Network resource intelligent risk management and control method and system

Abstract

The invention discloses a network resource intelligent risk management and control method and system, and the method comprises the steps: obtaining the network resource pool data of a first object, monitoring the resource state in real time, and adjusting the resource distribution; constructing a network strategy management mechanism based on the network resource pool data, and analyzing a network strategy configuration relationship; and automatically executing configuration of a network policy management mechanism. According to the intelligent risk management and control system for the network resources, the management efficiency of the network resources, the accuracy of strategy configuration and the flexibility of dynamic adjustment are remarkably improved. Through intelligent data acquisition, automatic strategy optimization and batch configuration and deployment, the system can effectively avoid the problems of IP conflicts, strategy redundancy, security risks and the like, and realizes efficient distribution of network resources. The method not only reduces the error rate of manual operation, but also has the capabilities of real-time monitoring and automatic adjustment, and improves the stability and safety of network operation.

Description

Technical Field

[0001] The present invention relates to the technical field of network management and security technology, and specifically to a method and system for intelligent risk management and control of network resources. Background Art

[0002] At present, the review and implementation of network resources and network security strategies by local survey and city bureau science and technology centers are mainly based on manual and experience-based decision-making, and they have failed to use digital means to solve the daily network resource and strategy management work. The main problems are as follows:

[0003] 1. Human subjective factors: Manual audits are easily affected by personal subjective opinions and experience. Different auditors may give different judgments on the same issue, resulting in inconsistent audit results.

[0004] 2. High labor costs. Network resource and security policy audits and commissioning tests require a lot of manpower and time to audit and report, which not only increases the burden of personnel costs, but also requires a lot of time and energy to train relevant practitioners, and human errors cannot be avoided;

[0005] 3. Low scale and efficiency. Due to the limitation of human resource cost and quantity, the traditional manual review method often cannot meet the large-scale review needs. Especially in the context of rapid expansion of information technology, resource and policy approval forms are usually approved in batches on a cycle basis, which makes it difficult to achieve timely and efficient document operation. The approval and activation test cycle of user resource and policy applications is long, resulting in poor user experience.

[0006] 4. Lack of intelligent and automated means. The manual review of resources and the opening of strategies lack the support of intelligent and automated technologies, and it is impossible to fully utilize artificial intelligence, machine learning and other technical means to improve review efficiency and accuracy.

[0007] In response to the above problems, the traditional manual approval method is optimized to use intelligent and automated tools as support. The system allocates system permissions according to different users and roles. Users can apply for IP in the system. Administrators can reasonably open policies based on user applications and query the rationality of IP. The accuracy and timeliness of resource and policy approval are improved to improve the efficiency of network operation and maintenance. Summary of the invention

[0008] In view of the above-mentioned problems, the present invention is proposed.

[0009] Therefore, the technical problem solved by the present invention is: inefficiency and waste of network resource management: in traditional network management methods, resources such as IP addresses, ports, and subnets usually rely on manual management, which is prone to problems such as unreasonable resource allocation, address segment conflicts, and resource waste. The present invention uses an automated management module to scientifically divide and dynamically adjust network resources to ensure efficient use and reasonable allocation of resources.

[0010] As the scale and complexity of the network increase, policy configurations for different business requirements often lead to conflicts and redundancies, reducing network security and performance. The present invention builds a network policy management mechanism to achieve automatic detection and optimization of policies, automatically identify conflicts and redundancies, and generate optimization solutions, thereby reducing configuration conflicts and improving the effectiveness of policies.

[0011] Traditional network policy configuration often requires manual input and operation, which is not only inefficient but also prone to human errors. The automated configuration module of the present invention simplifies the configuration process, reduces manual intervention, and improves the accuracy and efficiency of policy deployment through remote batch deployment and real-time monitoring.

[0012] Existing network management methods are difficult to perceive and respond to changes in network security situations in a timely manner. The present invention uses intelligent data collection and analysis to build a real-time network security situation awareness mechanism, which can dynamically track traffic paths, device status, and policy execution, and timely identify and adjust weak links, thereby improving the real-time and reliability of network security.

[0013] To solve the above technical problems, the present invention provides the following technical solutions: a method for intelligent risk management and control of network resources, comprising: obtaining network resource pool data of a first object, monitoring resource status in real time and adjusting resource allocation;

[0014] Based on the network resource pool data, a network policy management mechanism is constructed, and a network policy configuration relationship is analyzed;

[0015] Automate the configuration of network policy management mechanisms.

