Network access control policy management method and device, equipment and medium

Abstract

The invention provides a network access control policy management method and device, equipment and a medium. The method comprises the steps that network security information of a firewall in a preset time period is collected, the network security information is analyzed according to the machine learning technology, a network security index is obtained, the network security index is used for evaluating the effectiveness of a currently deployed access control strategy, and the network security information comprises the network security information of the firewall in the preset time period; using the currently deployed access control strategy to control the generated data; and according to the network security index, updating the deployment access control strategy in the firewall. According to the technical scheme, the network access control strategy is updated in real time by monitoring the network access information, and the network access safety is improved.

Description

Technical Field

[0001] The present application relates to the field of network security technology, and in particular to a network access control policy management method, device, equipment and medium. Background Art

[0002] With the development of informatization of banking business, more and more financial services rely on the Internet and internal networks. This highly network-dependent operation model makes the banking industry a key target of cybersecurity attacks. The forms of cyberattacks are becoming increasingly complex and varied. These attacks may not only steal sensitive data, but also interfere with the normal operation of banking business, causing huge economic losses and reputation damage.

[0003] Currently, the banking industry mainly relies on traditional network firewalls and intrusion detection systems to ensure network security. These systems are usually based on predefined rule bases to identify and block potential threats.

[0004] However, traditional network firewalls and intrusion detection systems mainly rely on fixed rule sets, which are difficult to effectively respond to evolving network security threats and reduce the network security of banks. Summary of the invention

[0005] The present application provides a network access control policy management method, apparatus, device and medium to solve the problem that traditional network firewalls and intrusion detection systems mainly rely on fixed rule sets and are difficult to effectively respond to evolving network security threats.

[0006] In a first aspect, the present application proposes a network access control policy management method, comprising:

[0007] Collecting network security information of the firewall within a preset time period, and analyzing the network security information according to machine learning technology to obtain network security indicators, wherein the network security indicators are used to evaluate the effectiveness of the currently deployed access control policy, and the network security information includes data generated by the firewall using the currently deployed access control policy for control within the preset time period;

[0008] The access control policy deployed in the firewall is updated according to the network security indicator.

[0009] Furthermore, before collecting network security information of the firewall within a preset time period and analyzing the network security information according to machine learning technology to obtain the network security index, the method further includes:

[0010] Receive network security requirements configured by users;

[0011] Generate an access control policy based on the network security requirements, the pre-acquired network topology relationship and the control policy generation rules; wherein the network topology relationship is a topology relationship obtained by classifying and associating network devices, users, applications and IP addresses based on the network device information, user information, application information and IP addresses in the historical data;

[0012] The access control policy is sent to the firewall for deployment.

[0013] Furthermore, network security information includes network traffic data, security event logs, user behavior records, policy hit counts, and policy coverage levels;

[0014] The analyzing the network security information according to the machine learning technology to obtain the network security indicators includes:

[0015] Using the pre-acquired strategy analysis model, the network security information is analyzed and processed to obtain the network security indicator;

[0016] Among them, the policy analysis model is a model based on the index value of evaluating the effectiveness of the access control policy based on network traffic, security events, user behavior, and policy usage requests obtained through training based on a machine learning algorithm.

[0017] Furthermore, according to the network security requirements, as well as the pre-acquired network topology relationship and control policy generation rules, an access control policy is generated, including:

[0018] Determine, according to the network security requirement and the network topology relationship, an access topology corresponding to the network security requirement, wherein the access topology includes at least one network access path;

[0019] The access control policy is generated according to the control policy generation rule and the access topology.

[0020] Further, sending the access control policy to the firewall for deployment includes:

[0021] A network configuration protocol is used to communicate with the firewall, and the access control policy is sent to the firewall for deployment through an API call.

[0022] Furthermore, the method further comprises:

[0023] If an access anomaly is detected or the network security indicator indicates that the access control policy is invalid, the last valid access control policy deployed in the backup file is used to replace the currently deployed access control policy;

[0024] or,

[0025] If an access anomaly is detected or the network security indicator indicates that the access control policy is invalid, a policy anomaly indication is pushed;

[0026] In response to a selection operation by a user, replacing a currently deployed access control policy with a valid access control policy selected by the user;

[0027] The backup file stores the access control policy for each deployment.

[0028] Furthermore, the method further comprises:

[0029] In response to a policy clearing operation by a user, the access control policy deployed in the firewall is deleted.

[0030] In a second aspect, the present application proposes a network access control policy management device, comprising:

[0031] A network security index obtaining module is used to collect network security information of the firewall within a preset time period, and analyze the network security information according to machine learning technology to obtain network security indicators, wherein the network security indicators are used to evaluate the effectiveness of the currently deployed access control policy, and the network security information includes data generated by the firewall using the currently deployed access control policy for control within the preset time period;

[0032] An access control policy updating module is used to update the access control policy deployed in the firewall according to the network security indicator.

