Network access control policy management method, apparatus, device, and medium

Abstract

The application provides a network access control policy management method, device, equipment and medium. The method comprises the following steps: collecting network security information of a firewall in a preset time period, and analyzing the network security information according to a machine learning technology to obtain a network security index, wherein the network security index is used to evaluate the effectiveness of a currently deployed access control policy, and the network security information comprises data generated by the firewall in the preset time period and controlled by the currently deployed access control policy; and updating the access control policy deployed in the firewall according to the network security index. According to the technical scheme, the network access information is monitored, the network access control policy is updated in real time, and the network access security is improved.

Description

TECHNICAL FIELD

[0001] The present application relates to the technical field of network security, and particularly relates to a network access control policy management method and device, equipment and a medium. BACKGROUND

[0002] With the informatization development of banking business, more and more financial services rely on the Internet and internal networks. This highly network-dependent operation mode makes the banking industry a key target of network security attacks. Network attacks are increasingly complex and varied, and these attacks not only may steal sensitive data, but also may interfere with the normal operation of banking business, causing huge economic losses and reputation damage.

[0003] Currently, the banking industry mainly relies on traditional network firewalls and intrusion detection systems to protect network security, and these systems usually identify and block potential threats based on a predefined rule base.

[0004] However, traditional network firewalls and intrusion detection systems mainly rely on fixed rule sets, which are difficult to effectively deal with the evolving network security threats, reducing the network security of banks. SUMMARY

[0005] The present application provides a network access control policy management method, device, equipment and medium to solve the problem that traditional network firewalls and intrusion detection systems mainly rely on fixed rule sets, which are difficult to effectively deal with the evolving network security threats.

[0006] In a first aspect, the present application provides a network access control policy management method, comprising:

[0007] Collecting network security information of a firewall in a preset time period, and analyzing the network security information according to a machine learning technology to obtain a network security index, the network security index being used to evaluate the effectiveness of a currently deployed access control policy, the network security information including data generated by the firewall using the currently deployed access control policy for control in the preset time period;

[0008] According to the network security index, updating the access control policy deployed in the firewall.

[0009] Further, before collecting network security information of a firewall in a preset time period, and analyzing the network security information according to a machine learning technology to obtain a network security index, the method further comprises:

[0010] Receiving a network security requirement configured by a user;

[0011] generate the access control policy according to the network security requirement and the pre-acquired network topology relationship and control policy generation rule, wherein the network topology relationship is a topology relationship obtained by classifying and associating network devices, users, application programs and IP based on network device information, user information, application program information and IP addresses in historical data;

[0012] send the access control policy to the firewall for deployment.

[0013] Further, the network security information includes network traffic data, security event logs, user behavior records, policy hit numbers and policy coverage degrees.

[0014] The network security information is analyzed according to the machine learning technique to obtain network security indexes, including:

[0015] The network security information is analyzed and processed by using a pre-acquired policy analysis model to obtain the network security indexes.

[0016] The policy analysis model is a model based on network traffic, security events, user behaviors, policy usage request and evaluation of access control policy effectiveness index values, which is trained based on a machine learning algorithm.

[0017] Further, the access control policy is generated according to the network security requirement and the pre-acquired network topology relationship and control policy generation rule, including:

[0018] The access topology corresponding to the network security requirement is determined according to the network security requirement and the network topology relationship, and the access topology includes at least one network access path.

[0019] The access control policy is generated according to the control policy generation rule and the access topology.

[0020] Further, the access control policy is sent to the firewall for deployment, including:

[0021] The network configuration protocol is used to communicate with the firewall, and the access control policy is sent to the firewall for deployment through API calling.

[0022] Further, the method further includes:

[0023] If it is detected that the access is abnormal or the network security index indicates that the access control policy is invalid, the last deployed valid access control policy in the backup file is used to replace the currently deployed access control policy.

[0024] Or,

[0025] If the access anomaly is detected or the network security indicator indicates that the access control policy is invalid, a policy anomaly indication is pushed;

[0026] In response to a selection operation of a user, the valid access control policy selected by the user is used to replace the currently deployed access control policy;

[0027] The backup file stores the access control policy deployed each time.

[0028] Further, the method further comprises:

[0029] In response to a policy clearing operation of a user, the access control policy deployed in the firewall is deleted.

[0030] In a second aspect, the present application provides a network access control policy management device, comprising:

[0031] A network security indicator obtaining module is configured to collect network security information of the firewall in a preset time period, and analyze the network security information according to a machine learning technology to obtain a network security indicator, the network security indicator being used to evaluate the effectiveness of the currently deployed access control policy, the network security information including data generated by the firewall in the preset time period when the currently deployed access control policy is used for control;

[0032] An access control policy updating module is configured to update the access control policy deployed in the firewall according to the network security indicator.