[0016] As a preferred solution of the intelligent risk management method for network resources described in the present invention, the adjustment of resource allocation includes dynamically monitoring and optimizing the network resource pool data according to preset network resource allocation rules, automatically detecting the usage status of network resources, and generating and updating the resource usage ledger.

[0017] As a preferred solution of the intelligent risk management method for network resources described in the present invention, the dynamic monitoring includes automatically calculating the resource allocation range according to the address information and usage status in the network resource pool data, establishing a resource pool management system, and detecting resource conflicts or anomalies through matching and verification mechanisms, and providing real-time warnings of potential inconsistent resource configurations.

[0018] As a preferred solution of the intelligent risk management method for network resources described in the present invention, the construction of a network policy management mechanism includes automatically analyzing the dependencies of policy configurations based on network resource pool data and policy configuration rules, detecting conflicts, redundancies or inconsistencies in policies, and generating policy optimization suggestions.

[0019] As a preferred solution of the intelligent risk management method for network resources described in the present invention, the automatic configuration of executing network policies includes generating an adaptive network policy configuration plan, batch deploying policy configurations through a remote interface, and monitoring the configuration status in real time during policy execution, and dynamically adjusting configuration parameters.

[0020] As a preferred solution of the intelligent risk management method for network resources described in the present invention, the automatic analysis of the dependency of policy configuration includes analyzing the firewall policy based on policy attribute information using an intelligent algorithm, automatically detecting duplicate policies and conflicting policies under the same conditions, and generating a policy optimization plan, and supporting automatic export of the results as external files.

[0021] As a preferred scheme of the intelligent risk management method of network resources described in the present invention, wherein: the first object includes but is not limited to, the first object includes but is not limited to, a local area network, a wide area network, a data center network, a cloud computing network and an Internet of Things device network, and the first object may include any network environment with IP address allocation, network policy management and security policy configuration requirements.

[0022] A network resource intelligent risk management and control system, characterized by: including:

[0023] Resource data collection and management module: obtains network resource pool data of the first object, monitors resource status in real time and adjusts resource allocation;

[0024] Network policy building module: based on the network resource pool data, building a network policy management mechanism and analyzing the network policy configuration relationship;

[0025] Network policy automatic configuration module: Automates the configuration of network policy management mechanisms.

[0026] The beneficial effects of the present invention are as follows: through an intelligent automatic management system, dynamic monitoring and optimal allocation of IP addresses, ports and subnets are achieved, ensuring the rational use of resources, effectively reducing resource waste and conflict problems, and improving the overall utilization of network resources.

[0027] A network policy management mechanism has been built that can automatically detect and optimize conflicts or redundancies in policy configuration, making policy configuration more reasonable, reducing the risk of network failures due to policy errors, and improving network operation stability and security.

[0028] Through the automated configuration module, the network policy configuration process achieves batch, automated remote deployment, reduces manual intervention, reduces the possibility of human configuration errors, and improves the efficiency and accuracy of policy deployment.

[0029] The system of the present invention can track network traffic, device status and policy execution in real time, promptly discover weak links or potential security threats in the network, and automatically generate adjustment plans, effectively improving the timeliness of network security response and protection capabilities.

[0030] The intelligent and automated design of the present invention is not only applicable to the existing network environment, but can also flexibly adapt to the expansion requirements of future network scale and complexity, providing strong support for large-scale network management and security protection. BRIEF DESCRIPTION OF THE DRAWINGS

[0031] In order to more clearly illustrate the technical solutions of the embodiments of the present invention, the figures required for use in the description of the embodiments will be briefly introduced below. Obviously, the figures described below are only some embodiments of the present invention. For ordinary technicians in this field, other figures can be obtained based on these figures without paying creative work.

[0032] Figure 1 A flowchart of a method for intelligent risk management and control of network resources provided by a first embodiment of the present invention;

[0033] Figure 2 A structural diagram of the automatic association access and 360IP address of the IP address information management of the network resource intelligent risk management method provided in the first embodiment of the present invention;

[0034] Figure 3 A structural diagram of a policy management automatic detection redundancy policy of a network resource intelligent risk management method provided in the first embodiment of the present invention;

[0035] Figure 4 This is a structural diagram of the policy activation automatic detection strategy of the network resource intelligent risk management and control method provided in the first embodiment of the present invention. DETAILED DESCRIPTION

[0036] In order to make the above-mentioned purposes, features and advantages of the present invention more obvious and easy to understand, the specific implementation methods of the present invention are described in detail below in conjunction with the specification drawings. Obviously, the described embodiments are part of the embodiments of the present invention, but not all of them. Based on the embodiments of the present invention, all other embodiments obtained by ordinary persons in the art without creative work should fall within the scope of protection of the present invention.

