Unified management system for security boundary strategies of network security equipment of power monitoring system

Abstract

The invention discloses a power monitoring system network security equipment security boundary strategy unified management system, and belongs to the field of security. Comprising the following steps of: acquiring information of general safety equipment including a firewall, a switch and a VPN (Virtual Private Network); analyzing traffic, strategies, logs and events by using a machine learning method; when the analysis result is displayed, a blocking suggestion is given and can be automatically issued, and a disposal report is generated; unified and centralized management of heterogeneous brands and heterogeneous models of network security equipment including firewalls, routing exchange, load balancing and VPN in the whole network of an enterprise is realized; through visualization of safety management by a user, safety compliance visualization analysis from a safety perspective is realized. Safety equipment strategies of different brands in a power monitoring system are collected, intelligent analysis is carried out in combination with asset routing conditions, and automatic issuing of protection and blocking strategies is achieved. On the basis of asset detection, routing policy acquisition and protection policy acquisition, policy unified management of the security boundary is realized.

Description

Technical Field

[0001] The present invention belongs to the field of network security, and in particular relates to a unified management system for network security equipment security boundary strategies used in an electric power monitoring system. Background Art

[0002] The power monitoring system refers to the business system and intelligent equipment based on computer and network technology used to monitor and control the power production and supply process, as well as the communication and data network as the basic support.

[0003] With the development of the power system, the scale and complexity of the power monitoring system network are constantly increasing, and the resulting information exposure and risk points are also gradually expanding.

[0004] As a system that controls the operation of the power grid, once it is damaged, it may cause the power system to be paralyzed, affecting the stability and reliability of power supply. The importance of information security of power monitoring systems is becoming increasingly prominent.

[0005] In current practical applications, the power monitoring system uses a power-specific network and implements the sixteen-character security policy of "security zoning, network dedicating, horizontal isolation, and vertical authentication."

[0006] Among them, security partitioning refers to dividing the network system into different security areas to prevent unauthorized access and attacks. Network-specific refers to equipment and software dedicated to network security, such as firewalls, access gateways, systems, etc. Horizontal isolation refers to isolating different network security areas in the network system to prevent unauthorized access and attacks. Vertical authentication refers to authenticating the identity of users in the network system to ensure that only authorized users can access the network system.

[0007] Take firewalls as an example. As the most common network security protection device, they are widely deployed in various networks. The basic function of a firewall is to set network access control policies, converge network access rights, implement the principle of least authorization, prevent unauthorized access, and prevent and reduce network risks. Access control policies are the soul of firewalls and the foundation of network security defense systems. Their settings directly affect the application effect of firewalls and the overall level of network security defense.

[0008] If a network's access control policy deployment has loopholes, attackers may be able to illegally invade through the simplest means, even with the most advanced network security equipment. In February 2019, Gartner predicted in a technology observation report: "By 2023, 99% of firewall breaches will be due to firewall configuration errors rather than defects in the firewall itself."

[0009] Currently, most firewall policies used in power monitoring systems are managed manually. With the continuous expansion of network scale and frequent changes in business, the number of policy rules is increasing, the effect evaluation is difficult to complete, and compliance is difficult to ensure.

[0010] The "Information Security Level Protection Management Measures" (GB / T 331XX-20XX) clearly puts forward the requirements for refined and centralized management of firewall policies. However, for both user units and evaluation agencies, in complex network scenarios, the analysis of massive firewall policies is beyond the reach of human power, and the refined management and evaluation of firewall policies are difficult to implement.

[0011] Specifically, on the one hand, the overall management of policies is difficult, and often the problem is not solved completely. Global security policy management is impossible, and various security device policies are prone to form "islands". According to the requirements of security protection and the principle of defense in depth, each manufacturer establishes a three-dimensional defense system adapted to its own equipment, and the expression of policies is different. As a result, when policies are activated or business needs change in daily systems, it is necessary not only to be familiar with the command syntax of each brand of equipment, but also to adjust the policies of multiple security devices. If not managed well, the policy situation needs to be sorted out first, resulting in a lot of operation and maintenance work, which has a huge impact on work efficiency.

[0012] On the other hand, problems such as redundant or inappropriate policies themselves frequently occur. If temporarily enabled or expired security policies are not cleaned up in a timely manner, policy redundancy will result, bringing great security risks. In addition, policy optimization takes a long time, operating procedures are not standardized, and regular, item-by-item security policy screening will consume a lot of manpower and time. When there are hidden dangers or configuration problems in security policies, administrators need to analyze them one by one according to the policy path nodes, which is inefficient and prone to errors, and the system security and stability are worrying.

[0013] In response to the above problems, network operation and maintenance software can usually use the general SNMP protocol for management (see "A Brief Analysis of the Key Points and Development Trends of Computer Network Operation and Maintenance Management" by Liu Wenxing, China New Communications, Issue 07, 2022, P98-P100), but because there is no analysis specifically for information security in the power monitoring system scenario, it is impossible to analyze strategies or issue management commands. In addition, due to the lack of effective means for the management of security policies, security policies are in an "invisible" state, and the correctness and compliance of policy configurations cannot be effectively checked.

[0014] The invention patent application with the application publication date of 2021.04.06 and the application publication number of CN 112615811 A discloses "an automated analysis method for the robustness of network boundary strategies within power information", including the following steps: S1. Use the collection layer to complete the information collection object processing; S2. Then the processing layer is analyzed and processed by a dedicated analysis engine, and then the security policy collection module and security policy processing operations are performed in sequence; S3. The storage layer is used again to store and process the information in sequence through configuration file storage, traffic data storage, combing result storage and threat alarm storage; S4. Finally, the information is displayed and processed in the traffic interconnection display, configuration comparison display, traffic alarm, status monitoring display, work order management and result report export through the display layer. This technical solution realizes the firewall policy hit frequency analysis, firewall potential conflict strategy analysis and other tasks by analyzing and counting the hit frequency of the border firewall security policy. Since it is only based on the analysis and statistics of the hit frequency of the border firewall security policy, it focuses on the software field and does not take into account the security management policy issues between hardware systems, nor does it take into account the security equipment policy issues of different brands in the power monitoring system. It does not involve issues such as security equipment model management, information security policy formulation and management in the power monitoring system network.

