Security policy risk analysis method

Abstract

The invention provides a security policy risk analysis method, which comprises the following steps of: acquiring a security policy configuration file, and converting the security policy configuration file into structured policy data according to a predefined data format; performing mask prediction training on the structured strategy data by using a large language model to enable the model to understand the content of the security strategy, performing logic relation reasoning training on the structured strategy data of different security strategies, and evaluating a model prediction result by using a preset evaluation index to obtain a trained security strategy analysis model; and designing a security policy risk analysis target, and applying the security policy analysis model to obtain a security policy risk analysis result. When the method is applied to security policy risk analysis, various different security policy configurations can be compatibly processed, the automation degree is high, manual intervention can be reduced, the management efficiency can be improved, dynamic analysis of security policy rules can be realized, and the effectiveness, real-time performance and accuracy of security protection are improved.

Description

Technical Field

[0001] The present invention relates to the field of network security technology, and in particular to a security strategy risk analysis method. Background Art

[0002] Firewalls are an important line of defense for network security. Their policy configuration data usually includes security rules, network address translation (NAT) rules, object definitions (such as networks, services, users, etc.). Different vendors' firewall products have different policy configurations, which makes it difficult to collect, manage, and analyze policies in a unified manner. Existing policy collection methods are usually developed for specific vendors' products, lack universality, and are difficult to meet the needs of multi-brand equipment environments.

[0003] Not only firewall policies, but also network security policies such as router policies and load balancer policies also play a vital role in maintaining the security, stability and efficient operation of the network environment. Firewall policies prevent unauthorized access and malicious traffic by controlling the data packets entering and leaving the network; router policies are responsible for the routing and forwarding of data packets to ensure the optimization of data transmission paths; load balancer policies improve system availability and response speed by distributing network traffic to multiple servers.

[0004] Due to the differences in policy configuration between products from different vendors, how to effectively analyze and predict the potential risks that may be caused by policy changes has become a major challenge for policy management. Existing policy analysis methods usually use fixed models, lack flexibility, and are difficult to adapt to the ever-changing security threat environment. These methods cannot fully identify potential risks in policy configuration, and it is difficult to conduct timely and effective analysis of relevant data and provide real-time optimization suggestions, which limits the improvement of network security protection capabilities.

[0005] Therefore, it is necessary to provide a security policy risk analysis method with strong versatility and high flexibility. Summary of the invention

[0006] The purpose of the present invention is to provide a security policy risk analysis method for performing risk analysis on security policy rules with complex configurations.

[0007] In a first aspect, the security policy risk analysis method provided by the present invention includes: obtaining a security policy configuration file, converting the content of the security policy configuration file into structured policy data according to a predefined data format; using a large language model to perform mask prediction training on the structured policy data so that the model can understand the security policy content, and performing logical relationship reasoning training on the structured policy data of different security policies, applying preset evaluation indicators to evaluate the model prediction results, and obtaining a trained security policy analysis model when the evaluation result is that the prediction result meets the preset evaluation indicator requirements; designing a security policy risk analysis target, and applying the security policy analysis model to obtain a security policy risk analysis result

[0008] The beneficial effects of the method provided by the present invention are: providing a unified security policy data structuring method, being compatible with a variety of different security policy configurations, supporting future added equipment and policy types, and having good scalability. Through the security policy analysis model, risk analysis can be performed on the security policy to be analyzed, and the required risk analysis results can be obtained according to the design objectives, and optimization suggestions can be made for the security policy based on the analysis results. The overall process has a high degree of automation, which can reduce manual intervention and improve management efficiency, and can realize dynamic analysis of security policy rules, thereby improving the effectiveness, real-time nature and accuracy of security protection.

[0009] In a possible embodiment, the content of the security policy configuration file is converted into structured policy data according to a predefined data format, including: encoding the IP information, port information, protocol type and policy action in the security policy configuration file according to a predefined data format; and converting the policy rule content in the security policy configuration file into a feature vector.

[0010] In another possible embodiment, a large language model is used to perform mask prediction training on the structured policy data so that the model understands the security policy content, and logical relationship reasoning training is performed on the structured policy data of different security policies, including: constructing a mask prediction training task that randomly masks the structured policy data content and uses a large language model to predict the masked content; constructing a reasoning training task that determines whether there is a logical association or conflict between security policies; selecting an optimizer and setting a learning rate for training, and using a cross-entropy loss function to measure the difference between the predicted results and the actual data.