[0037] Example 1, reference Figures 1 to 4 , is an embodiment of the present invention, and provides a network resource intelligent risk management method, comprising:

[0038] S1: Obtain network resource pool data of the first object, monitor resource status in real time and adjust resource allocation.

[0039] According to the preset network resource allocation rules, the network resource pool data is dynamically monitored and optimized, the usage status of network resources is automatically detected, and the resource usage ledger is generated and updated.

[0040] The preset network resource allocation rules refer to the parameterized standards or constraints that the system follows when performing resource allocation, monitoring and optimization. These rules can be preset based on factors such as network requirements, business priorities, resource utilization efficiency and security. They include but are not limited to priority rules, utilization efficiency rules, security isolation rules, bandwidth control rules, resource recovery rules, load balancing rules and device type priority rules.

[0041] Further, in the context of the present invention, the first object can be any subject that needs to be monitored, managed or configured in the network management system. The following are two possible examples: Enterprise internal local area network (LAN): The enterprise LAN is a typical first object, which includes multiple subnets, servers, workstations, routers, switches and other devices. In this case, the first network data can be IP address allocation information, subnet division, port usage, device connection status, network traffic information, etc. related to the LAN.

[0042] A data center network is also a suitable first object, which usually contains a large number of servers, storage devices, and network devices. In this case, the first network data may include IP allocation information, VLAN division, device bandwidth usage, routing information, data traffic load, etc. of the virtualized network.

[0043] According to the preset network resource allocation rules, the network resource pool data is dynamically monitored and optimized, the usage status of network resources is automatically detected, and the resource usage ledger is generated and updated.

[0044] like Figure 2As shown, the IP address pool manages and associates the access device IP and 360 device IP. The steps are as follows:

[0045] Step 1: Import IP address segment information (including IP segment information and VPN device information), such as 192.168.1.0 / 24 (multiple segments of information can be imported).

[0046] Step 2: Import IP subnet information (including IP subnet information, service purpose, logical area, business area, user unit and other extended information), IP subnet such as 192.168.1.0 / 24.

[0047] Step 3: Import specific IP address information (including IP address, user, MAC address, allocation time, whether it is idle, and other extended information). The IP address is 192.168.1.1. The system automatically calculates the IP subnet information as 192.168.1.0 / 24 based on the IP address. After importing the IP address, the system IP address pool is created.

[0048] Step 4: Import or obtain the IP address of the access device (including IP address, MAC information, access time, user and other extended information) and the 360 ​​device IP address (including IP address, MAC information, access time and other extended information) according to the interface. Through the IP address, automatically associate the information in the IP address pool and match the extended information in the IP subnet. Automatically detect whether the MAC is consistent. If it is inconsistent, it will be prompted in red font. Achieve the effect of MAC information early warning prompt.

[0049] It should be noted that the division of the company's business domains is combined with management and security requirements, and the IP addresses of various regions in the world are scientifically divided into address segments to form a unique IP address management specification system. Through the combination of technical means and management measures, the network policies of different business domains and different security partitions are summarized and associated, and a complete network resource pool is integrated to provide a clear management view for network resources (such as IP addresses, ports, services, etc.), accurately divide resource usage, and make more reasonable planning and allocation decisions.

[0050] S2: Based on the network resource pool data, build a network policy management mechanism and analyze the network policy configuration relationship.

[0051] Based on the address information and usage status in the network resource pool data, the resource allocation range is automatically calculated, a resource pool management system is established, and resource conflicts or anomalies are detected through matching and verification mechanisms, providing real-time warnings of potential inconsistent resource configurations.

[0052] Calculate the IP segment information based on the IP address field contained in the network resource pool data; import the IP address information actually used, automatically calculate the subnet information and IP segment information based on the IP address, and establish an address pool; provide matching management of the access IP address and 360IP address. After importing the access IP address and 360IP address, automatically match the IP address in the address pool based on the imported IP address, and automatically detect whether the MAC address information is consistent. If inconsistent, the MAC address information will issue an early warning.