[0033] In a third aspect, the present application provides an electronic device, comprising a processor and a memory connected with the processor in communication;

[0034] The memory stores computer execution instructions.

[0035] The processor executes the computer execution instructions stored in the memory to implement the method of the embodiments of the present application.

[0036] In a fourth aspect, the present application provides a computer readable storage medium, the computer readable storage medium storing computer execution instructions, the computer execution instructions being executed by a processor to implement the method of the embodiments of the present application.

[0037] The network access control policy management method, device, equipment and medium provided by the application, by collecting network security information of a firewall in a preset time period, and analyzing the network security information according to a machine learning technology, obtaining a network security index, the network security index is used to evaluate the effectiveness of the currently deployed access control policy, the network security information includes data generated by the firewall in the preset time period using the currently deployed access control policy for control; according to the network security index, the means for updating the access control policy deployed in the firewall, improves the network security protection capability, and improves the intelligence and adaptability of the network security defense system. BRIEF DESCRIPTION OF DRAWINGS

[0038] The accompanying drawings, which are incorporated herein and form part of the specification, illustrate embodiments consistent with the present application and, together with the description, further serve to explain the principles of the application.

[0039] Figure 1 The architecture schematic diagram of the network access control policy management method provided by the application;

[0040] Figure 2 The flowchart of the network access control policy management method provided by the application embodiment one;

[0041] Figure 3 The flowchart of the network access control policy management method provided by the application embodiment two;

[0042] Figure 4 The flowchart of the network access control policy management method provided by the application embodiment three;

[0043] Figure 5 The flowchart of the network access control policy management method provided by the application embodiment four;

[0044] Figure 6 The flowchart of the network access control policy management method provided by the application embodiment five;

[0045] Figure 7 The flowchart of the network access control policy management method provided by the application embodiment six;

[0046] Figure 8 The flowchart of the network access control policy management method provided by the application embodiment seven;

[0047] Figure 9 The structure schematic diagram of the network access control policy management device provided by the application embodiment;

[0048] Figure 10The structural schematic diagram of the electronic device provided by the embodiment of the present application is shown in the above-mentioned drawings. The specific embodiments of the present application have been shown in the above-mentioned drawings, and will be described in more details hereinafter. These drawings and the description are not intended to limit the scope of the concept of the present application by any means, but to illustrate the concept of the present application to those skilled in the art by referring to the specific embodiments. DETAILED DESCRIPTION

[0049] The exemplary embodiments will be described in detail herein below with reference to the drawings. When the following description refers to the drawings, the same numbers in different drawings represent the same or similar elements unless otherwise indicated. The embodiments described in the following exemplary embodiments do not represent all the embodiments consistent with the present application. Rather, they are merely examples of apparatuses and methods consistent with some aspects of the present application as detailed in the appended claims.

[0050] With the rapid development of banking network business, network security threats are increasingly complex and changeable, and traditional network firewall access control policy management has many deficiencies. The main problems include: the access control policy cannot adapt to zero-day threats and unknown attacks, the policy generation and deployment process lacks intelligent support, abnormal policies are difficult to detect and recover in time, and policy adjustment and cleaning operations require a large amount of manual intervention and are inefficient, which leads to insufficient network security protection capability and significant decline in management efficiency.

[0051] Based on the above technical problems, the inventors propose a network access control policy management method based on reinforcement learning and machine learning technology, which can dynamically generate and deploy access control policies by collecting network security information of the firewall and combining user-configured security requirements and network topology relationships. The method uses a policy analysis model to evaluate policy effectiveness, combines an anomaly detection mechanism to realize automatic policy recovery or push user decision guidance, and supports a policy cleaning function for rapid adjustment, greatly improving network security protection capability and management efficiency.

[0052] The technical solutions of the present application and how the technical solutions of the present application solve the above technical problems will be described in detail below with specific embodiments. The following specific embodiments can be combined with each other, and the same or similar concepts or processes can not be described again in some embodiments. The embodiments of the present application will be described below with reference to the drawings.

[0053] Figure 1 The structural schematic diagram of the network access control policy management method provided by the present application is shown in the above-mentioned drawings. As shown in the above-mentioned drawings, it includes: Figure 1

[0054] ​The overall architecture 100 of the network access control policy management method includes a policy planning stage 101, a policy deployment stage 102, a policy monitoring stage 103, and a policy optimization stage 104. By introducing intelligent technologies such as reinforcement learning, the life cycle of access control policies on network firewall devices is comprehensively managed, thereby improving network security protection capabilities and management efficiency.