[0011] In other possible embodiments, the preset evaluation indicators include prediction accuracy, prediction precision, recall rate and F1 score.

[0012] In a second aspect, the present invention further provides a security policy risk analysis device, comprising:

[0013] The data conversion unit is used to obtain a security policy configuration file and convert the content of the security policy configuration file into structured policy data according to a predefined data format.

[0014] The model training unit is used to use a large language model to perform mask prediction training on the structured policy data so that the model can understand the security policy content, and to perform logical relationship reasoning training on the structured policy data of different security policies, and to evaluate the model prediction results using preset evaluation indicators. When the evaluation result is that the prediction result meets the preset evaluation indicator requirements, a trained security policy analysis model is obtained.

[0015] The analysis unit is used to design a security policy risk analysis target and obtain a security policy risk analysis result by applying the security policy analysis model.

[0016] Among them, the data conversion unit converts the content of the security policy configuration file into structured policy data according to a predefined data format, including: encoding the IP information, port information, protocol type and policy action in the security policy configuration file according to a predefined data format; converting the policy rule content in the security policy configuration file into a feature vector.

[0017] The model training unit uses a large language model to perform mask prediction training on the structured policy data so that the model can understand the security policy content, and performs logical relationship reasoning training on the structured policy data of different security policies, including: constructing a mask prediction training task that randomly masks the structured policy data content and uses a large language model to predict the masked content; constructing a reasoning training task that determines whether there is a logical association or conflict between security policies; selecting an optimizer and setting a learning rate for training, and using a cross-entropy loss function to measure the difference between the predicted results and the actual data.

[0018] The preset evaluation indicators include prediction accuracy, prediction precision, recall rate and F1 score.

[0019] In a third aspect, the present invention further provides a computer-readable storage medium having a computer program stored thereon, and the computer program implements the above-mentioned security policy risk analysis method when executed by a processor.

[0020] In a fourth aspect, the present invention further provides an electronic device, comprising: a processor and a memory; the memory is used to store a computer program; the processor is used to execute the computer program stored in the memory, so that the electronic device performs the above-mentioned security policy risk analysis method.

[0021] For the beneficial effects of the second to fourth aspects, reference may be made to the description of the first aspect. BRIEF DESCRIPTION OF THE DRAWINGS

[0022] Figure 1 A schematic diagram of a process flow of a security policy risk analysis method provided by an embodiment of the present invention;

[0023] Figure 2 A schematic diagram of a security policy risk analysis device provided by an embodiment of the present invention;

[0024] Figure 3 A schematic diagram of the structure of an electronic device provided by an embodiment of the present invention. DETAILED DESCRIPTION

[0025] In order to make the purpose, technical solutions and advantages of the present invention clearer, the technical solutions in the embodiments of the present invention will be clearly and completely described below in conjunction with the drawings of the present invention. Obviously, the described embodiments are part of the embodiments of the present invention, rather than all of the embodiments. Based on the embodiments of the present invention, all other embodiments obtained by ordinary technicians in this field without creative work are within the scope of protection of the present invention. Unless otherwise defined, the technical terms or scientific terms used herein should be understood by people with general skills in the field to which the present invention belongs. "Including" and similar words used in this article mean that the elements or objects appearing before the word include the elements or objects listed after the word and their equivalents, without excluding other elements or objects.

[0026] This embodiment provides a security policy risk analysis method. Figure 1 , the method comprising:

[0027] S101: Obtain a security policy configuration file, and convert the content of the security policy configuration file into structured policy data according to a predefined data format.

[0028] In a possible embodiment, network security policy configuration files can be obtained from multiple channels. For example, policy configuration and log data can be obtained from security devices of different brands through security device interfaces (such as SSH, REST API, NETCONF, etc.); external data such as vulnerability databases (such as CVE) and threat intelligence platforms can be introduced; and security policy configuration files can be obtained by collecting user behavior logs, system audit logs, etc.

[0029] You can obtain the network security configuration file in the following ways: remotely log in to each firewall device through the SSH protocol, execute a specific command (such as show running-config) to obtain the current configuration file, or for devices that support the API interface, call the RESTful API provided by the device to obtain policy configuration data, or export the configuration file from the device management platform and import it into the system.

[0030] The collected data needs to be preprocessed to obtain a security policy configuration file that can be used to convert it into structured policy data. Specifically, the preprocessing steps include: checking whether there are duplicate policy rules, deleting the duplicate policy rules if there are, and then checking whether the fields of each policy rule are complete and the format is correct, correcting the errors, and completing the missing fields by completing from other data sources or setting default values.