[0033] In a third aspect, the present application provides an electronic device, comprising: a processor, and a memory communicatively connected to the processor;

[0034] The memory stores computer-executable instructions;

[0035] The processor executes the computer-executable instructions stored in the memory to implement the method of the embodiment of the present application.

[0036] In a fourth aspect, the present application provides a computer-readable storage medium, in which computer-executable instructions are stored. When the computer-executable instructions are executed by a processor, they are used to implement the method of the embodiment of the present application.

[0037] The network access control policy management method, device, equipment and medium provided in the present application obtain network security indicators by collecting network security information of the firewall within a preset time period and analyzing the network security information according to machine learning technology. The network security indicators are used to evaluate the effectiveness of the currently deployed access control policy. The network security information includes data generated by the firewall using the currently deployed access control policy for control within the preset time period; the access control policy deployed in the firewall is updated according to the network security indicators, thereby improving the network security protection capability and enhancing the intelligence and adaptability of the network security defense system. BRIEF DESCRIPTION OF THE DRAWINGS

[0038] The accompanying drawings, which are incorporated in and constitute a part of this specification, illustrate embodiments consistent with the present application and, together with the description, serve to explain the principles of the present application.

[0039] Figure 1 A schematic diagram of the architecture of the network access control policy management method provided in this application;

[0040] Figure 2 A flowchart of a first embodiment of a network access control policy management method provided by the present application;

[0041] Figure 3 A flowchart of a second embodiment of the network access control policy management method provided by the present application;

[0042] Figure 4 A flowchart of a third embodiment of the network access control policy management method provided by the present application;

[0043] Figure 5 A flowchart of a fourth embodiment of the network access control policy management method provided by the present application;

[0044] Figure 6 A flowchart of a fifth embodiment of the network access control policy management method provided by the present application;

[0045] Figure 7 A flowchart of a sixth embodiment of the network access control policy management method provided by the present application;

[0046] Figure 8 A flowchart of the seventh embodiment of the network access control policy management method provided by the present application;

[0047] Fig. 9 A schematic diagram of the structure of a network access control policy management device provided in an embodiment of the present application;

[0048] Fig.10A schematic diagram of the structure of an electronic device provided for an embodiment of the present application. Through the above-mentioned drawings, clear embodiments of the present application have been shown, and a more detailed description will be provided later. These drawings and textual descriptions are not intended to limit the scope of the concept of the present application in any way, but to illustrate the concept of the present application for those skilled in the art by reference to specific embodiments. DETAILED DESCRIPTION

[0049] Exemplary embodiments will be described in detail herein, examples of which are shown in the accompanying drawings. When the following description refers to the drawings, the same numbers in different drawings represent the same or similar elements unless otherwise indicated. The implementations described in the following exemplary embodiments do not represent all implementations consistent with the present application. Instead, they are merely examples of devices and methods consistent with some aspects of the present application as detailed in the appended claims.

[0050] With the rapid development of banking network business, network security threats are becoming increasingly complex and changeable, and traditional network firewall access control policy management has many shortcomings. The main problems include: access control policies cannot adapt to zero-day threats and unknown attacks, the policy generation and deployment process lacks intelligent support, abnormal policies are difficult to detect and recover in time, and policy adjustment and removal operations require a lot of manual intervention and are inefficient. These problems have led to insufficient network security protection capabilities and a significant decline in management efficiency.

[0051] Based on the above technical problems, the inventors proposed a network access control policy management method based on reinforcement learning and machine learning technology, which can dynamically generate and deploy access control policies by collecting network security information of firewalls and combining user-configured security requirements and network topology relationships. This method uses a policy analysis model to evaluate the effectiveness of policies, combines anomaly detection mechanisms to achieve automatic policy recovery or push user decision guidance, and supports policy clearing functions for rapid adjustment, greatly improving network security protection capabilities and management efficiency.

[0052] The technical solution of the present application and how the technical solution of the present application solves the above-mentioned technical problems are described in detail below with specific embodiments. The following specific embodiments can be combined with each other, and the same or similar concepts or processes may not be repeated in some embodiments. The embodiments of the present application will be described below in conjunction with the accompanying drawings.

[0053] Figure 1 This is a schematic diagram of the architecture of the network access control policy management method provided in this application. Figure 1 As shown, including:

[0054] The overall architecture 100 of the network access control policy management method includes a policy planning stage 101, a policy deployment stage 102, a policy monitoring stage 103 and a policy optimization stage 104. By introducing intelligent technologies such as reinforcement learning, the life cycle of the access control policy on the network firewall device is comprehensively managed, thereby improving network security protection capabilities and management efficiency.