[0055] Specifically, in the policy planning stage 101, access control policies are dynamically generated using network topology relationship data and real-time information. At the same time, by labeling the relationship between Internet Protocol (English: Internet Protocol, abbreviated: IP) addresses and network devices, users and application programs, an association with the corresponding access control policies is established, and automatic planning for abnormal traffic is realized. In this way, the system can more flexibly adapt to changes in the network environment, identify potential threats in advance, and effectively prevent security risks.

[0056] Secondly, in the policy deployment stage 102, automated management technology is introduced to realize the automatic issuance, backup, cleaning and rollback of access control policies. This not only simplifies the workflow of network administrators and reduces the possibility of human error, but also improves the response speed and accuracy of policies. Users can more efficiently manage and maintain access control policies to ensure the continuity and stability of network security protection.

[0057] In the policy monitoring stage 103, the effectiveness of access control policies is evaluated according to various indicators to help network administrators adjust and optimize policies in a timely manner to adapt to new security threats. By continuously monitoring network traffic and policy execution, abnormal behavior can be detected in a timely manner and appropriate countermeasures can be provided to improve the real-time performance and accuracy of network security protection.

[0058] Finally, in the policy optimization stage 104, reinforcement learning technology is used to continuously improve access control policies, improving the adaptability and intelligence of the policies. By analyzing historical data and real-time information, the execution efficiency and security of access control policies can be optimized to continuously improve network security protection capabilities and management efficiency.

[0059] In summary, this technical solution realizes the whole life cycle management of access control policies, including planning, deployment, monitoring and optimization of the four key stages, by introducing intelligent technologies such as reinforcement learning. Not only does it reduce the workload of users, but it also enhances the intelligence and adaptability of the entire network security defense system, providing innovative ideas and solutions for the development of network security technology.

[0060] Figure 2 The flowchart of the network access control policy management method embodiment one provided by the present application is shown in Figure 1. Figure 2 As shown in Figure 1, the method comprises:

[0061] S201, collect network security information of the firewall in a preset time period, and analyze the network security information according to a machine learning technology to obtain a network security index.

[0062] Among the bank business network, the traffic distribution is complex and diverse, including transaction, query and other types of business traffic. Collecting these data and analyzing their security is the first step to evaluate the effectiveness of the existing access control strategy. The firewall is a network security device used to monitor and filter data flow in and out of the network, and to prevent unauthorized access according to defined security rules. The network security index can be used to evaluate the effectiveness of the currently deployed access control strategy. The network security information includes data generated by the firewall in a preset time period using the currently deployed access control strategy for control.

[0063] Specifically, the log collection frequency and type can be set by configuring the firewall log collection module. When the firewall is working, it records suspicious traffic, normal traffic that has passed, and abnormal alarm logs that it has intercepted. Then, a machine learning algorithm is used to classify and analyze the collected data to generate network security indexes, such as the proportion of suspicious traffic detected, the number of attack traffic that failed to be successfully intercepted, etc. The machine learning algorithm can be a classification model based on support vector machine or decision tree.

[0064] S202, update the access control strategy deployed in the firewall according to the network security index.

[0065] In a complex network environment, a single access control strategy may not be able to cope with changing attack patterns, so it is necessary to analyze the effectiveness of the strategy according to the network security index. Specifically, the evaluation index of the effectiveness of the access control strategy can be defined, such as the rate of blocking malicious traffic, i.e. security, or the passing rate of normal traffic, i.e. efficiency. Then use the evaluation function in reinforcement learning to generate a reward value according to the network security information, such as a strategy that effectively blocks malicious traffic gets a high reward, or a strategy that blocks normal traffic is punished. Finally, the comprehensive score of the current access control strategy is obtained by integrating the above reward values, which can be used as the evaluation result of its effectiveness.

[0066] Secondly, the existing access control strategy can be optimized according to the evaluation result of the effectiveness, and a new strategy can be deployed in real time. Specifically, the network security index is used as input through the reinforcement learning algorithm; then set the strategy update goal, such as maximizing the blocking rate of malicious traffic, minimizing the misinterception rate of normal traffic. Then in the algorithm training stage, generate multiple strategy candidates and perform simulation testing, record the performance of different strategies in the attack environment. Finally, determine the updated strategy and deploy it on the firewall to realize seamless switching of the access control strategy.