[0053] By importing global firewall policy information, the firewall policy is analyzed using intelligent algorithms based on IP addresses, port numbers, policy actions, and service parameters. Duplicate and conflicting policies under the same conditions are automatically detected, and policy optimization solutions are generated. The results can be automatically exported as external files.

[0054] Among them, the construction method of the network policy management mechanism includes but is not limited to the subnet isolation strategy. Based on the needs of different business departments in the network resource pool data, the system automatically creates a subnet isolation strategy to ensure that access between different business subnets is restricted. The subnet isolation strategy ensures the partition security of the network by defining access rules for different IP segments. For example, for the networks of the finance and R&D departments, the system will create an isolation strategy to ensure that their traffic does not interfere with each other and reduce cross-departmental security risks. And, bandwidth priority strategy. According to the traffic demand of the network resource pool data, the system creates a bandwidth priority strategy in the policy management mechanism to prioritize bandwidth allocation for key businesses. For example, when the network is congested, the system automatically prioritizes video conferencing traffic and real-time monitoring traffic to reduce the problem of insufficient bandwidth for key applications and ensure the normal operation of the business.

[0055] Furthermore, the resource allocation range is automatically calculated. Based on the real-time connection status of different devices in the network resource pool, the system can dynamically calculate and allocate IP address segments. For example, for newly connected IoT devices, the system automatically allocates appropriate IP segments to avoid IP conflicts with existing devices. Or according to the dynamic changes in the number of devices in the subnet, the system automatically adjusts the allocation range of the subnet. When the number of device connections increases, the system automatically expands the subnet range, and when the number of connections decreases, the subnet is automatically contracted to optimize the use efficiency of the address space.

[0056] like Figure 3 As shown, network policy management and network policy redundancy detection. The specific steps are as follows:

[0057] Step 1: Import or obtain the firewall configuration policy file through the structure. When importing, you need to fill in the firewall IP address and business usage area.

[0058] Step 2: Query the existing network policies in the firewall; you can query based on source IP address, target IP address, source port, target port, behavior, status, etc.

[0059] Step 3: Network redundancy policy detection: Select the firewall IP address, click the calculation button, and the system will intelligently detect whether there are duplications in the firewall policies based on the algorithm and get the results. The results are as follows: "142: Keshu Center accesses the server in Zone III and 155: New access to the marketing ftp address to access the Kunming Bureau marketing FTP service source address partially overlaps, and the target address overlaps."

[0060] It can also be understood as building a real-time network security situation awareness mechanism through network resources and policy ledgers, collecting and analyzing network traffic and policy hits, realizing rapid retrieval, updating and expansion of network policy ledgers, and completing policy conflict detection, resolution, policy optimization and other functions. Import firewall policy information for each global business domain obtained through the interface. You can view the firewall's policy configuration information based on IP address, port, policy action, and service. After selecting the firewall address, click Calculate. The system automatically detects duplicate policies in the firewall based on information such as address, address group, port, and service based on intelligent algorithms. The duplicate policies that are checked are automatically exported to external files.

[0061] Firewall policy information includes the existing rules of the firewall, IP addresses, port numbers, protocol types, actions (allow or deny) defined in the policy, etc. By importing firewall policies, you can detect redundant, conflicting or invalid policy rules and optimize existing network security policies.

[0062] S3: Automates the configuration of network policy management mechanisms.

[0063] Generate adaptive network policy configuration solutions, deploy policy configurations in batches through remote interfaces, monitor configuration status in real time during policy execution, and dynamically adjust configuration parameters.

[0064] Based on policy attribute information, the firewall policy is analyzed using intelligent algorithms, duplicate policies and conflicting policies under the same conditions are automatically detected, and policy optimization solutions are generated. The results can be automatically exported as external files.

[0065] Among them, the network policy configuration solution generates access control policies based on the policy management mechanism in the network management system to control the access rights of specific IP segments or devices. For example, ACL rules are deployed in batches through remote interfaces to limit external access to non-critical applications and ensure the security of the intranet. Access control policies are automatically adjusted according to device and business needs to prevent unauthorized access.

[0066] Furthermore, in order to improve network security, traffic filtering policies can be generated and deployed to filter traffic entering and leaving the network. For example, the system automatically generates traffic filtering rules based on IP addresses and port numbers to filter unnecessary high-bandwidth traffic from specific network segments, optimize bandwidth usage, and reduce network congestion.

