Firewall automatic management system and method based on work order system

Abstract

The invention discloses a firewall automatic management system and method based on a work order system, and relates to the technical field of network security, and the method comprises the steps: S1, data collection, preprocessing and model construction, S2, work order submission and risk prediction, S3, work order adjustment decision, S4, work order approval and execution, and S5, execution result feedback and monitoring auditing. According to the invention, the mechanical learning and risk prediction module is utilized to carry out comprehensive analysis and learning on a large amount of historical work order data, network flow data, security threat intelligence and firewall operation state data; the module can predict various risks possibly caused by firewall configuration changes related to the work order in a future period of time, and prevents security holes of the firewall due to the fact that the configuration is not adjusted in time.

Description

Technical Field

[0001] The present invention belongs to the technical field of network security, and in particular relates to a firewall automation management system and method based on a work order system. Background Art

[0002] In today's digital age, as enterprise networks continue to expand and become increasingly complex, network security has become a vital concern. Firewalls, as key infrastructure for network security protection, undertake the core tasks of controlling network access and resisting external threats.

[0003] In traditional firewall automation management based on work order systems, firewall configuration changes are often executed according to established work order processes and rules. There is a lack of proactive prediction and flexible response capabilities for potential future risks. This may lead to security vulnerabilities in the firewall due to failure to adjust the configuration in a timely manner. To address the above issues, the following solutions are proposed. Summary of the invention

[0004] The purpose of the present invention is to provide a firewall automation management system and method based on a work order system. Through machine learning and risk prediction modules, it is possible to predict various risks that may be caused by the firewall configuration changes involved in this work order in the future, thereby solving the problem that security vulnerabilities may occur in existing firewalls due to failure to adjust the configuration in a timely manner.

[0005] In order to solve the above technical problems, the present invention is achieved through the following technical solutions:

[0006] The present invention is a firewall automation management method based on a work order system, and the management method includes:

[0007] Step S1, data collection, preprocessing and model building;

[0008] The process of step S1, data collection, preprocessing and model building is as follows:

[0009] Step S11: The data collection module continuously collects various types of data, extracts key feature information, and converts the data into an input format acceptable to the algorithm according to the data feature extraction and encoding rules of the dynamic risk assessment algorithm, providing high-quality data input for the machine learning and risk prediction modules;

[0010] Step S12: The machine learning and risk prediction module constructs a dynamic risk assessment model of the dynamic risk assessment algorithm, determines the model architecture, trains the model using historical data, inputs the encoded feature data into the model, and adjusts the weights and biases of the model according to the mean square error loss function through the back propagation algorithm combined with the stochastic gradient descent optimization algorithm, so that the model can learn the feature associations and risk patterns in the data until the model converges to achieve better prediction performance;

[0011] Step S2: Work order submission and risk prediction;

[0012] Step S3, work order adjustment decision: The work order adjustment module receives the risk assessment report and determines whether the risk exceeds the preset threshold. When the risk does not exceed the threshold, the original work order is directly submitted to the regular approval process of the work order system. When the risk exceeds the threshold, the work order is intelligently adjusted according to the rule-based optimization algorithm and the pre-established risk response rule library to generate an adjusted work order, which is resubmitted to the approval process of the work order system together with the adjustment description document, and at the same time triggers the push of risk warning notifications and adjusted work order details to relevant personnel;

[0013] Step S4, work order approval and execution: The adjusted work order is circulated in the work order system according to the preset approval process. The approver reviews the work order based on the risk warning information, adjustment instructions, enterprise security policies and business needs. If the approval is passed, the automated execution module interacts with the firewall device and sends the adjusted configuration instructions to the firewall device to perform the configuration change operation. If the approval is not passed, the work order will be returned to the submitter or the adjustment module for further modification, with the rejection reason and modification suggestions attached;

[0014] Step S5: Execution result feedback and monitoring audit.

[0015] Preferably, the dynamic network risk perception algorithm in step S11 specifically includes:

[0016] Data feature extraction and encoding:

[0017] Calculate the risk weight Q of the source IP address geographic location: Where n is the number of historical security incidents related to the geographical area, W i Score the severity of the i-th historical security event, E i is the occurrence frequency of the i-th historical security event;

[0018] Calculate the source IP historical access behavior code R: Among them, T is the access frequency in the past time window, Y is the total length of the time window, and U r is the number of different port ranges visited, U t is the total number of ports, I is the number of abnormal connection interruptions, σ, τ is an adjustable weight coefficient;

[0019] Calculate the firewall work order configuration change vector encoding O: Among them, P nu is the number of IP addresses covered by the source IP range, P to is the total number of IP addresses in the entire network, k 1 and k2 is a constant set according to the network scale and security policy. A represents a threshold value, which is used to distinguish different risk levels of the number of IP addresses covered by the source IP range.