[0015] The invention patent with the authorization announcement date of 2023.05.19 and the authorization announcement number of CN 113591915 B discloses an "abnormal traffic identification method based on semi-supervised learning and single-classification support vector machine", which includes the following steps: 1. Collect network traffic data and extract data description features; 2. Generate an initialization model for abnormal traffic identification by using the collected network traffic data through a single-classification support vector machine algorithm; 3. Input the network traffic data into the sample screening strategy, and the sample screening strategy uses the nearest boundary strategy and its deformation; 4. Select typical network traffic according to the sample screening strategy and mark it to obtain typical marked samples; 5. Input the typical marked samples into the initialization model for abnormal traffic identification, and combine the semi-supervised learning idea to iteratively optimize the model to obtain the abnormal traffic identification model; 6. Input the network traffic data into the abnormal traffic identification model to identify abnormal traffic. This technical solution can provide an accurate and fast modeling method for a large amount of unbalanced traffic data to identify known and unknown attacks. However, it only considers the identification of abnormal traffic and focuses on the software aspect. It also does not address the problems of large differences in the management methods of network security equipment models in the power monitoring system, low policy management efficiency, and high error probability.

[0016] Therefore, how to solve the problems of large differences in the management methods of network security equipment models in power monitoring systems, low policy management efficiency, and high error probability is an important technical issue that needs to be urgently solved in the process of formulating security boundary strategies for network security equipment in power monitoring systems. Summary of the invention

[0017] The technical problem to be solved by the present invention is to provide a unified management system for the security boundary strategy of network security equipment in power monitoring systems. By constructing a unified management system for security equipment strategies in power monitoring system scenarios, collecting security equipment strategies of different brands in the power monitoring system, and conducting intelligent analysis in combination with asset routing, the automatic issuance of protection and blocking strategies is achieved while meeting information security requirements.

[0018] The technical solution of the present invention is to provide a unified management system for network security equipment security boundary strategy of a power monitoring system, including a power monitoring system, which is characterized by:

[0019] The unified management system of security boundary strategy of network security equipment of power monitoring system is divided into: collection layer, analysis layer and execution layer;

[0020] The collection layer includes information collection of common security devices including firewalls, switches, and VPNs;

[0021] The analysis layer uses machine learning methods to analyze traffic, policies, logs, and events after sorting out the collected data;

[0022] While displaying the analysis results, the execution layer gives blocking suggestions and can automatically issue them to generate a disposal report.

[0023] The unified management system of security boundary strategy for network security equipment of the power monitoring system is adopted to realize unified and centralized management of network security equipment of heterogeneous brands and models including firewalls, routing switches, load balancing, and VPNs in the entire enterprise network;

[0024] Regularly capture policy configuration files and routing table information of gateway devices including firewalls and routing switches through online collection, and then parse and store them in a unified security policy model through normalization, ultimately realizing centralized display, query, export and analysis of various access control policies for heterogeneous brands, models and devices;

[0025] By comparing and analyzing the security policies in the policy configuration file with other policies one by one, we can determine the inclusion and inclusion relationship between them. Finally, we can check and analyze whether there are redundant policies or hidden policies, and whether there are mergeable policies and empty policies. We can then streamline and optimize the policies based on the analysis results.

[0026] By reading the configuration of firewalls and routing switching devices, the interfaces and network segments of each gateway device, as well as other settings, are parsed; if there is the same interface subnet between any two gateway nodes, they are interconnected, which will be automatically reflected in the topology through subnet connections. All gateway devices are recursively traversed in turn to automatically form the logical topology of the entire network;

[0027] Divide security domains according to security standards, group related network assets and devices in the security topology, use the ability to mark security domains, and customize user business rules; use visualization technology to visualize the infrastructure of the security domain of the entire network; and realize visual analysis of security compliance from a security perspective through user visualization of security management.

[0028] Specifically, the power monitoring system includes at least sensors, controllers, computers, software and network switches; the sensors are used to detect parameters of the power system; the controllers are used to control the operation of the power system; the computers are used to process data; the software is used to implement the functions of the monitoring system; and the network switches are used to connect various components.

[0029] Specifically, the unified management system of the security boundary strategy of network security equipment in the power monitoring system uses automated / semi-automated means to complete blocking and disposal work; uses XML files as the unified description language of network security device security policies, making network security policy definitions easier to unify the management of security devices of different versions and models; describes routes in the unified policy description by using XPath syntax to describe various nodes and elements in XML documents; and uses XSLT language to define conversions between nodes to achieve route conversion, thereby achieving route description.

[0030] Specifically, the unified and centralized management includes basic information, policy information, and log information of various types of network security devices.

[0031] Furthermore, the policy information includes functions related to policy collection, policy analysis, policy history, policy change monitoring, policy query, policy cleanup, and policy activation.

[0032] Furthermore, the policy information includes various security policies, NAT policies, ACL policies, static policies, policy routing, and dynamic routing.

[0033] Furthermore, the basic information of the device includes at least management IP, device name, brand, type, and model.

[0034] Specifically, the unified management system of security boundary policies for network security equipment in the power monitoring system realizes access path and data flow analysis from any source address to the destination address through end-to-end full-path analysis, including whether there is a reachable path, the nodes passed by the reachable path, the routes and policy information hit, and the details of the data flows allowed or denied.

[0035] Specifically, the unified management system of security boundary policies for network security devices of the power monitoring system locates the corresponding gateway device through the source address when performing access path analysis, and then searches for the next gateway one by one through the routing on the gateway device until the destination address is reached.

[0036] The unified management system for security boundary strategies of network security equipment of the power monitoring system described in the present invention combines the network security equipment characteristics of the power monitoring system, collects security equipment strategies of different brands in the power monitoring system, and performs intelligent analysis based on the asset routing situation. Under the condition of meeting information security requirements, it realizes the automatic issuance of protection and blocking strategies. On the basis of asset detection, routing strategy collection, and protection strategy collection, it performs network security strategy calculation to realize unified management of security boundary strategies.