[0055] Specifically, in the strategy planning stage 101, the access control strategy is dynamically generated using network topology relationship data and real-time information, and the relationship between the Internet Protocol address (English: Internet Protocol, abbreviated: IP) address and network equipment, users and applications is marked to establish an association with the corresponding access control strategy, thereby realizing automatic planning for abnormal traffic. In this way, the system can more flexibly adapt to changes in the network environment, identify potential threats in advance, and effectively prevent security risks.

[0056] Secondly, in the policy deployment phase 102, automated management technology is introduced to achieve automatic distribution, backup, clearing and rollback of access control policies. This not only simplifies the workflow of network administrators and reduces the possibility of human errors, but also improves the response speed and accuracy of policies. Users can manage and maintain access control policies more efficiently, ensuring the continuity and stability of network security protection.

[0057] In the policy monitoring stage 103, the effectiveness of the access control policy is evaluated based on various indicators to help network administrators adjust and optimize the policy in a timely manner to adapt to new security threats. By continuously monitoring network traffic and policy execution, abnormal behavior can be discovered in a timely manner and corresponding countermeasures can be provided, thereby improving the real-time and accuracy of network security protection.

[0058] Finally, in the policy optimization stage 104, the access control policy is continuously improved using reinforcement learning technology, which improves the policy's adaptability and intelligence. By analyzing historical data and real-time information, the execution efficiency and security of the access control policy can be optimized, and the network security protection capability and management efficiency can be continuously improved.

[0059] In summary, this technical solution realizes the full life cycle management of access control strategies by introducing intelligent technologies such as reinforcement learning, including four key stages of planning, deployment, monitoring and optimization. It not only reduces the user's workload, but also enhances the intelligence and adaptability of the entire network security defense system, providing innovative ideas and solutions for the technological development in the field of network security.

[0060] Figure 2 The flowchart of the first embodiment of the network access control policy management method provided by this application is as follows. Figure 2 As shown, the method includes:

[0061] S201. Collect network security information of the firewall within a preset time period, and analyze the network security information according to machine learning technology to obtain network security indicators.

[0062] In banking business networks, traffic distribution is complex and diverse, including transactions, inquiries and other types of business traffic. Collecting this data and analyzing its security is the first step in evaluating the effectiveness of existing access control policies. A firewall is a network security device that monitors and filters data flows in and out of the network and blocks unauthorized access according to defined security rules. Network security indicators can be used to evaluate the effectiveness of currently deployed access control policies. Network security information includes data generated by the firewall using the currently deployed access control policy for control within a preset time period.

[0063] Specifically, the log collection frequency and type can be set by configuring the firewall log collection module. When the firewall is working, it records the suspicious traffic intercepted, the normal traffic that has passed, and the abnormal alarm log. Then, a machine learning algorithm is used to classify and analyze the collected data to generate network security indicators, such as the proportion of suspicious traffic detected, the number of attack traffic that failed to be successfully intercepted, etc. Among them, the machine learning algorithm can be a classification model based on a support vector machine or a decision tree.

[0064] S202. Update the access control policy deployed in the firewall according to the network security index.

[0065] In a complex network environment, a single access control policy may not be able to cope with the changing attack patterns, so it is necessary to analyze the effectiveness of the policy based on network security indicators. Specifically, we can define evaluation indicators for the effectiveness of access control policies, such as the ratio of blocking malicious traffic, i.e., security, or the rate of normal traffic passing through the operation, i.e., efficiency. Then, we use the evaluation function in reinforcement learning to generate reward values ​​based on network security information. For example, a strategy that efficiently blocks malicious traffic will receive a high reward, or a strategy that blocks normal traffic will be punished. Finally, by combining the above reward values, we can get the comprehensive score of the current access control policy, which can be used as the evaluation result of its effectiveness.

[0066] Secondly, based on the effectiveness evaluation results, the existing access control policies can be optimized and new policies can be deployed in real time. Specifically, the network security indicators are used as input through the reinforcement learning algorithm; then the policy update goals are set, such as maximizing the blocking rate of malicious traffic and minimizing the false interception rate of normal traffic. Then, in the algorithm training phase, multiple policy candidates are generated and simulated tests are performed to record the performance of different policies in the attack environment. Finally, the updated policy is determined and hot deployed on the firewall, thereby achieving seamless switching of access control policies.

[0067] The network access control policy management method provided in the embodiment of the present application aims to meet the needs of network security protection. It proposes a management method for collecting firewall network security information, analyzing the effectiveness of current policies, and updating access control policies in real time. It generates security indicators through machine learning analysis of network security information, and combines reinforcement learning algorithms to dynamically optimize and deploy policies, thereby effectively improving the firewall's defense capabilities against unknown threats and management efficiency.