[0031] The content of the security policy configuration file is converted into structured policy data according to a predefined data format, including: encoding the IP information, port information, protocol type and policy action in the security policy configuration file according to the predefined data format; and converting the policy rule content in the security policy configuration file into a feature vector.

[0032] Exemplarily, converting the content of the security policy configuration file into structured policy data according to a predefined data format includes: IP address encoding: converting the IP address into a numerical form to facilitate model processing, such as converting the IP address into a 32-bit integer, for example, 192.168.0.1 is converted to 3232235521; for IP network segments, taking the starting address or using CIDR encoding. One-Hot encoding: One-Hot encoding is performed on commonly used IP addresses or network segments to indicate the existence of the IP.

[0033] Encode the port information: For example, encode any port uniformly as 0, and keep the specific port number in numerical form.

[0034] Encode the protocol type: For example, map the protocol type to a numerical value: TCP is mapped to 1, UDP is 2, ICMP is 3, and other protocols are encoded in sequence.

[0035] Encode the policy action: for example, ALLOW is encoded as 1 and DENY is encoded as 0.

[0036] The policy rules in the security policy configuration file are converted into feature vectors as shown in the following matrix:

[0037]

[0038] In a possible embodiment, the predefined data format refers to a data structure template in JSON format, including security policy data, network security logs, vulnerability databases, security best practices and standards, user behavior data and threat intelligence. Among them, Security Policy Data (security policy data) includes Firewall Rules (firewall rules), Access Control Lists (access control lists), Security Group Policies (security group policies); Network Security Logs (network security logs) include Traffic Logs (traffic logs), Intrusion Detection System Alerts (intrusion detection system alerts), Audit Logs (audit logs); Vulnerability Database (vulnerability database) includes CVE records (CVE records); Security Best Practices And Standards (security best practices and standards) include ISO27001, Level Protection (Level Protection); Threat Intelligence (threat intelligence) includes Malicious IPs (malicious IP addresses) and Phishing Patterns (phishing attack patterns).

[0039] Exemplarily, the firewall policy data in the standard JSON format includes the following fields: rule_id: unique identifier of the rule, source_ip / destination_ip: source / destination IP address, supporting single IP, IP segment or CIDR notation, source_port / destination_port: source / destination port number, supporting single port or port range, protocol: protocol type, such as TCP, UDP, ICMP, etc., action: policy action, usually ALLOW or DENY, description: detailed description of the policy. The detailed description of the policy includes the following fields: priority: priority of the policy, enabled: whether the policy is enabled, log: whether to log the traffic matching the rule, application: associated application or service, time_range: time range for the policy to take effect.

[0040] S102: Use a large language model to perform mask prediction training on structured policy data so that the model can understand the security policy content, and perform logical relationship reasoning training on structured policy data of different security policies. Apply preset evaluation indicators to evaluate the model prediction results. When the evaluation result is that the prediction result meets the preset evaluation indicator requirements, the trained security policy analysis model is obtained.

[0041] In a possible embodiment, a large language model is used to perform mask prediction training on structured policy data so that the model can understand the security policy content, and logical relationship reasoning training is performed on structured policy data of different security policies, including: constructing a mask prediction training task that randomly masks the structured policy data content and uses a large language model to predict the masked content; constructing a reasoning training task that determines whether there is a logical association or conflict between security policies; selecting an optimizer and setting a learning rate for training, and using a cross-entropy loss function to measure the difference between the prediction result and the actual data.

[0042] In a possible embodiment, the preset evaluation indicators include prediction accuracy, prediction precision, recall rate and F1 score.

[0043] In a possible embodiment, the adopted large language model is a pre-trained model based on Transformer, such as BERT and GPT. The pre-trained model based on Transformer performs well in processing sequence data and natural language processing tasks.

[0044] Exemplarily, the pre-trained model of the GPT series can be used to design mask prediction training tasks and logical relationship reasoning tasks. Among them, the mask prediction training task is to randomly mask a part of the structured policy data and predict the masked content. The mask prediction training task can enhance the model's understanding of the context of security policy rules. For example, input: [source IP: 192.168.0.0 / 24, destination IP: 10.0.0.1, action: [MASK]], the model predicts the target: predict [MASK] is ALLOW. The logical relationship reasoning task is to reason whether there is an association or conflict between two security policy rules.