[0037] Compared with the prior art, the advantages of the present invention are:

[0038] 1. The technical solution of the present invention combines the characteristics of network security equipment of the power monitoring system, performs network security policy calculation on the basis of asset detection, routing policy collection, and protection policy collection, and realizes unified policy management of security boundaries. It can effectively improve operation and maintenance efficiency and system security, and has good pertinence, practicality and advancement for the power monitoring system;

[0039] 2. The technical solution of the present invention, by building a unified management system for security device strategies in power monitoring system scenarios, collects security device strategies of different brands in the power monitoring system, and conducts intelligent analysis in combination with asset routing, so as to realize the automatic issuance of protection and blocking strategies while meeting information security requirements;

[0040] 3. The technical solution of the present invention, combined with the network security equipment characteristics of the power monitoring system, collects the security equipment policies of different brands in the power monitoring system, and conducts intelligent analysis based on the asset routing situation. Under the condition of meeting the information security requirements, it realizes the automatic issuance of protection and blocking policies; based on asset detection, routing policy collection, and protection policy collection, it performs network security policy calculation to realize unified policy management of security boundaries. BRIEF DESCRIPTION OF THE DRAWINGS

[0041] Figure 1 It is a schematic diagram of the protection model P2DR model adopted by the present invention;

[0042] Figure 2 It is a schematic diagram of the framework structure of the strategy unified management system of the present invention;

[0043] Figure 3 Schematic diagram of the improved CL-BERT model of the present invention;

[0044] Figure 4It is a schematic diagram of the analysis model of the present invention;

[0045] Figure 5 It is a schematic diagram of a unified management platform for security boundary policies of network security devices of the present invention;

[0046] Figure 6 It is a schematic diagram of the topological layer of the present invention;

[0047] Figure 7 It is a schematic diagram of the path query and detection results of the present invention;

[0048] Figure 8 It is a schematic diagram of the strategy list of the present invention;

[0049] Fig. 9 It is a schematic diagram of the path inspection of the present invention;

[0050] Fig.10 is a schematic diagram of the intersection strategy in the optimization suggestion of the present invention;

[0051] Fig.11 It is a schematic diagram of the intersection strategy in the optimization suggestion of the present invention. DETAILED DESCRIPTION

[0052] The present invention will be further described below in conjunction with the accompanying drawings.

[0053] As the construction of power monitoring systems continues to improve, the number of networks, security devices, and business application scenarios deployed in them continues to increase, and the related network boundary security policies are becoming more and more complicated, often spanning multiple suppliers, multiple equipment manufacturers, and multiple physical locations. The operation and maintenance are difficult, and the accuracy of the traditional "manual" security management method that relies on "people" is low, which greatly increases the risk of the company's important business and core data assets being attacked by cyber attacks. Therefore, it is urgent to strengthen the construction of the network boundary security policy management system.

[0054] The research and practical deployment in this paper show that the system can effectively improve operation and maintenance efficiency and system security, and has good pertinence, practicality and advancement for power monitoring systems.

[0055] In order to solve the problems of large differences in the management methods of network security equipment models in the power monitoring system, low policy management efficiency and high error probability, the technical solution of the present invention, combined with the network security equipment characteristics of the power monitoring system, proposes a unified security boundary policy management system based on network security equipment asset analysis, power monitoring system routing topology analysis and information security equipment policy analysis. It collects security equipment policies of different brands in the power monitoring system, conducts intelligent analysis based on the asset routing situation, and realizes the automatic issuance of protection and blocking policies while meeting information security requirements; on the basis of asset detection, routing policy collection and protection policy collection, it performs network security policy calculation to realize unified policy management of security boundaries.

[0056] 1. Introduction to the characteristics of power monitoring system:

[0057] The power monitoring system is usually composed of sensors, controllers, computers, software, networks, etc. Sensors are used to detect the parameters of the power system, controllers are used to control the operation of the power system, computers are used to process data, software is used to realize the functions of the monitoring system, and network switches are used to connect various components.

[0058] The power monitoring system uses a power-specific network and implements the sixteen-character network security policy of "security zoning, network dedication, horizontal isolation, and vertical authentication."

[0059] The power monitoring system will deploy security protection devices at the border to prevent unauthorized access and attacks. The protection devices include firewalls, access gateways, isolation devices, etc. These devices contain functions such as security policies, access control lists (ACLs), and security audits.

[0060] At present, a complete business monitoring system has been built in the power monitoring system. However, there is no complete system for security protection equipment policy management. The difficulty is mainly reflected in three aspects of security equipment: heterogeneity, complexity and dynamics. The following is an introduction using a firewall as an example.

[0061] 1) Heterogeneity

[0062] There are generally more than three brands of firewalls in the power network, and more than five models. The access control policy configurations of different brands of equipment are different, and different software versions of the same brand of equipment also have differences in access control policy configurations. The number of firewalls in large and medium-sized power networks can reach dozens or even hundreds. Access control devices are presented in various forms such as physical, virtual, security group policy, and host access control.

[0063] Taking basic function commands as an example, there are differences between brands, as shown in Table 1:

[0064] Table 1 Basic commands for firewalls of different brands

[0065]

[0066] 2) Complexity

[0067] The most basic function of a firewall is to manage policies through the five-tuple to block unauthorized network traffic, thereby protecting the network from malicious attacks. Firewall policies can control network traffic by setting rules to ensure network security. The firewall five-tuple refers to a set of rules consisting of five elements: source address, destination address, source port, destination port, and protocol, which are used to control the ingress and egress of network traffic.

[0068] Therefore, the effectiveness and risk analysis of firewall policy settings is not limited to a single firewall, but also needs to be analyzed through the access relationship and access path between network objects. The access path between two points in the network requires the correlation analysis of the logical connection and access control of multiple network devices. The network devices involved not only refer to firewalls, but also routers, switches and load balancers. The data that needs to be analyzed includes IP, VLAN, VXLAN, routing, policy routing, NAT, ACL, security policies, etc.

[0069] 3) Dynamic

[0070] It is possible to change the power firewall policy. The main reason is that the firewall access control policy is related to network connectivity and security. The security principle of access control is to reduce network risks by converging network connectivity. Therefore, as long as the network structure and business change, the access control policy needs to change accordingly. For the power monitoring system network with high business agility in the future, the policy changes will be more frequent and the number of rules will be larger.

[0071] The above three problems make it difficult to implement the refined management of the firewall strategy of the power monitoring system, and will have two consequences: 1) Frequent policy changes increase the chance of introducing security risks; 2) It takes up a lot of manpower.

[0072] The policy management of some power monitoring systems accounts for a high proportion of the security operation and maintenance work, which directly leads to the lack of guarantee of other higher-level work resources. The operation and maintenance of other security equipment, such as switches, also have similar problems that need to be solved urgently.