[0068] Figure 3 The flowchart of the second embodiment of the network access control policy management method provided by this application is as follows. Figure 3 As shown, in Figure 2 Based on the embodiment, before collecting network security information of the firewall within a preset time period and analyzing the network security information according to the machine learning technology to obtain the network security index, the method also includes:

[0069] S301: Receive network security requirements configured by a user.

[0070] Among them, user network security requirements usually include the core objectives of access control rules, such as allowing or blocking network access for specific applications, user groups or devices, and priorities for traffic categories. By receiving user requirements, it is possible to ensure that the generation of access control policies accurately matches the actual security requirements.

[0071] Specifically, a user interface or application programming interface (API) can be provided so that users can input network security requirements, such as blocking external IP addresses from accessing the server of the internal database or limiting access to sensitive information by specific user groups. The network security requirements input by users are then analyzed and converted into policy rule templates for subsequent access control policy updates.

[0072] S302: Generate an access control policy based on network security requirements, pre-acquired network topology relationships, and control policy generation rules.

[0073] The generation of access control policies requires not only the security requirements input by users, but also the actual topology of the network, the relationship between devices, and the advantages and disadvantages of historical control policies. Specifically, the network topology relationship is a topological relationship obtained by classifying and associating network devices, users, applications, and IP addresses based on the network device information, user information, application information, and IP addresses in historical data.

[0074] In this embodiment, the network topology relationship can be obtained through the following steps: extract relevant information of network devices (such as routers, firewalls), users (such as employees, administrators), applications (such as trading systems) and IP addresses from historical data. Then, a topology map is constructed based on this information to classify and associate devices, users, applications and IP addresses. For example, for classification, the internal IP segment of the bank can be distinguished from the external IP segment, and for association, a specific IP can be bound to a user group or device.

[0075] The step of generating access control policies may include: automatically generating policies that conform to the network topology structure in combination with generation rules according to the user's network security needs, wherein the generation rules may be rules that allow internal communication by default or block external access by default. For example, when the user's needs are to restrict external IPs from accessing the internal trading system, the generation rules may be: if the user's IP belongs to the trading system, then block access from source IPs that belong to the external range. Finally, introduce machine learning algorithms to identify potential risk points through historical data analysis, and optimize policy generation rules to improve network access security and efficiency.

[0076] S303: Send the access control policy to the firewall for deployment.

[0077] After the policy is generated, it needs to be deployed to the firewall quickly so that the access control policy can take effect immediately and achieve real-time control of network traffic. Specifically, the generated access control policy is converted into a policy language or instruction set that can be executed by the firewall, and then the access control policy is sent to the target firewall device through the firewall management interface. Finally, after the policy is deployed on the firewall, a preliminary test is run to ensure that the access control policy has started to work. For example, the test can prevent unauthorized access or verify whether the network performance meets expectations.

[0078] The embodiment of the present application improves the process of implementing the access control policy on the basis of embodiment one, wherein the security requirements configured by the user ensure the accuracy of the policy; secondly, the automated policy generation process based on network topology relationships and control policy generation rules improves efficiency; finally, the rapid deployment of the policy realizes real-time network security management capabilities, providing a reliable initial policy foundation for subsequent acquisition and optimization.

[0079] Figure 4 The flowchart of the third embodiment of the network access control policy management method provided by this application is as follows. Figure 4 As shown, in Figure 2 Based on the embodiment, the network security information is analyzed according to the machine learning technology to obtain the network security index, and the method also includes:

[0080] S401. Use the pre-acquired policy analysis model to analyze and process network security information to obtain network security indicators.

[0081] Among them, network security information network security information includes five key data sources, which are used to comprehensively reflect the network status and the effectiveness of access control policies, including: network traffic data, which is used to describe the traffic distribution in different time periods in the network, such as traffic size, traffic source and target IP, etc., which helps to evaluate the impact of policies on normal business traffic; security event logs, including attack events intercepted by firewalls, alarms triggered by intrusion detection systems, etc., which can be used to measure the attack interception capability of the current policy; user behavior records, which are used to track users' access behavior to network resources, such as access frequency, access time and access targets, which can reveal abnormal user behavior; policy hit counts, which are used to count the number of times different access control policies are triggered, so as to reflect the actual frequency and criticality of policy use; policy coverage, which is used to measure the degree of adaptation of existing policies to all traffic and user behaviors, so as to indicate whether there are blind spots or insufficient coverage of the policy.