[0067] The network access control policy management method provided by the embodiments of the present application proposes a management method of collecting firewall network security information, analyzing the effectiveness of the current policy, and updating the access control policy in real time, aiming at network security protection needs. The method generates security indicators by analyzing network security information through machine learning, and dynamically optimizes and deploys the policy by combining reinforcement learning algorithm, thereby effectively improving the defense capability and management efficiency of the firewall against unknown threats.

[0068] Figure 3 The flowchart of the second embodiment of the network access control policy management method provided by the present application is shown in FIG. 2. Figure 3 As shown in FIG. 2, based on the embodiments of the present application, the method further comprises the following steps: Figure 2 Before collecting the network security information of the firewall within a preset time period and analyzing the network security information to obtain network security indicators according to the machine learning technology, the method further comprises:

[0069] S301, receiving the network security requirements configured by the user.

[0070] The network security requirements of the user usually include the core target of the access control rule, such as allowing or blocking the network access of a specific application, user group or device, and the priority of the traffic category. By receiving the user requirements, it is possible to ensure that the generated access control policy accurately matches the actual security requirements.

[0071] Specifically, a user interface or application programming interface (full name: Application Programming Interface, abbreviated as API) can be provided to allow the user to input network security requirements, such as blocking external IP access to internal database servers and limiting access to sensitive information by specific user groups. Then the network security requirements input by the user are analyzed and converted into a policy rule template for subsequent updating of the access control policy.

[0072] S302, generating an access control policy according to the network security requirements, and the pre-acquired network topology relationship and control policy generation rule.

[0073] The generation of the access control policy not only needs the security requirements input by the user, but also needs to combine the actual topology structure of the network, the association relationship between devices, and the advantages and disadvantages of the historical control policy. Specifically, the network topology relationship is obtained by classifying and associating the network devices, users, application programs and IP addresses based on the network device information, user information, application program information and IP address in the historical data.

[0074] In this embodiment, network topology relationships can be obtained through the following steps: extracting relevant information about network devices (such as routers and firewalls), users (such as employees and administrators), applications (such as transaction systems), and IP addresses from historical data. Then, a topology map is constructed based on this information, classifying and associating devices, users, applications, and IP addresses. For example, for classification, internal bank IP segments can be distinguished from external IP segments; for association, specific IPs can be bound to user groups or devices.

[0075] The steps for generating access control policies may include: automatically generating policies that conform to the network topology based on the user's network security needs and generated rules. These generated rules can either allow internal communication by default or block external access by default. For example, when the user's requirement is to restrict external IP access to the internal trading system, the generated rule could be: if the user's IP belongs to the trading system, then block access from sources whose IPs are outside the system. Finally, machine learning algorithms are introduced to identify potential risk points through historical data analysis, optimizing the policy generation rules to improve network access security and efficiency.

[0076] S303. Send the access control policy to the firewall for deployment.

[0077] After the policy is generated, it needs to be quickly deployed to the firewall so that the access control policy takes effect immediately, enabling real-time control of network traffic. Specifically, the generated access control policy is translated into a policy language or command set that the firewall can execute. Then, the access control policy is distributed to the target firewall device through the firewall management interface. Finally, after the policy is deployed on the firewall, preliminary tests are run to ensure that the access control policy is working. For example, tests may be conducted to see if unauthorized access is blocked or to verify that network performance meets expectations.

[0078] This application's embodiments improve the access control policy implementation process based on Embodiment 1. Firstly, user-configured security requirements ensure the policy's accuracy. Secondly, the automated policy generation process based on network topology and control policy generation rules improves efficiency. Finally, rapid policy deployment enables real-time network security management capabilities, providing a reliable initial policy foundation for subsequent data collection and optimization.

[0079] Figure 4 This is a flowchart illustrating Embodiment 3 of the network access control policy management method provided in this application. Figure 4 As shown, in Figure 2 Based on the embodiments, the method further includes analyzing network security information using machine learning techniques to obtain network security indicators:

[0080] S401, analyze the network security information by using the pre-acquired policy analysis model to obtain network security indicators.

[0081] The network security information includes five kinds of key data sources for comprehensively reflecting the network state and the effect of the access control policy, including: network traffic data for describing the traffic distribution in different time periods in the network, such as traffic size, traffic source and target IP, which helps to evaluate the influence of the policy on normal traffic; security event logs including attack events intercepted by the firewall, alarms triggered by the intrusion detection system, etc., which can be used to measure the attack interception ability of the current policy; user behavior records for tracking user access behavior to network resources, such as access frequency, access time and access target, which can reveal abnormal user behavior; policy hit number for counting the number of times that different access control policies are triggered to reflect the actual use frequency and key of the policy; and policy coverage degree for measuring the adaptation degree of the existing policy to all traffic and user behavior to indicate whether there is a blind area or insufficient coverage of the policy.