[0045] Use an optimizer, set the learning rate, set the batch size and the number of training rounds. Set and adjust the learning rate to ensure effective model learning; select the batch size based on hardware resources to ensure training efficiency; set a suitable number of training rounds to prevent overfitting; select optimizers such as Adam, SGD, etc.

[0046] In a specific embodiment, an Adam optimizer may be used, an initial learning rate is set to 1e-5, a batch size is set to 16 or 32, and the number of training rounds is usually between 3 and 5 rounds.

[0047] In a specific embodiment, 80% of the structured policy data is used as a training set for model training, and 20% of the structured policy data is used as a validation set to evaluate the performance of the trained model to prevent overfitting. That is, if it is found that the model performs well on the training set but poorly on the validation set, there may be overfitting, and the model complexity or regularization parameters need to be adjusted.

[0048] In a specific embodiment, the evaluation indicators for evaluating the trained model include: accuracy (Accuracy) for measuring the proportion of correct predictions, accuracy (Accuracy) for measuring the proportion of correctly predicted positive samples, recall (Recall) for measuring the proportion of correctly predicted actual positive samples, and F1 score (F1 Score) of the harmonic mean of precision and recall. The measurement threshold of each evaluation indicator can be preset, and when the prediction result obtained by the model meets the measurement threshold of each evaluation indicator, the trained security policy analysis model is obtained.

[0049] S103: Design security policy risk analysis objectives and apply security policy analysis models to obtain security policy risk analysis results.

[0050] When analyzing security policy rules that require risk analysis, the security policy risk analysis results can be obtained by designing security policy risk analysis objectives and applying security policy analysis models.

[0051] The security policy analysis model can interpret the content of security policy rules and the logical relationship between different security policy rules, design security policy risk analysis targets, and implement security policy risk analysis by applying the functions of the security policy analysis model. For example, the analysis targets include whether the security policy rules are loose, whether the detection policies conflict, whether the rules are redundant, whether there are security threats, and whether to generate optimization suggestions. For example, if the source IP is any and the destination port is a sensitive service (such as SSH, database port) and the action is ALLOW, it is identified as an overly loose rule. If all traffic is allowed first, and specific traffic is denied in subsequent rules, resulting in the policy being invalid, it is detected as a policy conflict. If the matching conditions and actions of two or more rules are exactly the same, it is identified as the discovery of redundant rules. For the identified risks, specific optimization suggestions are generated through the model, for example: the description of the predicted existing security threat is: policy FW005 is too loose, allowing any source IP to access the database server. Generate optimization measures to provide specific adjustment suggestions, such as "limit the source IP range to the internal network, or add an identity authentication mechanism." For example, the risk rule for predicting the existence of security threats is: allowing any source IP to access the internal SSH service. The corresponding optimization suggestions include: Limit the source IP range: modify the source IP to the trusted management network range. Use security measures: use VPN or jump server to strengthen access control.

[0052] The security policy risk analysis results can be displayed through the user interface, and the content included in the user interface can be customized. For example, the user interface can include a risk list, detailed information, and interactive functions. The risk list can list all identified risk rules, sorted by risk level, and the risk items include detailed information such as specific rule details and optimization suggestions. Interactive functions can be provided for administrators to adjust policies and view the risk assessment of the model in real time for real-time risk analysis.

[0053] In a possible embodiment, the information that can be obtained by obtaining the security policy configuration file includes threat intelligence, which is used to enable the application security policy analysis model to dynamically assess the risk of security policy rules in response to changing security threats, thereby facilitating the automatic adjustment of security policy rules. The sources of threat intelligence include domestic and foreign threat intelligence platforms such as CNCERT and AlienVault OTX, and intelligence information shared with industry partners (security vendors or alliances). Intelligence types include malicious IP addresses and domain names (involving attacks, phishing, botnets, etc.), as well as new attack methods (such as zero-day vulnerability exploits, APT attacks, etc.). Combining threat intelligence data with existing security policies and network environment data, the security policy analysis model can be used to identify unprotected threats and assess new risks based on information, wherein unprotected threats refer to the discovery of known malicious IPs or domain names that are not banned by the current policy, and assessing new risks refers to assessing the protection capabilities of existing policies against new attack methods. According to the dynamic risk assessment results obtained by real-time analysis of threat intelligence data, corresponding new policies can be generated in a timely manner, such as DENY all traffic from the malicious IP list to any destination address, DENY any source IP access to known exploited vulnerability service ports. Preferably, an automated operation and maintenance tool can be set up to generate new strategies for responding to dynamic risk assessment results based on set rules and quickly deploy them, and a change log can be set up to record changes in strategies to ensure traceability.