[0073] 2. Security Boundary Policy Framework for Network Security Devices

[0074] 1) Firewall security boundary strategy

[0075] The function of firewall technology is mainly to promptly discover and deal with security risks, data transmission and other problems that may exist during the operation of computer networks. Its treatment measures include isolation and protection. At the same time, it can record and detect various operations in computer network security to ensure the security of computer network operation and the integrity of user data and information, providing users with a better and safer computer network experience. [7]

[0076] Firewall boundary security strategies generally include the following aspects: 1) Restricting access: Firewalls can restrict unauthorized access to protect the network from malicious attacks; 2) Managing network traffic: Firewalls can control the traffic in the network to ensure the security and stability of the network; 3) Detecting attacks: Firewalls can detect malicious attacks to prevent attackers from invading the network; 4) Reviewing content: Firewalls can review content to detect suspicious malicious programs and unsafe content; 5) Monitoring the network: Firewalls can monitor the network to detect potential attack behaviors.

[0077] Firewall security strategies usually include analyzing and filtering network traffic to ensure network security. The main technical measures include using rules and authorization techniques, establishing access control lists, filtering specific data packets, blocking malware and malicious activities, and using encryption technology to protect network traffic.

[0078] Based on the firewall security policy, a security domain can be established. A firewall security domain refers to a group of physical or virtual networks that can be used to implement a network security wall. It can reject unauthorized network traffic to protect computers and data inside the network from external attacks. As a result, the following are generated:

[0079] 1) Inter-domain or intra-domain security policy: used to control the traffic between domains or within domains. At this time, the security policy has both traditional packet filtering functions and further application layer detection such as IPS, AV, Web filtering, and application control. Inter-domain or intra-domain security policy is an integrated strategy that implements multiple security checks such as packet filtering and UTM application layer detection at the same time. Inter-domain security policy also includes: forwarding policy, which controls the traffic forwarded by the device, including traditional packet filtering and UTM detection at the application layer; local policy: controls the mutual access between the outside world and the device, and controls only based on the five-tuple. Intra-domain security policy also includes: basic policy is the same as the inter-domain policy, the only difference is that there is no need to set the forwarding entry and exit, and the traffic within the local domain cannot be controlled.

[0080] 2) Packet filtering rules applied on the interface: used to control the traffic on the interface, which is the traditional packet filtering function, directly allowing or denying packets to pass based on the second and third layer message attributes such as IP and MAC addresses.

[0081] 2) Switch security boundary strategy

[0082] Switch policy refers to the network setting rules in the network switch, which are used to control the behavior of the network switch to achieve network security, performance, and management purposes. Switch policies usually include security policies, performance policies, and management policies. Security policies are the boundary security policies of the switch, which can prohibit unsafe protocols or operations to prevent network attacks and malware intrusion. Specific implementation strategies include: secure access control, packet filtering, virtual local area network (VLAN), flow control, ARP attack protection, network address translation (NAT), etc.

[0083] 1) Access control policy

[0084] Access control is the main strategy for network security prevention and protection. Its main task is to ensure that network resources are not illegally used and accessed. It is also an important means to maintain network system security and protect network resources.

[0085] Security policies are divided into network access control, network permission control, directory-level security control, attribute security control, network server security control, network monitoring and locking control, network port and node security control, etc. These security policies must cooperate with each other to truly play a protective role, but in general, access control is one of the most important core strategies to ensure network security.

[0086] On a Layer 2 switch, ACL is used to implement access control. ACL ensures that network devices are not illegally accessed or used as attack springboards by controlling access input and output to network resources. ACL is a table of rules. The Layer 2 switch executes these rules in sequence and processes each data packet entering the port.

[0087] Each rule allows or denies packets based on their attributes, such as source address, destination address, and protocol. Since rule processing is done in a certain order, the relative position of each rule is critical in determining whether to allow each type of packet to pass through the network.

[0088] 2) Packet filtering

[0089] The intrusion is mainly carried out through the "backdoor" of the software. Packet filtering is set up at the network layer. First, a certain number of information filtering tables should be established. The information filtering table is built based on the header information of the received data packet. The information packet header contains the source IP address of the data packet, the destination IP address, the transmission protocol type (TCP, UDP, ICMP, etc.), the source port number of the protocol, the destination port number of the protocol, the connection request direction, the ICMP message type, etc.

[0090] When a data packet meets the rules in the filter table, it is allowed to pass, otherwise it is prohibited to pass. This firewall can be used to prohibit illegal external users from accessing the internal system, and can also be used to prohibit access to certain types of services. However, packet filtering technology cannot identify dangerous information packets, cannot implement application-level protocol processing, and cannot process UDP, RPC or dynamic protocols.

[0091] 3) VLAN

[0092] As a commonly used logical isolation method in power monitoring systems, virtual local area networks based on three-layer switches can solve conflict domains, broadcast domains, and bandwidth issues. VLANs can be divided based on the network layer.

[0093] There are currently two solutions: 1) division by protocol (if there are multiple protocols in the network); 2) division by network layer address (the most common is the subnet address in TCP / IP).

[0094] The same strategy as managing routing can be used to establish VLANs, and VLANs can be divided according to IP subnets, IPX network numbers, and other protocols. Workstations with the same protocol are divided into one VLAN, and the three-layer switch checks the Ethernet frame header field of the broadcast frame.

[0095] Check the protocol type, if the VLAN of the protocol already exists, add the source port, otherwise, create a new VLAN. VLANs constructed in this way not only greatly reduce the workload of manual VLAN configuration, but also ensure that users can freely add, move and modify.

[0096] Sites on different VLAN segments can belong to the same VLAN, and sites on different VLANs can also be on the same physical segment.

[0097] The disadvantage of defining VLANs at the network layer is that, compared with using MAC addresses, VLANs based on the network layer need to analyze the address formats of various protocols and perform corresponding conversions.

[0098] For Layer 2 switches, VLAN division can be based on different principles. Generally, there are three division methods: port-based VLAN division, MAC address-based VLAN division, and route-based VLAN division. Through VLAN division principles such as routing access lists and MAC address allocation, user access rights and logical network segment sizes can be controlled, and different user groups can be divided into different VLANs, thereby improving the overall performance and security of the switched network.

[0099] 4) Flow control technology

[0100] Flow control technology limits abnormal traffic flowing through ports within a certain range. Many Layer 2 switches have port-based flow control functions that can achieve storm control, port protection, and port security.

[0101] The flow control function is used to notify the other party to temporarily stop sending data packets when congestion occurs between switches to avoid message loss. Broadcast storm suppression can limit the size of broadcast traffic and discard broadcast traffic that exceeds the set value.

