment; Extract key features from the collected indicator information according to the preset feature extraction rules; The health score of the device is calculated and compared with a preset score threshold. When the health score of a device is less than the score threshold, the health status of the device is defined as abnormal; otherwise, the health status of the device is defined as normal.

3. The operation management method for network security equipment according to claim 1, characterized in that: The dynamic allocation of device resources according to network traffic and application requirements specifically includes: Based on network traffic and application requirements, use machine learning models to predict the future resource requirements of devices. j ; The current resource usage of the device O j and resource consumption E j Conduct collection; The time it takes for a device to complete a task T j Conduct collection; Based on resource demand D j , resource possession O j , Resource consumption E j and the time consumed T j Adaptability to equipment F j Perform calculations; According to the fitness of each device, the genetic algorithm is used to allocate the resources in the resource pool P.

4. The operation management method for network security equipment according to claim 3, characterized in that: The fitness F j Calculated by the following formula: Among them, α, β and γ are weight coefficients.

5. The operation management method for network security equipment according to claim 4, characterized in that: When multiple devices have the same resource requirements, the device with greater fitness will be given priority in obtaining the required resources.

6. The operation management method for network security equipment according to claim 4, characterized in that: When the resource demand of a device to complete a task exceeds a preset allocation threshold, the device is coordinated with other devices to execute the task.

7. The operation management method for network security equipment according to claim 1, characterized in that: The monitoring of network security during device operation specifically includes: Use deep learning technology to train the behavior recognition model to identify the behavior of the device and determine whether the device's behavior is a normal behavior pattern or an abnormal behavior pattern. When the device's behavior is identified as an abnormal behavior pattern, it is defined as a security threat event for the device.

8. The operation management method for network security equipment according to claim 7, characterized in that: When a security threat event is detected, the preset defense strategy is called to perform security disposal, specifically including: Build a library of coping strategies; Analyze the abnormal behavior patterns of the device and match the analysis results in the response strategy library; The matched defense strategy is called to handle the security threat events that occur on the device.

9. An operation management system for network security equipment, applicable to the operation management method for network security equipment according to any one of claims 1 to 8, characterized in that: The system includes: The equipment health assessment module is configured to: assess the health status of the equipment in real time and trigger an early warning mechanism when the health status of the equipment is abnormal; Device resource scheduling module: dynamically allocates device resources based on network traffic and application requirements; Network security protection module: monitors the network security of the device during operation, and when a security threat event is detected, calls the preset defense strategy for security disposal.

10. An electronic device, characterized in that: include: at least one memory and at least one processor; The memory is communicatively connected to the processor; The memory stores a computer program that can be executed by the processor. When the computer program is executed, the operation management method for a network security device according to any one of claims 1 to 8 is implemented.

Images