[0082] In addition, the network security indicators can be generated by using machine learning algorithms to conduct in-depth analysis of the above network security information. Specifically, the policy analysis model is first pre-trained, for example, using historical network security data as training data, and using supervised learning algorithms or deep learning models to establish an analysis model to build an indicator model that can evaluate the effectiveness of access control policies. Then the collected network security information is cleaned and standardized, for example, network traffic data is converted into features such as traffic type and peak time period, and then user behaviors are clustered to generate normal behavior patterns and abnormal behavior patterns. Finally, the cleaned network security information is input into the policy analysis model to generate network security indicators, including malicious traffic interception rate, false alarm rate, coverage rate, and policy utilization efficiency. Among them, the malicious traffic interception rate represents the proportion of malicious traffic intercepted by the current policy, which is used to reflect the security of the policy; the false alarm rate represents the probability that the policy incorrectly blocks normal traffic, which is used to reflect the accuracy of the policy; the coverage rate refers to the coverage of all traffic or behaviors by the policy, which is used to reflect the comprehensiveness of the policy; the policy utilization efficiency refers to the ratio of the number of policy hits to the total number of visits, which is used to reflect whether the policy is efficient.

[0083] In the embodiment of the present application, by introducing a policy analysis model based on machine learning, security indicators are automatically extracted from multi-dimensional network security information, making the evaluation of access control policies more accurate and intelligent. This method can not only identify loopholes in the current policy, but also respond to complex and changing network threats in real time, significantly improving network protection capabilities and management efficiency.

[0084] Figure 5This is a flow chart of the fourth embodiment of the network access control policy management method provided by this application. Figure 5 As shown, in Figure 3 Based on the embodiment, according to the network security requirements, as well as the pre-acquired network topology relationship and control policy generation rules, an access control policy is generated, including:

[0085] S501: Determine access topology corresponding to network security requirements according to network security requirements and network topology relationships.

[0086] When generating access control policies, the access topology is accurately determined and corresponding policies are generated by combining network security requirements, network topology relationships and control policy generation rules.

[0087] Specifically, the access topology is the core foundation for generating access control policies. It describes the access path in the network that meets the user's network security needs, and the access topology includes at least one network access path. Exemplarily, the target access object (such as a specific IP address, server or subnet) and access restriction conditions (such as the source of allowed access or the type of restricted protocol) are extracted from the security requirements input by the user. Then, based on the pre-acquired network topology relationship, the access path that meets the requirements is screened out. For example, the network topology contains devices including firewalls, routers, and switches. The classified association information includes that users of the internal IP segment are associated with subnet A, and external traffic enters subnet A through router R1. The access topology is determined based on the above information. Finally, the access topology data structure is generated. The access path can be described using a graph data structure (such as nodes representing network devices and edges representing connection relationships) to clarify the nodes and data flows that need to be controlled.

[0088] S502: Generate an access control policy according to the control policy generation rules and the access topology.

[0089] Based on the access topology, the access control policy is dynamically generated in combination with the control policy generation rules. Specifically, the access control policy is generated by matching the preset rule base (such as blocking external traffic from accessing intranet resources by default). For example, if the path contains an external network, access is blocked by default. If the path involves sensitive resources (such as database servers), the access protocol is restricted to HTTPS. Then, based on the network nodes involved in the access topology, the generated rules are converted into a policy format that can be recognized by the firewall. Finally, combined with historical data or traffic statistics, the generated access control policies are simplified and merged to avoid rule redundancy and conflicts. For example, multiple rules are merged to reduce the processing burden of the device or optimize the priority to ensure that key rules are matched first.

[0090] The embodiment of the present application determines the access topology and automatically generates the access control policy based on the control policy generation rules, which can accurately match the user's network security needs, dynamically adapt to the changes in the network topology to ensure that the policy covers all access paths that need to be controlled, achieve efficient policy generation, significantly reduce the complexity of network management, and lay a solid foundation for subsequent policy evaluation and optimization.

[0091] Figure 6 The flowchart of the fifth embodiment of the network access control policy management method provided by this application is as follows. Figure 6 As shown, in Figure 3 Examples and Figure 5 Based on the embodiment, the access control policy is sent to the firewall for deployment, including:

[0092] S601, communicating with the firewall using a network configuration protocol, and sending the access control policy to the firewall for deployment through an API call.

[0093] Existing network firewalls usually support standardized network configuration protocols or proprietary API interfaces for remote management and configuration of devices. Through these interfaces, policies can be deployed automatically, reducing the risk and time of manual configuration.

[0094] In an embodiment of the present application, a network configuration protocol can be used to establish communication, wherein the network configuration protocol can select a protocol supported by the current firewall, and then select an appropriate communication method to initialize communication, and establish a secure communication channel to protect communication data by configuring the management interface of the firewall. Then, the API interface is formatted, and the generated access control policy is converted into the format required by the firewall API interface, and then the API interface is called, for example, a Hypertext Transfer Protocol (HTTP) request is sent through a programming language or a network management tool to transfer the policy data to the firewall. Finally, check the status code or response data returned by the API to confirm whether the policy is successfully deployed.