[0102] 5) ARP attack protection technology

[0103] ARP spoofing attacks and ARPFlood attacks use the trust mechanism in the ARP address resolution process to perform camouflage and spoofing attacks, causing some or all hosts in the network to be unable to access the network. ARP attack protection technology is based on the principles of various attack methods.

[0104] 6) NAT

[0105] Switch network address translation technology is a network technology implemented by switches, which can convert an address in one network into an address in another network. Switch network address translation allows devices between two different networks to communicate, thereby achieving network access, data exchange and sharing and other functions.

[0106] 3. Unified management system for network security equipment security boundary strategy

[0107] 3.1. Unified description language for network security device security policies

[0108] NetSec Device Security Policy Unified Description Language (NetSecPDL) is a description language used to define security policies for network security devices. This language is designed to make network security policy definitions easier to unify the management of security devices of different versions and models. This system uses XML to describe PDL.

[0109] At the same time, in the unified description of the strategy, the route is described by using XPath syntax, and the route conversion is realized by using XSLT language. XPath can describe various nodes and elements in XML documents, and XSLT can define the conversion between nodes, thereby realizing the route description.

[0110] 3.2 System Framework

[0111] The unified policy management system adopts the P2DR model, corresponding to the time spent on the attack, as follows Figure 1 as shown in .

[0112] The P2DR model is a representative model of a dynamic network security system. The security policy generated based on risk analysis describes which resources in the system need to be protected and how to protect them. The policy is the core of the model, and all protection, detection, and response are implemented based on the security policy. Network security policies generally include two parts: overall security policy and specific security policy.

[0113] In order to successfully achieve disposal, avoid risks and reduce losses, it is necessary to reduce time loss in the "discovery" and "disposal" links as much as possible.

[0114] Among them, the method to reduce time loss in the disposal link is to make full use of automated / semi-automated means to complete blocking and disposal work. However, since the network system includes many control functions, in order to more effectively implement network security disposal work, semi-automated means are currently mainly used to reduce disposal time and improve disposal efficiency.

[0115] The unified policy management system is divided into: collection layer, analysis layer and execution layer. The collection layer includes information collection of common security devices such as firewalls, switches, VPNs, etc. After sorting out the collected data, the analysis layer uses machine learning methods to analyze traffic, policies, logs and events. While displaying the analysis results, the execution layer gives blocking suggestions and can automatically issue them to generate disposal reports. Figure 2 As shown, specifically including:

[0116] 1) Based on the analysis of firewall policy logs, it provides historical hit statistics and hit details analysis functions for security policies, supports analysis of security policy utilization from dimensions such as source address, destination address, and destination port, and realizes the gradual convergence and tightening of ANY and loose policies.

[0117] 2) Check for inter-domain violation policies. In the access control policy, the access from the source address to the destination port of the destination address is converged and tightened if it violates the business principles or security management principles.

[0118] 3) Converge and tighten the access control policies for high-risk ports such as destination ports 3389 and 445.

[0119] 4) When focusing on a specific network asset, quickly query the access rights of the asset across the entire network to clarify the spread of the virus / attack or quickly query the service permissions open to the asset across the entire network to narrow the search scope of the attack source.

[0120] 5) Build functions such as policy risk analysis, remote policy issuance, and policy activation verification to assist network security operation and maintenance personnel in completing policy changes quickly and effectively, and ensure the accuracy of the changes, thereby improving work efficiency and reducing maintenance costs.

[0121] 6) Linked with the network attack alarm system, it automatically performs policy blocking. It can issue five-tuple blocking / unblocking security policies in two modes: designated firewall and automatic positioning firewall, and effectively avoid the problem of equipment performance degradation caused by a large number of blocking.

[0122] Key technologies in this technical solution:

[0123] A. Strategy Management

[0124] 1) Centralized management of heterogeneous devices

[0125] The unified visualization platform for security policies can realize the unified and centralized management of network security devices of heterogeneous brands and models such as firewalls, routing switches, load balancing, VPNs, etc. across the entire enterprise network, including policy collection, policy analysis, policy history, policy change monitoring, policy query, policy cleanup, policy activation and other related functions.

[0126] The management content includes basic information, policy information, and log information of various network security devices. Basic device information includes management IP, device name, brand, type, model, etc. Policy information includes various security policies, NAT policy, ACL policy, static policy, policy routing, and dynamic routing.

[0127] 2) Strategy collection and extraction

[0128] The unified security policy visualization platform supports two policy configuration collection and extraction methods: manual collection and online collection.

[0129] (1) Manual collection

[0130] The administrator can manually export the device policy configuration information to the configuration file through "Export Configuration" in the Web management interface of the target firewall or through Show Config in the command line console, and then upload the configuration file to the unified visualization platform for security policies. Supports configuration file parsing in multiple file formats such as log, txt, conf, cfg, and XML.

[0131] (2) Online Collection

[0132] The unified security policy visualization platform provides two online collection methods for target firewall devices that support command line configuration management. For target devices that support command line configuration, the platform can automatically collect policy configuration information of target devices online through remote access management protocols such as SSH and Telnet; for target devices that do not support command line configuration, the platform can obtain policy configuration information through the API interface or Web management page.

[0133] Policy configuration information.

[0134] 3) Strategy query retrieval

[0135] The centralized firewall policy management system standardizes and unifies the data format of the extracted firewall policies, and performs unified analysis to achieve a visual presentation of the security domain architecture.

[0136] From the perspective of security domain architecture, users can perform fuzzy or precise queries on firewall policies based on their needs by group number, action, protocol, source address, source port, destination address, destination port, service and other factors.

[0137] 4) Policy history backup

[0138] In the process of firewall device security operation and maintenance, firewall device configurations need to be backed up regularly for reasons such as configuration recovery and event tracing. The policy visualization platform can customize online collection timed tasks to obtain and synchronize target device policy configuration information in a timely manner. The collection cycle can be set to different frequencies such as weekly, daily, and hourly. The platform archives and stores the target device policy configuration history, and administrators can choose to download the original policy configuration files of any period.

[0139] 5) Policy configuration information comparison

[0140] The unified security policy visualization platform can compare historical configuration files of target devices at different times and present the differences between configuration files at different times by comparing configuration file texts.

[0141] 6) Policy change monitoring and change records

[0142] Uncontrolled policy changes or various malicious policy tampering and changes are one of the important causes of network failures and security incidents. At the same time, in the actual network security operation and maintenance process of the enterprise, each device will be managed and maintained by multiple administrators at the same time. When the configuration information is destroyed or tampered with, it is difficult to know in time.