[0082] In addition, the machine learning algorithm is used to deeply analyze each of the above network security information to generate network security indicators. Specifically, first, the policy analysis model is pre-trained, for example, using historical network security data as training data, using a supervised learning algorithm or a deep learning model to establish an analysis model to build an indicator model capable of evaluating the effectiveness of the access control policy. Then, the collected network security information is cleaned and standardized, for example, converting network traffic data into traffic types, peak time periods and other features, and then clustering user behavior to generate normal behavior patterns and abnormal behavior patterns. Finally, the cleaned network security information is input into the policy analysis model to generate network security indicators, including malicious traffic interception rate, false positive rate, coverage rate, and policy use efficiency, wherein the malicious traffic interception rate represents the proportion of malicious traffic intercepted by the current policy, which is used to reflect the security of the policy; the false positive rate represents the probability that the policy incorrectly prevents normal traffic, which is used to reflect the accuracy of the policy; the coverage rate refers to the coverage degree of the policy to all traffic or behavior, which is used to reflect the comprehensiveness of the policy; and the policy use efficiency refers to the ratio of policy hit number to total access volume, which is used to reflect whether the policy is efficient.

[0083] In the embodiments of the present application, a policy analysis model based on machine learning is introduced to automatically extract security indicators from multi-dimensional network security information, making the evaluation of the access control policy more accurate and intelligent. This method not only identifies the vulnerabilities of the current policy, but also responds to complex and variable network threats in real time, significantly improving the network protection capability and management efficiency.

[0084] Figure 5This is a flowchart illustrating Embodiment 4 of the network access control policy management method provided in this application. Figure 5 As shown, in Figure 3 Based on the implementation examples, and according to network security requirements, as well as pre-acquired network topology relationships and control policy generation rules, an access control policy is generated, including:

[0085] S501. Based on network security requirements and network topology, determine the access topology corresponding to the network security requirements.

[0086] When generating access control policies, the access topology is accurately determined and corresponding policies are generated by combining network security requirements, network topology relationships, and control policy generation rules.

[0087] Specifically, access topology is the core foundation for generating access control policies. It describes the access paths in the network that meet the user's network security requirements, and includes at least one network access path. For example, the target access object (such as a specific IP address, server, or subnet) and access restrictions (such as allowed sources or restricted protocol types) are extracted from the user's input security requirements. Then, based on the pre-acquired network topology relationships, access paths that meet the requirements are selected. For instance, the network topology includes devices such as firewalls, routers, and switches, and the classification association information includes users of internal IP ranges being associated with subnet A, and external traffic entering subnet A through router R1. The access topology is determined based on this information. Finally, an access topology data structure is generated. A graph data structure (such as nodes representing network devices and edges representing connections) can be used to describe the access paths, clearly defining the nodes and data flows that need to be controlled.

[0088] S502. Generate an access control policy based on the control policy generation rules and access topology.

[0089] Based on the access topology, access control policies are dynamically generated by combining control policies with rule generation. Specifically, access control policies are generated by matching pre-defined rule bases (such as blocking external traffic from accessing internal network resources by default). For example, if the path contains external networks, access is blocked by default; if the path involves sensitive resources (such as database servers), the access protocol is restricted to HTTPS. Then, based on the network nodes involved in the access topology, the generated rules are converted into a policy format that the firewall can recognize. Finally, by combining historical data or traffic statistics, the generated access control policies are simplified and merged to avoid rule redundancy and conflicts. For example, multiple rules are merged to reduce the processing burden on the device or optimize priority to ensure that critical rules are matched first.

[0090] The embodiment of the application determines an access topology and automatically generates an access control policy based on a control policy to match the network security requirements of a user, dynamically adapt to changes in the network topology, ensure that the policy covers all access paths that need to be controlled, efficiently generate the policy, significantly reduce the complexity of network management, and lay a solid foundation for subsequent policy evaluation and optimization.

[0091] Figure 6 A flowchart of the network access control policy management method embodiment five provided by the application is shown in FIG. 5. Figure 6 As shown in FIG. 5, based on the embodiments of the application, Figure 3 the access control policy is sent to a firewall for deployment, including: Figure 5

[0092] S601, a network configuration protocol is used to communicate with the firewall, and the access control policy is sent to the firewall for deployment through API calling.

[0093] Existing network firewalls usually support standardized network configuration protocols or proprietary API interfaces for remote management and configuration of devices. Through these interfaces, the automatic deployment of the policy can be realized, and the risk and time of manual configuration can be reduced.