[0095] The embodiments of the present application can achieve efficient, accurate and secure access control policy management by adopting a policy deployment method of network configuration protocol and API call, thereby meeting the needs of modern network security management.

[0096] Figure 7 This is a flow chart of the sixth embodiment of the network access control policy management method provided by this application. Figure 7 As shown, in Figures 3 to 5 Based on the embodiment, the method further includes:

[0097] S701. If an access anomaly is detected or the network security indicator indicates that the access control policy is invalid, the last valid access control policy deployed in the backup file is used to replace the currently deployed access control policy.

[0098] The backup file stores each deployed access control policy. When an access anomaly is detected or network security indicators indicate that the current access control policy is invalid, in order to avoid further damage to network security or business termination, the last verified effective policy in the backup file can be automatically switched.

[0099] Specifically, the network access status and security indicators are continuously monitored. If any of the following situations occurs: critical business traffic is blocked, malicious traffic is not effectively intercepted, or security indicators are lower than the preset threshold, the most recently deployed effective policy needs to be retrieved from the backup file, where the backup file includes the complete rule set, metadata, etc. of the policy. Then the effective policy is used to replace the currently deployed policy, and the effective policy is loaded into the firewall as a backup policy. After the deployment is complete, the network access status and network security indicators are re-evaluated to confirm that the backup policy has restored normal access and security.

[0100] S702: If an access anomaly is detected or the network security indicator indicates that the access control policy is invalid, a policy anomaly indication is pushed.

[0101] In this step, when an access anomaly is detected or the access control policy is invalid, in addition to automatically switching the policy, the anomaly information can also be pushed to the administrator to provide more fine-grained management control.

[0102] For example, when a specific event that triggers the invalidation of a policy is captured, such as the number of blocked legitimate traffic or the number of abnormal traffic that is not blocked, abnormal indication information is generated, such as the reason why the current policy is invalid or a list of alternative backup policies and their historical performance. Then, the abnormal indication is sent to the user through the interface, mobile device notification or email, or the real-time access control policy status is provided, such as policy failure.

[0103] S703: In response to the user's selection operation, the currently deployed access control policy is replaced with the valid access control policy selected by the user.

[0104] After receiving the policy anomaly indication, the user is allowed to manually select the appropriate policy in the backup file for recovery according to the actual situation, so as to achieve the flexibility of manual intervention and policy adjustment. For example, a list of all available policies in the backup file is displayed on the display interface, including the policy version number, deployment time, and corresponding network indicators. The user selects the appropriate backup policy according to the interface prompts, and then submits the selection, and the user's selected policy can be loaded onto the firewall, replacing the currently invalid policy, and then the network status is evaluated again to ensure the normal operation of the new policy.

[0105] The embodiment of the present application describes that before each policy deployment, the current effective policy will be automatically saved to a backup file, and then cloud storage and other methods are used to ensure that the backup file is always available. The current policy can be automatically switched to the backup policy or the user can manually initiate the switch, thereby improving the management flexibility of the access control side policy and avoiding business interruptions or security risks caused by policy failure.

[0106] Figure 8 The flowchart of the seventh embodiment of the network access control policy management method provided by this application is as follows. Figure 8 As shown, in Figures 3 to 5 Based on the embodiment, the method further includes:

[0107] S801. In response to a policy clearing operation by a user, the access control policy deployed in the firewall is deleted.

[0108] When the access control policy needs to be completely adjusted or the network environment is disrupted due to configuration errors, users can delete all access control policies currently deployed in the firewall through policy clearing operations and restore the firewall to the default state.

[0109] Specifically, the clearing instructions selected by the user are received through the user interface or remote API, and the options corresponding to the clearing instructions may include clearing a single policy, clearing all currently deployed access control policies, or clearing the policy process. Then, before executing the clearing operation selected by the user, the user's identity and permissions need to be verified to ensure that only authorized users can perform this operation. Then, the firewall management interface is called to send an instruction to delete the policy, for example, using the API interface to send a deletion request. After deleting the corresponding access control policy, the firewall can be restored to the default state, for example, enabling the default rules for allowing or blocking traffic. After the policy clearing is completed, the clearing operation results are fed back to the user, such as the number of successfully cleared policy entries or the current default policy state of the firewall.

[0110] The embodiment of the present application quickly deletes the currently deployed access control policy through a user-triggered clearing operation, provides a clear starting point for policy resetting or reconfiguration, and supports users to quickly clean up erroneous policies to avoid further spread of network problems caused by incorrect configurations. Therefore, by combining the clearing operation with the default policy, it is ensured that network communications are not interrupted after the policy is cleared.