[0143] The policy change monitoring function of the unified visualization platform for security policies can realize the visualization of policy changes. After the platform automatically collects the configuration files of the target device, it will compare them with the content collected last time. When there is a difference in the system comparison, it will be regarded as a change in the policy configuration of the target device, and the device administrator can be notified and warned through email, SMS, etc. The unified visualization platform for security policies supports the tracking and management of policy configuration changes, helping administrators to timely understand the details of changes in device policy configuration, including the time of policy information change, and the specific policy configuration content that has been added, deleted, and modified.

[0144] 7) Strategy cleanup

[0145] In scenarios where new firewalls are deployed or firewall devices are migrated, it is difficult for administrators to plan and design firewall access control policies due to business complexity. Instead, administrators hope to monitor the firewall traffic for a period of time, sort out ACL policy list suggestions from the traffic session information, and then selectively implement them in the firewall policy list.

[0146] The policy configuration suggestion function can automatically sort out the firewall policy suggestion report based on the real traffic information and interconnection relationship in the existing network, sort out the policy according to filtering conditions such as target, time, and aggregation granularity, and convert the policy suggestions into policy scripts to facilitate policy maintenance and addition.

[0147] 8) Strategy hit analysis

[0148] By monitoring and counting the traffic session data in and out of the firewall device, the total hit traffic for each policy on the firewall over a period of time can be presented, and the corresponding historical hit traffic session information details can be viewed. Through policy hits, the policy order is adjusted, and the policy with a large number of hits has a high priority, which improves the efficiency of the firewall; at the same time, long-term useless policies are found, and they are tightened and deleted in a targeted manner to achieve the principle of minimizing access policies, thereby improving the overall security defense capabilities of the network.

[0149] 9) Strategy optimization check

[0150] Usually, due to frequent changes and accumulation of firewall policies, there will be a lot of useless policies, which will affect the efficiency of firewall operation on the one hand, and also pose certain security risks on the other hand. Platform policy optimization inspection can regularly optimize and inspect firewall objects (including address objects, time objects) and policies (including security policies, ACL policies, NAT policies, routing policies), sort out various types of empty objects, unreferenced objects, redundant policies, hidden policies, expired policies, mergeable policies, empty policies, etc. Administrators can streamline and optimize policies based on the analysis results.

[0151] 10) Strategy activation

[0152] The policy activation service includes functions such as service activation request, activation suggestion, policy risk analysis, remote policy issuance and policy activation verification, which assist network security operation and maintenance personnel to quickly and effectively complete policy changes and ensure the accuracy of the changes, thereby improving work efficiency and reducing maintenance costs.

[0153] After the business personnel propose a change, they will combine the process service platform to conduct a policy risk assessment before approval. By mining the policy information on the original equipment and comparing it with the existing change policy, they can check whether the same policy exists and whether it conflicts with the existing policy, and confirm the compliance of the change. Before the policy change, a simulation test is performed to verify whether the change requested by the business personnel meets the expected requirements and does not introduce new risks; based on the results of the simulation test, a change suggestion is generated, telling the user the optimal path to make the change and generating the corresponding change parameters. The automated change platform calls the corresponding parameters to issue the change, reducing the involvement of technical personnel in the change and confirming the reliability of the change.

[0154] 11) Strategy full life cycle management

[0155] The entire life cycle management of security policies, namely the entire process of application - review - evaluation - simulation - verification - issuance, is done online, managed and audited.

[0156] B. Security topology

[0157] The system needs to realize the automatic extraction and analysis management of security policy information of firewalls, routers, and switches, including routing information, access control, and NAT policies that affect data security, and use visualization technology to realize the visualization of the security domain infrastructure of the entire network. It is necessary to divide security domains according to the security protection specifications, group relevant network assets and devices in the security topology and mark security domains, customize user business rules, realize user visualization of security management, and realize visual analysis of security compliance from a security perspective.

[0158] Through the analysis and display of the security domain infrastructure, enterprise managers can clearly see the distribution of the enterprise's core business assets and key data, as well as the access to the outside world. On this basis, targeted security protection can be carried out, and the effect will be twice the result with half the effort.

[0159] Combined with the current status of business processes, application architecture, data architecture, etc., analyze the compliance baseline strategy of key data in the core business system, and query and display business-based compliance data flows in the security domain infrastructure layer. Support users to analyze network compliance data flows from source address, destination address, source security domain, destination security domain, and untrusted external network area, and can mark all network accessible paths to warn of network risks, and realize visual analysis of the threat surface of core business. Support path reachability analysis after NAT address conversion in security topology.

[0160] C. Risk Analysis

[0161] 1) Inter-domain access whitelist and continuous monitoring

[0162] The system automatically sorts out the access control relationships between security domains, and cooperates with manual intervention to quickly form an access control whitelist between security domains across the entire network; it supports visual management of the access control whitelist between security domains across the entire network; and through continuous monitoring, it promptly detects and warns of illegal paths and security policies that violate the access control whitelist.

[0163] 2) Security strategy risk analysis

[0164] Based on the system's preset security policy risk rule library, the firewall device security policy configuration is tested for policy risk rules, and firewall device security policy risk warnings and rectification measures are provided. Policy risk rules cover multiple dimensions such as statistical risk, loose risk, high-risk ports, configuration risk, and compliance risk.

[0165] D. Innovative technology

[0166] Machine learning-based policy management uses machine learning techniques to study, analyze, and process policy learning.

[0167] Starting from the task itself, we build an adaptive model CL-BERT for data security level recognition based on the attention mechanism, which is similar to BERT and Baidu ERNIE deep natural language model. This model makes a more accurate judgment on the security level of the node by capturing and understanding the device strategy, network assets and routing dimensions in a more fine-grained manner.

[0168] The model is lightweight through the sharing mechanism of model parameters, which greatly reduces the training and testing dimensional requirements of the model, and is more in line with the needs of policy priority and routing classification judgment.

[0169] Also, see Figure 3 As shown, this technical solution uses an optimized CL-BERT model to improve the model's judgment accuracy.

[0170] By using enhanced unsupervised learning models, especially text clustering models such as the LDA topic model, and linking them with supervised learning algorithms such as CL-BERT, and adding a human-computer interaction interference mechanism, the routing learning and log analysis effects are further improved, and the accuracy of policy decisions is improved.