[0094] In the embodiment of the application, a network configuration protocol can be used to establish communication, wherein the network configuration protocol can be selected from the protocols supported by the current firewall, and then a suitable communication method is selected to initialize communication. A secure communication channel is established through the management interface of the firewall to protect the communication data. Then, the API interface is formatted, the generated access control policy is converted into the format required by the firewall API interface, and then the API interface is called, for example, a HyperText Transfer Protocol (HTTP) request is sent through a programming language or a network management tool to transmit the policy data to the firewall. Finally, the status code or response data returned by the API is checked to confirm whether the policy is successfully deployed.

[0095] The policy deployment method using the network configuration protocol and API calling in the embodiment of the application can efficiently, accurately and safely manage the access control policy, and meet the needs of modern network security management.

[0096] Figure 7 A flowchart of the network access control policy management method embodiment six provided by the application is shown in FIG. 6. Figure 7 As shown in FIG. 6, based on the embodiment of the application, Figures 3 to 5 the method further includes:

[0097] ​S701, if the access anomaly or the network security indicator indicates that the access control policy is invalid, replacing the currently deployed access control policy with the last deployed valid access control policy in the backup file.

[0098] The backup file stores each deployed access control policy. When the access anomaly or the network security indicator indicates that the current access control policy is invalid, to avoid further network security damage or business terminal, the last verified valid policy in the backup file can be automatically switched to.

[0099] Specifically, the network access status and security indicators are monitored uninterruptedly. If any of the following conditions occurs, the last deployed valid policy is retrieved from the backup file, which includes the complete rule set, metadata, etc. of the policy. Then the valid policy is used to replace the currently deployed policy, and the valid policy is loaded as a backup policy to the firewall. After deployment, the network access status and network security indicators are re-evaluated to confirm that the backup policy restores normal access and security.

[0100] S702, if the access anomaly or the network security indicator indicates that the access control policy is invalid, pushing a policy anomaly indication.

[0101] In this step, when the access anomaly or the invalid access control policy is detected, in addition to automatically switching the policy, the administrator can also be pushed with abnormal information to provide more granular management control.

[0102] Exemplarily, when the specific event triggering the invalid policy is captured, such as the number of blocked legal traffic or the unblocked abnormal traffic, the abnormal indication information is generated, such as the reason information of the current invalid policy or the list of replaceable backup policies and their historical performance. Then the abnormal indication is sent to the user through the interface, mobile device notification or email, or the real-time access control policy state is provided, such as policy invalidation.

[0103] S703, in response to the selection operation of the user, replacing the currently deployed access control policy with the valid access control policy selected by the user.

[0104] After receiving the policy exception indication, the user is allowed to manually select a suitable policy in the backup file for recovery according to the actual situation, so as to realize the flexibility of manual intervention and policy adjustment. Exemplarily, a list of all available policies in the backup file is displayed on the display interface, including the policy version number, the deployment time, and the corresponding network indicators. The user selects a suitable backup policy according to the interface, and then submits the selection, so that the user-selected policy can be loaded onto the firewall to replace the current invalid policy, and then the network state is evaluated again to ensure the normal operation of the new policy.

[0105] The embodiments of the present application describe that before each policy deployment, the current effective policy is automatically saved to a backup file, and then the backup file is ensured to be always available by using cloud storage and the like, and the current policy can be automatically switched to the backup policy or manually switched by the user, so that the management flexibility of the access control side policy is improved, and the business interruption or security risk caused by policy invalidation is avoided.

[0106] Figure 8 The flowchart of the seventh embodiment of the network access control policy management method provided by the present application is shown in FIG. 7. Figure 8 As shown in FIG. 7, Figures 3 to 5 On the basis of the embodiments, the method further includes:

[0107] S801, in response to a policy clearing operation of the user, deleting the access control policy deployed in the firewall.

[0108] When the access control policy needs to be completely adjusted or the network environment is disordered due to configuration errors, the user can delete all the access control policies currently deployed in the firewall through the policy clearing operation, and restore the firewall to the default state.

[0109] Specifically, the user-selected clearing instruction is received through the user interface or the remote API, and the options corresponding to the clearing instruction can include clearing a single policy, clearing all the currently deployed access control policies, or clearing the policy flow. Then, the user identity and the permission are verified before the user-selected clearing operation is executed, so as to ensure that only authorized users can perform this operation. Then, the firewall management interface is called, and the instruction for deleting the policy is sent, for example, the API interface is used to send a deletion request. After the corresponding access control policy is deleted, the firewall can be restored to the default state, for example, the default rules for allowing or blocking traffic are enabled. After the policy clearing is completed, the user is fed back the clearing operation result, for example, the number of successfully cleared policy entries or the current default policy state of the firewall.