[0111] Fig. 9 A schematic diagram of the structure of a network access control policy management device provided in an embodiment of the present application. Fig. 9 As shown, the network access control policy management device 90 includes a network security indicator obtaining module 901 and an access control policy updating module 902, wherein:

[0112] The network security indicator acquisition module 901 is used to collect the network security information of the firewall within a preset time period, and analyze the network security information based on machine learning technology to obtain the network security indicator. The network security indicator is used to evaluate the effectiveness of the currently deployed access control policy. The network security information includes the data generated by the firewall within the preset time period using the currently deployed access control policy for control.

[0113] The access control policy updating module 902 is used to update the access control policy deployed in the firewall according to network security indicators.

[0114] Furthermore, the network security indicator obtaining module 901 is also specifically used for:

[0115] Receive network security requirements configured by users;

[0116] Generate access control policies based on network security requirements, pre-acquired network topology relationships and control policy generation rules; where the network topology relationship is a topology relationship obtained by classifying and associating network devices, users, applications, and IP addresses based on network device information, user information, application information, and IP addresses in historical data;

[0117] Send the access control policy to the firewall for deployment.

[0118] Furthermore, the network security indicator obtaining module 901 is also specifically used for:

[0119] Use the pre-acquired strategy analysis model to analyze and process network security information to obtain network security indicators;

[0120] Among them, the policy analysis model is a model based on the indicator values ​​of network traffic, security events, user behavior, and policy usage requests obtained through training based on machine learning algorithms to evaluate the effectiveness of access control policies.

[0121] Network security information includes network traffic data, security event logs, user behavior records, policy hit counts, and policy coverage;

[0122] Furthermore, the network security indicator obtaining module 901 is also specifically used for:

[0123] Determine an access topology corresponding to the network security requirement according to the network security requirement and the network topology relationship, wherein the access topology includes at least one network access path;

[0124] Generate access control policies based on control policy generation rules and access topology.

[0125] Furthermore, the access control policy updating module 902 is also specifically used for:

[0126] It uses the network configuration protocol to communicate with the firewall and sends the access control policy to the firewall for deployment through API calls.

[0127] Furthermore, the access control policy updating module 902 is also specifically used for:

[0128] If access anomalies are detected or network security indicators indicate that the access control policy is invalid, the last valid access control policy deployed in the backup file is used to replace the currently deployed access control policy;

[0129] or,

[0130] If access anomalies are detected or network security indicators indicate that the access control policy is invalid, a policy anomaly indication is pushed;

[0131] In response to a selection operation by a user, replacing a currently deployed access control policy with a valid access control policy selected by the user;

[0132] The backup file stores the access control policy for each deployment.

[0133] Furthermore, the access control policy updating module 902 is also specifically used for:

[0134] In response to the user's policy clearing operation, the access control policy deployed in the firewall is deleted.

[0135] Fig.10 This is a schematic diagram of the structure of an electronic device provided in an embodiment of the present application. Fig.10 As shown, the electronic device 100 includes:

[0136] The electronic device 100 may include a processor 1001 with one or more processing cores, a memory 1002 with one or more computer-readable storage media, a communication component 1003 and other components. The processor 1001, the memory 1002 and the communication component 1003 are connected via a bus 1004.

[0137] In a specific implementation process, at least one processor 1001 executes the computer execution instructions stored in the memory 1002, so that at least one processor 1001 executes the above network access control policy management method.

[0138] The specific implementation process of the processor 1001 can be found in the above method embodiment, and its implementation principle and technical effect are similar, so this embodiment will not be repeated here.

[0139] In the above Fig.10 In the illustrated embodiment, it should be understood that the processor may be a central processing unit (CPU), or other general-purpose processors, digital signal processors (DSP), application-specific integrated circuits (ASIC), etc. A general-purpose processor may be a microprocessor or any conventional processor, etc. The steps of the method disclosed in the invention may be directly implemented as being executed by a hardware processor, or may be executed by a combination of hardware and software modules in the processor.

[0140] The memory may include a high-speed memory (Random Access Memory, RAM), and may also include a non-volatile memory (NVM), such as at least one disk storage.

[0141] The bus can be an Industry Standard Architecture (ISA) bus, a Peripheral Component Interconnect (PCI) bus, or an Extended Industry Standard Architecture (EISA) bus, etc. The bus can be divided into an address bus, a data bus, a control bus, etc. For ease of representation, the bus in the drawings of this application is not limited to only one bus or one type of bus.

[0142] A person of ordinary skill in the art will appreciate that all or part of the steps in the various methods of the above embodiments may be completed by instructions, or by controlling related hardware through instructions. The instructions may be stored in a computer-readable storage medium and loaded and executed by a processor.