[0020] Dynamic risk assessment model construction:

[0021] A multi-layer neural network architecture is used, and the hidden layer neuron activation function is: f(x) = max(0,x);

[0022] The model training uses the mean square error (MSE) loss function: Among them, m is the number of training samples, y j is the true risk value of the jth sample, is the risk value of the jth sample predicted by the module, and the weight update adopts the formula: Among them, ω i is the i-th weight in the neural network, η = 0.01.

[0023] Preferably, the step S2, work order submission and risk prediction specifically includes:

[0024] Step S21: The user submits a firewall configuration change work order through the work order system and fills in the configuration change requirements;

[0025] Step S22: The work order system module passes the work order information to the machine learning and risk prediction module, and uses the trained dynamic risk assessment model in combination with the current network environment data and security threat intelligence to predict the risk of the work order. The new work order data and current related data are processed according to the coding rules and input into the dynamic risk assessment model. The module performs forward propagation calculations, outputs the predicted risk type and risk degree quantitative indicators, and generates a risk assessment report.

[0026] Preferably, the step S5, execution result feedback and monitoring audit specifically includes:

[0027] Step S51: After sending the configuration instruction, the automation execution module waits for feedback information from the firewall device; when the configuration is successful, the automation execution module will record the operation log and notify the work order system module that the work order processing is completed; when the configuration fails, the automation execution module will record detailed error information and feedback to the work order system module, and at the same time trigger the monitoring and auditing module to record the fault and further analyze it;

[0028] Step S52: The monitoring and auditing module monitors the firewall operation status in real time during the entire process, audits and records the entire process of work order processing, and then triggers the adaptive update of the risk prediction module in a timely manner according to data changes.

[0029] Preferably, a firewall automation management system based on a work order system, the management system includes a work order system module and a data acquisition module;

[0030] The output end of the work order system module is unidirectionally connected to the input end of the data acquisition module, and the input end of the data acquisition module is respectively unidirectionally connected to the firewall and the external intelligence library, the data acquisition module is bidirectionally connected to the machine learning and risk prediction module, the output end of the data acquisition module is unidirectionally connected to the monitoring and auditing module, the machine learning and risk prediction module is bidirectionally connected to the monitoring and auditing module, the machine learning and risk prediction module is bidirectionally connected to the work order system module, the work order system module is respectively bidirectionally connected to the user terminal, the work order adjustment module and the automation execution module, and the automation execution module is bidirectionally connected to the firewall.

[0031] Preferably, the data acquisition module is responsible for collecting data from multiple data sources, including historical network connection information recorded in firewall logs, all work order details in past work order systems, external security threat intelligence sources, and real-time firewall operating status data; the work order system module is used to receive the original firewall configuration change work order submitted by the user, and pass the work order information to the machine learning and risk prediction module for risk prediction; the monitoring and auditing module is used to monitor the operating status of the firewall in real time, and interact with the risk prediction module for data to provide real-time data support for risk prediction; the user terminal is used for users to submit firewall configuration change work orders to the work order system.

[0032] Preferably, the automated execution module is used to interact with the firewall device after the adjusted work order is approved, and send the adjusted firewall configuration instructions to the target firewall device to perform configuration change operations. The work order adjustment module checks the risk assessment report generated by the risk prediction module. When the risk exceeds the preset threshold, the work order adjustment module will start the dynamic work order adjustment mechanism to adjust the firewall configuration change content in the work order.

[0033] The present invention has the following beneficial effects:

[0034] 1. The present invention uses machine learning and risk prediction modules to conduct comprehensive analysis and learning of a large amount of historical work order data, network traffic data, security threat intelligence, and firewall operation status data. When a new work order is submitted, the module can predict the various risks that may be caused by the firewall configuration changes involved in this work order in the future, thereby preventing the firewall from having security vulnerabilities due to failure to adjust the configuration in a timely manner.

[0035] 2. The present invention utilizes the work order adjustment module to check the risk assessment report generated by the risk prediction module. If the risk exceeds the preset threshold, the module activates the dynamic work order adjustment mechanism to adjust the firewall configuration changes in the work order, automatically optimizes the work order according to the risk assessment results, and reduces the risk exposure.

[0036] Of course, any product implementing the present invention does not necessarily need to achieve all of the advantages described above at the same time. BRIEF DESCRIPTION OF THE DRAWINGS

[0037] In order to more clearly illustrate the technical solutions of the embodiments of the present invention, the accompanying drawings required for describing the embodiments will be briefly introduced below. Obviously, the accompanying drawings described below are only some embodiments of the present invention. For ordinary technicians in this field, other accompanying drawings can be obtained based on these accompanying drawings without paying creative work.