[0171] Based on accurate policy judgment, the DRL+GNN method is used for policy optimization analysis. The network is modeled using graph neural network (GNN). Deep reinforcement learning (DRL) is used to build agents to effectively run the network according to a specific optimization strategy. The algorithm is shown in the figure below: Figure 4 as shown in .

[0172] The pseudo code for the DRL algorithm implementation of the q-value function generated using GNN modeling is shown in the following table:

[0173] Table 1 Algorithm implementation pseudo code

[0174]

[0175]

[0176] 5. Unified management platform for network security equipment security boundary strategy

[0177] 5.1 Platform Architecture

[0178] like Figure 5 As shown in the , firstly, by investigating the current status and needs of the development of the power monitoring system, we extract its core connotation, build the physical model and system architecture of the unified management system of border security policies, and design its functions to provide architectural support for key technologies. According to the application scenarios, we study technologies such as key data collection, policy data introduction and storage, policy data mining and analysis, and network path analysis. We establish a unified security policy management system platform consisting of collection, visualization, analysis, management, and distribution, which fully supports the network security system of the power monitoring system and enhances the network security protection capabilities of the power monitoring system.

[0179] The unified management platform for network security equipment boundary security policies is a platform based on the full life cycle monitoring of security ecosystem services. Through visualization, it builds an information security defense system based on security policies, comprehensively sorts out the relationship between services, permissions, assets, policies, and data, and focuses on improving the security immunity of the power monitoring system itself. It uses big data and distributed computing technology to build an immune system, involving countless network nodes, security policies, and highly complex interactions of network records, to achieve the goal of manageable, controllable, and visual security of the power monitoring system business, and to fully grasp the overall security status of the network.

[0180] The unified management system architecture of security device boundary security policies adopts the method of "maintaining macro perspective, focusing on collaboration at the meso level, and emphasizing business at the micro level" to integrate the design of the platform technology architecture. This platform architecture consists of the basic software layer, data service layer, business application layer, and user display layer.

[0181] 5.2 Platform Functions

[0182] 1) User display layer:

[0183] (1) Permission management: manage user permission roles, including adding, deleting, modifying, checking and configuring permissions.

[0184] (2) User management: Manage system users, including adding, deleting, modifying, checking, resetting passwords, and allocating permissions.

[0185] (3) User personal information management: You can modify the current user’s personal information and login password.

[0186] 2) Data service layer:

[0187] (1) Asset list: Registration and management of firewalls, routers (switches), and load balancing devices. This includes adding, editing, importing, exporting, deleting, and policy collection functions.

[0188] (2) Collection records: equipment collection information log.

[0189] (3) Collection of vouchers: The management of accepted vouchers, including addition, deletion, modification and inquiry.

[0190] (4) Device List: Manage available device assets and edit, delete, and view corresponding policies and migration policies.

[0191] 3) Business application layer - topology:

[0192] (1) Topological layer

[0193] System topology management, including querying all topology maps (including automatic topology), adding hand-drawn topology, modifying existing topology layers (including automatic topology), deleting topology, and setting the system default topology. For details, see Figure 6 as shown in .

[0194] (2) Path query: You can test whether the specified source and destination are reachable. For details, see Figure 7 as shown in .

[0195] 4) Business application layer - strategy:

[0196] (1) Strategy List

[0197] The policy list displays the policy type, the name of the policy set, the policy name, the policy ID, the source domain, the destination domain, the source address, the destination address, the source port, the destination port, the service, the policy status, the description, the line number, and the device information. The policy types include ACL policy, firewall policy, and default policy. For details, see Figure 8 as shown in .

[0198] (2) Strategy display

[0199] The main contents of policy display include address objects, service object management, NAT list, policy routing, static routing, routing table, and Zone display. For details, see Figure 8 as shown in .

[0200] (3) Strategy Management

[0201] Due to changes in corporate business, department adjustments, and personnel transfers, firewall policies often change, which can lead to many useless policies over time. On the one hand, this affects the efficiency of firewall operations, and on the other hand, it can also pose certain security risks. The policy can be used to sort out the work order list and query the path.

[0202] First, in the work order list, a work order is a unique processing task generated by the device when a policy, address object, or service object changes. Through the work order, you can view the changed items, check the rationality of the changes, process the issued items, and view the issued results.

[0203] Path check is shown as follows Fig. 9 as shown in .

[0204] 5) Business service layer: Optimization suggestions-intersection strategy

[0205] Policy inspection can inspect and analyze firewall policies, sort out various redundant policies, hidden policies, empty policies, and expired policies. Administrators can optimize and adjust policies based on the analysis results.

[0206] Optimization suggestions: Active intersection strategy and optimal space strategy, see Fig.10 and Fig.11 as shown in .

[0207] 6) Platform Application

[0208] 6.1) Daily operation and maintenance

[0209] With the construction and advancement of the power monitoring system, network application technology continues to develop, and network security protection capabilities continue to improve. We will adjust the existing network security emergency response system, give full play to the advantages of the power monitoring system network infrastructure, terminal platform, and operation and maintenance personnel, use domestic and foreign research experience, improve the closed-loop mechanism of network security work, and promote the construction of systematic protection, monitoring, and disposal capabilities with strategy as the core, and finally build an emergency response mechanism based on business continuity.

[0210] 6.2) Emergency drills

[0211] Through the application research and key technology verification of the network security emergency response system in the distribution automation system, its implementation value in the Shibei distribution automation system can be verified. At the same time, the application effects of network event detection, network accident analysis, network accident response and emergency drills are analyzed to provide strong support for the safe operation of the distribution network.

[0212] The technical solution of the present invention, by strengthening the network boundary security policy management, establishes a complete network security policy unified management visualization platform in the network environment, and realizes the cross-physical area and cross-device brand management of security policies through docking with the network security management platform, and conducts all-round security dynamic monitoring of the current informatization construction from the network boundary policy security level, ensuring the rapid response of network data when real-time events are triggered in daily operation, and also provides architecture and technical support for meeting the relevant technical requirements of the National Cyber ​​Security Law.

[0213] The innovation of the present invention is:

[0214] 1) Build a visual management module for the entire network path:

[0215] Based on the current network security access control strategy, a topology diagram based on the network security architecture is constructed for the current network, and visual analysis and display are performed from the perspectives of security domains, security access relationships, and security paths, providing an effective basis for the convergence of the network attack surface.