[0110] The embodiments of the present application quickly delete the currently deployed access control policy through a user triggered clearing operation, provide a clear starting point for policy resetting or reconfiguration, and support the user to quickly clean up the error policy, thereby avoiding the further spread of network problems caused by the error configuration. Therefore, by combining the clearing operation with the default policy, it is ensured that the network communication after the policy clearing is not interrupted.

[0111] Figure 9 A structural schematic diagram of a network access control policy management device provided by the embodiments of the present application is shown in FIG. 1. As shown in FIG. 1, the network access control policy management device 90 includes a network security index obtaining module 901 and an access control policy updating module 902, wherein, Figure 9

[0112] The network security index obtaining module 901 is configured to collect network security information of the firewall in a preset time period, and analyze the network security information according to a machine learning technology to obtain a network security index. The network security index is used to evaluate the effectiveness of the currently deployed access control policy. The network security information includes data generated by the firewall in the preset time period by using the currently deployed access control policy for control.

[0113] The access control policy updating module 902 is configured to update the access control policy deployed in the firewall according to the network security index.

[0114] Further, the network security index obtaining module 901 is further configured to:

[0115] receive a network security requirement configured by a user;

[0116] generate an access control policy according to the network security requirement, and a pre-acquired network topology relationship and a control policy generation rule. The network topology relationship is a topology relationship obtained by classifying and associating network devices, users, application programs and IP addresses based on network device information, user information, application program information and IP addresses in historical data;

[0117] send the access control policy to the firewall for deployment.

[0118] Further, the network security index obtaining module 901 is further configured to:

[0119] analyze and process the network security information by using a pre-acquired policy analysis model to obtain the network security index;

[0120] The policy analysis model is a model for evaluating the index value of the effectiveness of the access control policy based on network traffic, security events, user behavior and policy use request, which is trained based on a machine learning algorithm.

[0121] ​The network security information includes network traffic data, security event logs, user behavior records, a number of policy hits, and a policy coverage degree.

[0122] Further, the network security indicator obtaining module 901 is further specifically configured to:

[0123] According to the network security requirement and the network topology relationship, an access topology corresponding to the network security requirement is determined, and the access topology includes at least one network access path.

[0124] According to the control policy generation rule and the access topology, an access control policy is generated.

[0125] Further, the access control policy updating module 902 is further specifically configured to:

[0126] The network configuration protocol is used to communicate with the firewall, and the access control policy is sent to the firewall for deployment through API calling.

[0127] Further, the access control policy updating module 902 is further specifically configured to:

[0128] If the access anomaly is detected or the network security indicator indicates that the access control policy is invalid, the last deployed valid access control policy in the backup file is used to replace the currently deployed access control policy.

[0129] Or,

[0130] If the access anomaly is detected or the network security indicator indicates that the access control policy is invalid, a policy anomaly indication is pushed.

[0131] In response to a selection operation of a user, the valid access control policy selected by the user is used to replace the currently deployed access control policy.

[0132] The backup file stores each deployed access control policy.

[0133] Further, the access control policy updating module 902 is further specifically configured to:

[0134] In response to a policy clearing operation of a user, the access control policy deployed in the firewall is deleted.

[0135] Figure 10 The structure schematic diagram of the electronic device provided in the embodiment of the present application is shown in FIG. 1. Figure 10 As shown in FIG. 1, the electronic device 100 includes:

[0136] The electronic device 100 can include a processor 1001 having one or more processing cores, a memory 1002 having one or more computer readable storage media, a communication component 1003, and the like. Among them, the processor 1001, the memory 1002 and the communication component 1003 are connected through a bus 1004.

[0137] In the implementation process, the at least one processor 1001 executes the computer execution instructions stored in the memory 1002, so that the at least one processor 1001 executes the network access control policy management method as described above.

[0138] The specific implementation process of the processor 1001 can refer to the method embodiments described above, which has similar implementation principles and technical effects, and will not be described here.

[0139] In the above Figure 10 In the embodiment shown in the above

[0140] The memory can contain a random access memory (RAM), and can also include a non-volatile memory (NVM), such as at least one disk memory.

[0141] The bus can be an industry standard architecture (ISA) bus, a peripheral component (PCI) bus, or an extended industry standard architecture (EISA) bus, etc. The bus can be divided into an address bus, a data bus, a control bus, etc. For the sake of convenience, the bus in the drawings of the present application does not limit to only one bus or one type of bus.