[0067] The application of intelligent algorithms can use conflict detection algorithms to analyze dependencies in policy configurations. For example, after detecting duplicate policies under the same source IP address and target port, the intelligent algorithm will prompt the administrator to modify or merge them to avoid inconsistencies and redundancies in the configuration. The redundant policy optimization algorithm can also be used. When the system detects multiple policies with the same configuration conditions but different actions, it can automatically generate optimization suggestions to help reduce redundant policy configurations and improve policy execution efficiency.

[0068] like Figure 4 As shown, the network policy is enabled. The specific steps are as follows

[0069] Step 1: Enter the source IP address and target IP address that need to be opened.

[0070] Step 2: The system will automatically calculate the IP subnet information and match it with the subnet information in the address pool to obtain the service area.

[0071] Step 3: Click the query button to obtain the firewall information that matches the source IP address and target IP address for which the policy needs to be enabled; for example: "Source address 192.168.1.1 firewall (unassigned) is: TEST, TEST; target address 10.10.23.1 external firewall (10.107.4.64)".

[0072] Step 4: At the same time, the interface will list the existing network policies for the source IP and target IP in the source firewall and the target firewall, providing a reference for the administrator to open the policy.

[0073] Furthermore, the generated network policy configuration scheme is automatically pushed to relevant network devices (such as routers, firewalls, switches, etc.) through the system to achieve remote batch deployment. The deployment uses standardized communication protocols (such as SNMP, Netconf, etc.) to interact with the devices to ensure the consistency of all policy configurations. The system provides real-time feedback on the status during the deployment process to ensure that the policy can be updated or added to the device smoothly and seamlessly. The automation of the batch deployment process reduces human intervention, reduces the possibility of operational errors, and significantly improves the efficiency of policy configuration.

[0074] Furthermore, after deployment, the system monitors the execution effect of the policy in real time to ensure that the policy configuration achieves the expected goal. The system tracks the flow and impact range of the newly added policy links in real time, monitors the actual path of network traffic, the devices it passes through, and the status of the affected services to ensure that the policy is executed as expected. The system automatically detects whether there are abnormal traffic or policy deviations; once a potential network security threat or configuration deviation is detected, the system will generate optimization adjustment suggestions in real time or automatically adjust the policy configuration to ensure network security and the best use of resources.

[0075] During the policy execution and monitoring process, the system automatically generates relevant reports, recording the details of each configuration, deployment process, monitoring data, and adjustment suggestions. These reports not only provide traceability of policy deployment and execution, but also provide data support for subsequent policy optimization.

[0076] Embodiment 2 is the second embodiment of the present invention, which is different from the previous embodiment in that:

[0077] If the functions are implemented in the form of software functional units and sold or used as independent products, they can be stored in a computer-readable storage medium. Based on this understanding, the technical solution of the present invention, or the part that contributes to the prior art or the part of the current technical solution, can be embodied in the form of a software product. The current computer software product is stored in a storage medium, including several instructions for a computer device (which can be a personal computer, a server, or a network device, etc.) to perform all or part of the steps of the method described in each embodiment of the present invention. The aforementioned storage medium includes: U disk, mobile hard disk, read-only memory (ROM, Read-Only Memory), random access memory (RAM, Random Access Memory), disk or optical disk and other media that can store program codes.

[0078] The logic and / or steps represented in the flowchart or otherwise described herein, for example, can be considered as an ordered list of executable instructions for implementing logical functions, and can be embodied in any computer-readable medium for use by an instruction execution system, system or device (such as a computer-based system, a system including a processor, or other system that can fetch instructions from an instruction execution system, system or device and execute the instructions), or in conjunction with these instruction execution systems, systems or devices. For the purpose of this specification, "computer-readable medium" can be any system that can contain, store, communicate, propagate or transport a program for use by an instruction execution system, system or device, or in conjunction with these instruction execution systems, systems or devices.

[0079] More specific examples of computer-readable media (a non-exhaustive list) include the following: an electrical connection with one or more wires (electronic systems), a portable computer disk case (magnetic systems), a random access memory (RAM), a read-only memory (ROM), an erasable and programmable read-only memory (EPROM or flash memory), an optical fiber system, and a portable compact disk read-only memory (CDROM). In addition, the computer-readable medium may even be a paper or other suitable medium on which the program is printed, since the program may be obtained electronically, for example, by optically scanning the paper or other medium, followed by editing, deciphering or, if necessary, processing in another suitable manner, and then stored in a computer memory.