[0216] 2) Build a security boundary baseline and optimize the whole network strategy:

[0217] Based on the unified management of network asset combing and security policy heterogeneous products, the enterprise's private and special security boundary baseline is calculated, and the conflicting strategies, hidden strategies, and minimum strategies of the entire network are monitored periodically or in quasi-real time, helping users to solidify the security baseline during operation and maintenance, eliminate abnormal behaviors, quickly warn, and reduce risks.

[0218] 3) Build a unified management module for network-wide security policies:

[0219] Collect and manage the security policies of the entire network in a unified manner, synchronize and back up the security policies of cross-brand security devices, and reduce the risks incurred by users during the operation and maintenance process. At the same time, the module is connected with the network security monitoring device and the supervision platform, and the disposal information of the security policies is uniformly uploaded to the network security management platform.

[0220] 4) Build a rapid response mechanism for network-wide security incidents:

[0221] On the basis of the above, it provides users with a rapid response mechanism and judgment basis when security incidents occur, ensuring the security of user assets, data security and the optimal state of security policies.

[0222] In summary, the technical solution of the present invention, combined with the network security equipment characteristics of the power monitoring system, proposes a unified security boundary strategy management system based on network security equipment asset analysis, power monitoring system routing topology analysis, and information security equipment strategy analysis. On the basis of asset detection, routing strategy collection, and protection strategy collection, network security strategy calculation is performed to achieve unified strategy management of security boundaries. This technical solution can effectively improve operation and maintenance efficiency and system security, and has good pertinence, practicality, and advancement for the power monitoring system.

[0223] The present invention can be widely used in the fields of safety management and operation maintenance of electric power monitoring system networks.

Claims

1. A unified management system for security boundary strategies of network security equipment of power monitoring system, including a power monitoring system, characterized by: The unified management system of security boundary strategy of network security equipment of power monitoring system is divided into: collection layer, analysis layer and execution layer; The unified management system of security boundary strategy for network security equipment of the power monitoring system is adopted to realize unified and centralized management of network security equipment of heterogeneous brands and models including firewalls, routing switches, load balancing, and VPNs in the entire enterprise network; Regularly capture policy configuration files and routing table information of gateway devices including firewalls and routing switches through online collection, and then parse and store them in a unified security policy model through normalization, ultimately realizing centralized display, query, export and analysis of various access control policies for heterogeneous brands, models and devices; By comparing and analyzing the security policies in the policy configuration file with other policies one by one, we can determine the inclusion and inclusion relationship between them. Finally, we can check and analyze whether there are redundant policies or hidden policies, and whether there are mergeable policies and empty policies. We can then streamline and optimize the policies based on the analysis results. By reading the configuration of firewalls and routing switching devices, the interfaces and network segments of each gateway device, as well as other settings, are parsed; if there is the same interface subnet between any two gateway nodes, they are interconnected, which will be automatically reflected in the topology through subnet connections. All gateway devices are recursively traversed in turn to automatically form the logical topology of the entire network; Divide security domains according to security standards, group related network assets and devices in the security topology, use the ability to mark security domains, and customize user business rules; use visualization technology to visualize the security domain infrastructure of the entire network; Through the user's visualization of security management, visual analysis of security compliance from a security perspective is achieved.

2. The unified management system for network security equipment security boundary strategy of the power monitoring system according to claim 1 is characterized by: The collection layer includes information collection of common security devices including firewalls, switches, and VPNs; The analysis layer uses machine learning methods to analyze traffic, policies, logs and events after sorting out the collected data; The execution layer provides blocking suggestions while displaying the analysis results and can automatically issue them to generate a disposal report; The power monitoring system at least includes a sensor, a controller, a computer, software and a network switch; The sensor is used to detect the parameters of the power system; The controller is used to control the operation of the power system; The computer is used to process data; The software is used to realize the functions of the monitoring system; The network switch is used to connect various components.

3. The unified management system for network security equipment security boundary strategy of the power monitoring system according to claim 1 is characterized by: The unified management system of security boundary strategy for network security equipment of the power monitoring system uses automated / semi-automated means to complete blocking and disposal work; Use XML files as a unified description language for network security device security policies, making network security policy definitions easier to unify the management of security devices of different versions and models; The P2DR model is used, corresponding to the time spent on the attack; In the unified description of the strategy, the routes are described by using XPath syntax to describe various nodes and elements in the XML document; and the conversion between nodes is defined by using XSLT language to realize the conversion of the routes, thereby realizing the route description.

4. The unified management system for security boundary strategy of network security equipment of power monitoring system according to claim 1 is characterized in that The unified and centralized management includes basic information, policy information, and log information of various types of network security devices.

5. The unified management system for security boundary strategy of network security equipment of power monitoring system according to claim 4 is characterized in that The policy information includes policy collection, policy analysis, policy history, policy change monitoring, policy query, policy cleanup, and policy activation related functions.

6. The unified management system for security boundary strategy of network security equipment of power monitoring system according to claim 4 is characterized by: The policy information includes various security policies, NAT policies, ACL policies, static policies, policy routing, and dynamic routing.

7. The unified management system for security boundary strategy of network security equipment of power monitoring system according to claim 4 is characterized by: The basic information of the device includes at least the management IP, device name, brand, type, and model.

8. The unified management system for security boundary strategy of network security equipment in power monitoring system according to claim 1 is characterized in that The described unified management system of security boundary policies for network security equipment in the power monitoring system realizes access path and data flow analysis from any source address to the destination address through end-to-end full-path analysis, including whether there is a reachable path, the nodes passed by the reachable path, the routes and policy information hit, and the details of the data flows allowed or denied.

9. The unified management system for security boundary strategy of network security equipment of power monitoring system according to claim 1 is characterized in that The power monitoring system network security device security boundary strategy unified management system locates the corresponding gateway device through the source address when performing access path analysis, and then searches for the next gateway one by one through the routing on the gateway device until the destination address is reached.

10. The unified management system for security boundary strategy of network security equipment of power monitoring system according to claim 1 is characterized in that The described unified management system for security boundary strategies of network security equipment in the power monitoring system combines the network security equipment characteristics of the power monitoring system, collects security equipment strategies of different brands in the power monitoring system, and conducts intelligent analysis based on the asset routing situation. While meeting information security requirements, it realizes the automatic issuance of protection and blocking strategies. On the basis of asset detection, routing strategy collection, and protection strategy collection, it performs network security strategy calculation to realize unified management of security boundary strategies.

Images