[0143] To this end, an embodiment of the present application provides a computer-readable storage medium, in which a plurality of instructions are stored. The instructions can be loaded by a processor to execute the steps in any one of the network access control policy management methods provided in the embodiments of the present application.

[0144] The storage medium may include: a read-only memory (ROM), a random access memory (RAM), a magnetic disk or an optical disk, etc.

[0145] According to one aspect of the present application, a computer program product or a computer program is provided. The computer program product or the computer program comprises computer instructions stored in a computer-readable storage medium.

[0146] Those skilled in the art will readily appreciate other embodiments of the present application after considering the specification and practicing the invention disclosed herein. The present application is intended to cover any modification, use or adaptation of the present application, which follows the general principles of the present application and includes common knowledge or customary techniques in the art that are not disclosed in the present application. The specification and examples are intended to be exemplary only, and the true scope and spirit of the present application are indicated by the following claims.

[0147] It should be understood that the present application is not limited to the precise structures that have been described above and shown in the drawings, and that various modifications and changes may be made without departing from the scope thereof. The scope of the present application is limited only by the appended claims.

Claims

1. A network access control policy management method, characterized in that: include: Collecting network security information of the firewall within a preset time period, and analyzing the network security information according to machine learning technology to obtain network security indicators, wherein the network security indicators are used to evaluate the effectiveness of the currently deployed access control policy, and the network security information includes data generated by the firewall using the currently deployed access control policy for control within the preset time period; The access control policy deployed in the firewall is updated according to the network security indicator.

2. The method according to claim 1, characterized in that Before collecting network security information of the firewall within a preset time period and analyzing the network security information according to machine learning technology to obtain network security indicators, the method further includes: Receive network security requirements configured by users; Generate an access control policy based on the network security requirements, the pre-acquired network topology relationship and the control policy generation rules; wherein the network topology relationship is a topology relationship obtained by classifying and associating network devices, users, applications and IP addresses based on the network device information, user information, application information and IP addresses in the historical data; The access control policy is sent to the firewall for deployment.

3. The method according to claim 1, characterized in that The network security information includes network traffic data, security event logs, user behavior records, policy hit counts, and policy coverage; The analyzing the network security information according to the machine learning technology to obtain the network security indicators includes: Using the pre-acquired strategy analysis model, the network security information is analyzed and processed to obtain the network security indicator; Among them, the policy analysis model is a model based on the index value of evaluating the effectiveness of the access control policy based on network traffic, security events, user behavior, and policy usage requests obtained through training based on a machine learning algorithm.

4. The method according to claim 2, characterized in that: The step of generating an access control policy according to the network security requirements, the pre-acquired network topology relationship and the control policy generation rules includes: Determine, according to the network security requirement and the network topology relationship, an access topology corresponding to the network security requirement, wherein the access topology includes at least one network access path; The access control policy is generated according to the control policy generation rule and the access topology.

5. The method according to claim 2 or 4, characterized in that: Sending the access control policy to the firewall for deployment includes: A network configuration protocol is used to communicate with the firewall, and the access control policy is sent to the firewall for deployment through an API call.

6. The method according to any one of claims 1 to 4, characterized in that: The method further comprises: If an access anomaly is detected or the network security indicator indicates that the access control policy is invalid, the last valid access control policy deployed in the backup file is used to replace the currently deployed access control policy; or, If an access anomaly is detected or the network security indicator indicates that the access control policy is invalid, a policy anomaly indication is pushed; In response to a selection operation by a user, replacing a currently deployed access control policy with a valid access control policy selected by the user; The backup file stores the access control policy for each deployment.

7. The method according to any one of claims 1 to 4, characterized in that: The method further comprises: In response to a policy clearing operation by a user, the access control policy deployed in the firewall is deleted.

8. A network access control policy management device, characterized in that: include: A network security index obtaining module is used to collect network security information of the firewall within a preset time period, and analyze the network security information according to machine learning technology to obtain network security indicators, wherein the network security indicators are used to evaluate the effectiveness of the currently deployed access control policy, and the network security information includes data generated by the firewall using the currently deployed access control policy for control within the preset time period; An access control policy updating module is used to update the access control policy deployed in the firewall according to the network security indicator.

9. An electronic device, characterized in that: include: A processor, and a memory communicatively connected to the processor; The memory stores computer-executable instructions; The processor executes the computer-executable instructions stored in the memory to implement the method according to any one of claims 1 to 7.

10. A computer-readable storage medium, characterized in that: The computer-readable storage medium stores computer-executable instructions, which are used to implement the method according to any one of claims 1 to 7 when executed by a processor.

Images