[0080] Embodiment 3 is an embodiment of the present invention, which provides a network resource intelligent risk management and control system, characterized in that it includes a resource data collection and management module, a network policy construction module and a network policy automatic configuration module.

[0081] Resource data collection and management module: obtains the network resource pool data of the first object, monitors the resource status in real time and adjusts resource allocation.

[0082] Network policy building module: Based on the network resource pool data, build a network policy management mechanism and analyze the network policy configuration relationship.

[0083] Network policy automatic configuration module: Automates the configuration of network policy management mechanisms.

[0084] Example 4: The following is an embodiment of the present invention, which provides a method for intelligent risk management and control of network resources. In order to verify the beneficial effects of the present invention, scientific demonstration is carried out through economic benefit calculation and simulation / comparative experiments.

[0085] This embodiment verifies the effectiveness of the intelligent risk management and control system for network resources in optimizing IP resource allocation, improving network policy management efficiency, and adjusting policy configuration in real time. The test object is a data center network of an enterprise, which includes a local area network (LAN), a firewall, and multiple distributed service subnets. The network involves approximately 1,200 IP addresses, has dynamically changing network traffic and complex business requirements, and faces problems such as IP address conflicts, policy redundancy, and security risks. The management methods of the prior art rely on manual allocation and monitoring, which can easily lead to waste of resources and inconsistent policy configuration, and management efficiency and network stability need to be improved urgently.

[0086] First, deploy the intelligent risk management and control system for network resources to divide the IP address pool of the data center. The system automatically obtains information about each subnet (such as IP address allocation, subnet division, device port allocation, etc.) according to the preset network allocation rules. Through the automatic monitoring and updating of the resource pool set by the system, the system records resource usage every 5 minutes and generates a dynamic resource usage ledger. In the initial stage, resource usage and allocation are recorded. After data collection begins, the system optimizes resource allocation according to the preset rules and records IP resource usage before and after optimization.

[0087] By importing firewall policy files and combining them with real-time monitoring data, the system obtains the defined policy configurations in the firewall. The system automatically analyzes and compares the IP addresses, ports, protocol types, and service parameters in the policies, and identifies redundant and conflicting policies under the same business or similar configurations. Through intelligent algorithms, the system automatically generates policy optimization suggestions, and the optimization results are automatically saved in the form of logs. During this process, the system imported 20 policy configurations, automatically detected 5 duplicate and conflicting policies, generated optimization suggestions, and exported duplicate policies as report files.

[0088] After generating the adapted network policy configuration plan, the system automatically deploys the configuration plan in batches to the corresponding devices through the network management interface based on the combination of source IP, target IP, source port and target port. During the deployment process, the system monitors the policy execution in real time to ensure that the policy path, target device and affected services are in line with expectations. If during the implementation process, the system detects that one policy deviates from expectations, it will immediately generate an adjustment plan and update it dynamically. Within 4 hours of operation in the data center, the system records the execution path, hit rate, impact range and other data of each policy, analyzes and adjusts the policy in real time to avoid network interruption or security risks.

[0089] Table 1 is the data record of this experiment, showing detailed data such as the name of the test object, the units of different parameters, and the changes in parameters before and after the experiment.

[0090] Table 1 Test data reference table

[0091]

[0092] It can be clearly seen from the table data that the network resource intelligent risk management and control system of the present invention has significant advantages in resource allocation optimization, policy redundancy detection and security situation management. First, in terms of IP resource management, the table shows that after optimization by this system, the IP utilization rate of the main network segment of the data center has dropped from the original 85% to 73%, and the IP utilization rates of subnet A and subnet B have dropped from 78% and 80% to 66% and 68% respectively. Such optimization significantly improves the utilization efficiency of network resources and reduces the risk of IP conflicts. Compared with the existing traditional technology that relies on manual management, this system can automatically optimize and adjust the IP allocation plan under the condition of high resource utilization, reducing errors caused by manual operation and reducing resource waste.

[0093] In terms of network policy management, the test data shows the advantages of the system in detecting and optimizing duplicate and conflicting policies. For example, in the main network segment of the data center, the system identified and cleared 8 redundant policies, reducing the total number of policies from the original 50 to 42, and the hit rate increased to 92%. Other network segments of the data center showed similar policy optimization effects. For example, the security policy network segment detected 3 conflicting policies out of the original 30 policies and made optimization adjustments, reducing the number of policies to 27, and the hit rate reached 89%. Compared with the traditional manual identification method, this system achieves accurate policy optimization in a shorter time, ensuring the accuracy and real-time nature of the configuration.