[0054] In a specific embodiment, the actual application effect and value of deploying the security policy risk analysis method of the present invention to the enterprise's system are: it can successfully manage security policy rules of different configurations, identify multiple high-risk policy rules, and optimize a large number of policy rules based on the identified risks, so that although the number of policies is reduced by 30%, the structure is clearer. The results of risk assessment combined with real-time threat intelligence have added new ban rules for the latest threats, improving the overall security protection capabilities. Overall, management efficiency is improved, the workload of security policy management is reduced by 50%, and administrators can devote more energy to strategic security planning; potential security vulnerabilities are discovered and repaired in a timely manner, reducing the occurrence of security incidents; the workload of manual review and maintenance is reduced, and labor costs are reduced; the data analysis and risk assessment results provided by the application of this method provide strong support for the security decisions of management.

[0055] The security policy risk analysis method provided by the present invention proposes a unified security policy data structuring method, which is compatible with a variety of different security policy configurations, supports future new equipment and policy types, and has good scalability. By utilizing the natural language processing capabilities of the large language model and designing training tasks and training processes, a security policy analysis model is obtained that fully understands the content of the security policy and can infer the logical relationship between different security policies. The obtained security policy analysis model can be used to perform risk analysis on the security policy to be analyzed, and the required risk analysis results can be obtained according to the design goals. Further optimization suggestions can be made for the security policy based on the analysis results. The overall process has a high degree of automation, which can reduce manual intervention and improve management efficiency. It can realize dynamic analysis of security policy rules and improve the effectiveness, real-time and accuracy of security protection.

[0056] See the instruction manual Figure 2 This embodiment also provides a security policy risk analysis device, which is used to implement the above method embodiment. The device includes:

[0057] The data conversion unit 201 is used to obtain a security policy configuration file and convert the content of the security policy configuration file into structured policy data according to a predefined data format.

[0058] The model training unit 202 is used to use a large language model to perform mask prediction training on structured policy data so that the model can understand the security policy content, and to perform logical relationship reasoning training on structured policy data of different security policies, and to evaluate the model prediction results using preset evaluation indicators. When the evaluation result is that the prediction result meets the preset evaluation indicator requirements, a trained security policy analysis model is obtained.

[0059] The analysis unit 203 is used to design a security policy risk analysis target and obtain a security policy risk analysis result by applying the security policy analysis model.

[0060] Among them, the data conversion unit 201 converts the content of the security policy configuration file into structured policy data according to a predefined data format, including: encoding the IP information, port information, protocol type and policy action in the security policy configuration file according to the predefined data format; converting the policy rule content in the security policy configuration file into a feature vector.

[0061] The model training unit 202 uses a large language model to perform mask prediction training on structured policy data so that the model can understand the security policy content, and performs logical relationship reasoning training on structured policy data of different security policies, including: constructing a mask prediction training task that randomly masks the structured policy data content and uses a large language model to predict the masked content; constructing a reasoning training task that determines whether there is a logical association or conflict between security policies; selecting an optimizer and setting a learning rate for training, and using a cross-entropy loss function to measure the difference between the prediction result and the actual data.

[0062] The preset evaluation indicators include prediction accuracy, prediction precision, recall rate and F1 score.

[0063] All relevant contents of each step involved in the above method embodiment can be referred to the functional description of the corresponding functional module, and will not be repeated here.

[0064] In other embodiments of the present application, the present application discloses an electronic device, such as Figure 3 As shown, the electronic device 300 may include: one or more processors 301; a memory 302; a display 303; one or more applications (not shown); and one or more computer programs 304. The above components may be connected via one or more communication buses 305. The one or more computer programs 304 are stored in the above memory and configured to be executed by the one or more processors 301. The one or more computer programs 304 include instructions, which may be used to execute the following: Figure 1 , Figure 2 And each step in the corresponding embodiment.

[0065] Through the description of the above implementation methods, technicians in the relevant field can clearly understand that for the convenience and simplicity of description, only the division of the above functional modules is used as an example. In actual applications, the above functions can be assigned to different functional modules as needed, that is, the internal structure of the device is divided into different functional modules to complete all or part of the functions described above. The specific working process of the system, device and unit described above can refer to the corresponding process in the aforementioned method embodiment, and will not be repeated here.

[0066] Each functional unit in each embodiment of the present application can be integrated into a processing unit, or each unit can exist physically separately, or two or more units can be integrated into one unit. The above integrated unit can be implemented in the form of hardware or in the form of software functional units.