[0142] Those skilled in the art can understand that all or part of the steps in the various methods of the above embodiments can be completed by instructions, or by related hardware controlled by the instructions, which can be stored in a computer readable storage medium and loaded and executed by a processor.

[0143] To this end, an embodiment of the present application provides a computer readable storage medium, which stores a plurality of instructions capable of being loaded by a processor to execute steps in any of the network access control policy management methods provided by the embodiments of the present application.

[0144] The storage medium can include a read only memory (ROM), a random access memory (RAM), a magnetic disk or an optical disk, etc.

[0145] According to an aspect of the present application, a computer program product or computer program is provided, which comprises computer instructions stored in a computer readable storage medium.

[0146] Other embodiments of the present application will be apparent to those skilled in the art from consideration of the specification and practice of the application disclosed herein. It is intended that the present application cover any and all variations of the application that come within the scope of the general concept of the application. The specification and examples are to be considered exemplary only, with the true scope and spirit of the application indicated by the following claims.

[0147] It should be understood that the application is not limited to the precise construction that has been described above and shown in the accompanying drawings, and that various modifications and changes can be made by those skilled in the art without departing from the scope of the application. The scope of the application is limited only by the appended claims.

Claims

1. A network access control policy management method characterized by, The method comprises the following steps: collecting network security information of a firewall in a preset time period, and analyzing the network security information according to a machine learning technology to obtain a network security index, wherein the network security information includes data generated by the firewall in the preset time period by using a currently deployed access control policy for control; updating the access control policy deployed in the firewall according to the network security index.

2. The method of claim 1, wherein, Before the step of collecting network security information of a firewall in a preset time period, and analyzing the network security information according to a machine learning technology to obtain a network security index, the method further comprises the following steps: receiving a network security requirement configured by a user; generating an access control policy according to the network security requirement, and a pre-acquired network topology relationship and a control policy generation rule, wherein the network topology relationship is a topology relationship obtained by classifying and associating network devices, users, application programs and IP addresses based on network device information, user information, application program information and IP addresses in historical data; sending the access control policy to the firewall for deployment.

3. The method of claim 1, wherein, The network security information includes network traffic data, security event logs, user behavior records, policy hit numbers and policy coverage degrees. The step of analyzing the network security information according to a machine learning technology to obtain a network security index comprises the following steps: analyzing and processing the network security information by using a pre-acquired policy analysis model to obtain the network security index; wherein the policy analysis model is a model for evaluating the effectiveness of an access control policy based on network traffic, security events, user behavior and policy usage request based on a machine learning algorithm.

4. The method of claim 2, wherein, The step of generating an access control policy according to the network security requirement, and a pre-acquired network topology relationship and a control policy generation rule comprises the following steps: determining an access topology corresponding to the network security requirement according to the network security requirement and the network topology relationship, wherein the access topology includes at least one network access path; generating the access control policy according to the control policy generation rule and the access topology.

5. The method according to claim 2 or 4, characterized in that, The step of sending the access control policy to the firewall for deployment comprises the following steps: communicating with the firewall by using a network configuration protocol, and sending the access control policy to the firewall for deployment by API calling.

6. The method according to any one of claims 1 to 4, characterized in that, The method further comprises the following steps: if an access anomaly or a network security index indicating that the access control policy is invalid is detected, replacing the currently deployed access control policy with an effective access control policy deployed last time in a backup file; or, if an access anomaly or a network security index indicating that the access control policy is invalid is detected, pushing a policy anomaly indication; in response to a selection operation of a user, replacing the currently deployed access control policy with an effective access control policy selected by the user; wherein the backup file stores each deployed access control policy.

7. The method according to any one of claims 1 to 4, characterized in that, The method further comprises the following steps: in response to a policy clearing operation of a user, deleting the access control policy deployed in the firewall.

8. A network access control policy management apparatus characterized by comprising: The method comprises the following steps: The network security indicator obtaining module is configured to collect network security information of the firewall in a preset time period, and analyze the network security information according to a machine learning technique to obtain a network security indicator, the network security indicator being used to evaluate effectiveness of a currently deployed access control policy, the network security information including data generated by the firewall in the preset time period and controlled by the currently deployed access control policy; The access control policy updating module is configured to update the access control policy deployed in the firewall according to the network security indicator.

9. An electronic device, comprising: The method comprises: a processor, and a memory connected to the processor in communication; the memory stores computer-executable instructions; the processor executes the computer-executable instructions stored in the memory to implement the method according to any one of claims 1 to 7.

10. A computer-readable storage medium, characterized in that, The computer-readable storage medium stores computer-executable instructions, and the computer-executable instructions are executed by the processor to implement the method according to any one of claims 1 to 7.

Images