[0094] In addition, in terms of dynamic adjustment and execution monitoring of policy configuration, this system achieves dynamic adjustment of policies by real-time tracking of the path and scope of influence of the policies. For example, the conflict rate of the external access network segment of the data center dropped from the initial 9% to 1% after the system automatically adjusted, indicating that the system is innovative in automatically detecting and correcting policy deviations. This real-time dynamic adjustment is difficult to achieve in traditional network management, but this system, with the support of intelligent algorithms, can promptly detect and correct configuration deviations, thereby improving the automation of network security management.

[0095] In summary, the network resource intelligent risk management and control system of the present invention has significant innovation and advantages. Compared with the prior art, the system not only improves the efficiency of resource management and the accuracy of policy configuration, but also significantly reduces the error rate of manual operation. The experimental results fully demonstrate the beneficial effects of the system in efficiently managing network resources, optimizing policy configuration, and dynamically responding to security incidents, providing reliable technical support for realizing intelligent management in complex network environments.

[0096] It should be noted that the above embodiments are only used to illustrate the technical solutions of the present invention rather than to limit it. Although the present invention has been described in detail with reference to the preferred embodiments, those skilled in the art should understand that the technical solutions of the present invention may be modified or replaced by equivalents without departing from the spirit and scope of the technical solutions of the present invention, which should all be included in the scope of the claims of the present invention.

Claims

1. A network resource intelligent risk management method, characterized in that: include: Acquire network resource pool data of the first object, monitor resource status in real time and adjust resource allocation; Based on the network resource pool data, a network policy management mechanism is constructed, and a network policy configuration relationship is analyzed; Automate the configuration of network policy management mechanisms.

2. The method for intelligent risk management of network resources according to claim 1, characterized in that: The resource allocation adjustment includes dynamically monitoring and optimizing network resource pool data according to preset network resource allocation rules, automatically detecting the usage status of network resources, and generating and updating resource usage ledgers.

3. The method for intelligent risk management of network resources according to claim 2, characterized in that: The dynamic monitoring includes automatically calculating the resource allocation range according to the address information and usage status in the network resource pool data, establishing a resource pool management system, detecting resource conflicts or anomalies through matching and verification mechanisms, and providing real-time warnings of potential inconsistent resource configurations.

4. The intelligent risk management method for network resources according to claim 3, characterized in that: The construction of the network policy management mechanism includes automatically analyzing the dependency of policy configurations based on network resource pool data and policy configuration rules, detecting conflicts, redundancies or inconsistencies in policies, and generating policy optimization suggestions.

5. The method for intelligent risk management of network resources according to claim 4, characterized in that: The automatic configuration of executing network policies includes generating an adaptive network policy configuration scheme, deploying policy configurations in batches through a remote interface, and monitoring the configuration status in real time during policy execution to dynamically adjust configuration parameters.

6. The intelligent risk management method for network resources according to claim 5, characterized in that: The automatic analysis of policy configuration dependencies includes analyzing firewall policies based on policy attribute information using intelligent algorithms, automatically detecting duplicate policies and conflicting policies under the same conditions, and generating policy optimization solutions, and supporting automatic export of results as external files.

7. The intelligent risk management method for network resources according to claim 1, characterized in that: The first object includes, but is not limited to, a local area network, a wide area network, a data center network, a cloud computing network, and an Internet of Things device network. The first object may include any network environment with IP address allocation, network policy management, and security policy configuration requirements.

8. A network resource intelligent risk management and control system using the method according to any one of claims 1 to 7, characterized in that: Resource data collection and management module: obtains network resource pool data of the first object, monitors resource status in real time and adjusts resource allocation; Network policy building module: based on the network resource pool data, building a network policy management mechanism and analyzing the network policy configuration relationship; Network policy automatic configuration module: Automates the configuration of network policy management mechanisms.

9. A computer device comprising a memory and a processor, wherein the memory stores a computer program, wherein: When the processor executes the computer program, the steps of the method according to any one of claims 1 to 7 are implemented.

10. A computer-readable storage medium having a computer program stored thereon, characterized in that: When the computer program is executed by a processor, the steps of the method according to any one of claims 1 to 7 are implemented.

Images