[0067] If the integrated unit is implemented in the form of a software functional unit and sold or used as an independent product, it can be stored in a computer-readable storage medium. Based on this understanding, the technical solution of the embodiment of the present application is essentially or the part that contributes to the prior art or all or part of the technical solution can be embodied in the form of a software product, and the computer software product is stored in a storage medium, including a number of instructions to enable a computer device (which can be a personal computer, a server, or a network device, etc.) or a processor to perform all or part of the steps of the method described in each embodiment of the present application. The aforementioned storage medium includes: various media that can store program codes, such as flash memory, mobile hard disk, read-only memory, random access memory, disk or optical disk.

[0068] The above is only a specific implementation of the embodiment of the present application, but the protection scope of the embodiment of the present application is not limited thereto, and any changes or replacements within the technical scope disclosed in the embodiment of the present application should be included in the protection scope of the embodiment of the present application. Therefore, the protection scope of the embodiment of the present application should be based on the protection scope of the claims.

Claims

1. A security strategy risk analysis method, characterized in that: include: Obtaining a security policy configuration file, and converting the content of the security policy configuration file into structured policy data according to a predefined data format; The structured policy data is trained for mask prediction using a large language model so that the model can understand the security policy content, and the structured policy data of different security policies are trained for logical relationship reasoning, and the model prediction results are evaluated using a preset evaluation index. When the evaluation result is that the prediction result meets the preset evaluation index requirement, a trained security policy analysis model is obtained; Design security policy risk analysis objectives, and apply the security policy analysis model to obtain security policy risk analysis results.

2. The method according to claim 1, characterized in that Converting the content of the security policy configuration file into structured policy data according to a predefined data format, including: Encoding the IP information, port information, protocol type and policy action in the security policy configuration file according to a predefined data format; The policy rule content in the security policy configuration file is converted into a feature vector.

3. The method according to claim 1, characterized in that The structured policy data is trained for mask prediction using a large language model to enable the model to understand the security policy content, and the structured policy data of different security policies are trained for logical relationship reasoning, including: Constructing a mask prediction training task of randomly masking the structured strategy data content and predicting the masked content using a large language model; Construct a reasoning training task to determine whether there is a logical connection or conflict between security policies; Select an optimizer and set the learning rate for training, using the cross entropy loss function to measure the difference between the predicted results and the actual data.

4. The method according to claim 1, characterized in that: The preset evaluation indicators include prediction accuracy, prediction precision, recall rate and F1 score.

5. A security strategy risk analysis device, characterized in that: The device comprises: A data conversion unit, used to obtain a security policy configuration file, and convert the content of the security policy configuration file into structured policy data according to a predefined data format; A model training unit is used to perform mask prediction training on the structured policy data using a large language model so that the model can understand the security policy content, and to perform logical relationship reasoning training on the structured policy data of different security policies, and to evaluate the model prediction results using a preset evaluation index, and to obtain a trained security policy analysis model when the evaluation result is that the prediction result meets the preset evaluation index requirement; The analysis unit is used to design a security policy risk analysis target and obtain a security policy risk analysis result by applying the security policy analysis model.

6. The device according to claim 5, characterized in that The data conversion unit converts the content of the security policy configuration file into structured policy data according to a predefined data format, including: Encoding the IP information, port information, protocol type and policy action in the security policy configuration file according to a predefined data format; The policy rule content in the security policy configuration file is converted into a feature vector.

7. The device according to claim 5, characterized in that The model training unit uses a large language model to perform mask prediction training on the structured policy data so that the model can understand the security policy content, and performs logical relationship reasoning training on the structured policy data of different security policies, including: Constructing a mask prediction training task of randomly masking the structured strategy data content and predicting the masked content using a large language model; Construct a reasoning training task to determine whether there is a logical connection or conflict between security policies; Select an optimizer and set the learning rate for training, using the cross entropy loss function to measure the difference between the predicted results and the actual data.

8. The device according to claim 5, characterized in that The preset evaluation indicators include prediction accuracy, prediction precision, recall rate and F1 score.

9. A computer-readable storage medium having a computer program stored thereon, characterized in that: When the computer program is executed by a processor, the security policy risk analysis method according to any one of claims 1 to 4 is implemented.

10. An electronic device, characterized in that: include: Processor and memory; The memory is used to store computer programs; The processor is used to execute the computer program stored in the memory, so that the electronic device executes the security policy risk analysis method according to any one of claims 1 to 4.

Images