[0038] Figure 1 It is the internal system framework diagram of the present invention;

[0039] Figure 2 It is a flow chart of the steps of the present invention. DETAILED DESCRIPTION

[0040] The following will be combined with the drawings in the embodiments of the present invention to clearly and completely describe the technical solutions in the embodiments of the present invention. Obviously, the described embodiments are only part of the embodiments of the present invention, not all of the embodiments. Based on the embodiments of the present invention, all other embodiments obtained by ordinary technicians in this field without creative work are within the scope of protection of the present invention.

[0041] See also Figure 1-2 As shown, the present invention is a firewall automation management method based on a work order system, and the management method includes:

[0042] Step S1, data collection, preprocessing and model building;

[0043] Step S1, data collection, preprocessing and model building process are as follows:

[0044] Step S11: The data collection module continuously collects various types of data, extracts key feature information, and converts the data into an input format acceptable to the algorithm according to the data feature extraction and encoding rules of the dynamic risk assessment algorithm, providing high-quality data input for the machine learning and risk prediction modules;

[0045] Step S12: The machine learning and risk prediction module constructs a dynamic risk assessment model of the dynamic risk assessment algorithm, determines the model architecture, trains the model using historical data, inputs the encoded feature data into the model, and adjusts the weights and biases of the model according to the mean square error loss function through the back propagation algorithm combined with the stochastic gradient descent optimization algorithm, so that the model can learn the feature associations and risk patterns in the data until the model converges to achieve better prediction performance;

[0046] Step S2: Work order submission and risk prediction;

[0047] Step S3, work order adjustment decision: The work order adjustment module receives the risk assessment report and determines whether the risk exceeds the preset threshold. When the risk does not exceed the threshold, the original work order is directly submitted to the regular approval process of the work order system. When the risk exceeds the threshold, the work order is intelligently adjusted according to the rule-based optimization algorithm and the pre-established risk response rule library to generate an adjusted work order, which is resubmitted to the approval process of the work order system together with the adjustment description document, and at the same time triggers the push of risk warning notifications and adjusted work order details to relevant personnel;

[0048] Step S4, work order approval and execution: The adjusted work order is circulated in the work order system according to the preset approval process. The approver reviews the work order based on the risk warning information, adjustment instructions, enterprise security policies and business needs. If the approval is passed, the automated execution module interacts with the firewall device and sends the adjusted configuration instructions to the firewall device to perform the configuration change operation. If the approval is not passed, the work order will be returned to the submitter or the adjustment module for further modification, with the rejection reason and modification suggestions attached;

[0049] Step S5: Execution result feedback and monitoring audit.

[0050] The dynamic network risk perception algorithm in step S11 specifically includes:

[0051] Data feature extraction and encoding:

[0052] Calculate the risk weight Q of the source IP address geographic location: Where n is the number of historical security incidents related to the geographical area, W i Score the severity of the i-th historical security event, E i is the occurrence frequency of the i-th historical security event;

[0053] Calculate the source IP historical access behavior code R: Among them, T is the access frequency in the past time window, Y is the total length of the time window, and U r is the number of different port ranges visited, U tis the total number of ports, I is the number of abnormal connection interruptions, σ, τ is an adjustable weight coefficient;

[0054] Calculate the firewall work order configuration change vector encoding O: Among them, P nu is the number of IP addresses covered by the source IP range, P to is the total number of IP addresses in the entire network, k 1 and k 2 is a constant set according to the network scale and security policy. A represents a threshold value, which is used to distinguish different risk levels of the number of IP addresses covered by the source IP range.

[0055] Dynamic risk assessment model construction:

[0056] A multi-layer neural network architecture is used, and the hidden layer neuron activation function is: f(x) = max(0,x);

[0057] The model training uses the mean square error (MSE) loss function: Among them, m is the number of training samples, y j is the true risk value of the jth sample, is the risk value of the jth sample predicted by the module, and the weight update adopts the formula: Among them, ω i is the i-th weight in the neural network, η = 0.01.

[0058] Step S2, work order submission and risk prediction specifically includes:

[0059] Step S21: The user submits a firewall configuration change work order through the work order system and fills in the configuration change requirements;

[0060] Step S22: The work order system module passes the work order information to the machine learning and risk prediction module, and uses the trained dynamic risk assessment model in combination with the current network environment data and security threat intelligence to predict the risk of the work order. The new work order data and current related data are processed according to the coding rules and input into the dynamic risk assessment model. The module performs forward propagation calculations, outputs the predicted risk type and risk degree quantitative indicators, and generates a risk assessment report.

[0061] Step S5, execution result feedback and monitoring audit specifically includes:

[0062] Step S51: After sending the configuration instruction, the automation execution module waits for feedback information from the firewall device; when the configuration is successful, the automation execution module will record the operation log and notify the work order system module that the work order processing is completed; when the configuration fails, the automation execution module will record detailed error information and feedback to the work order system module, and at the same time trigger the monitoring and auditing module to record the fault and further analyze it;

[0063] Step S52: The monitoring and auditing module monitors the firewall operation status in real time during the entire process, audits and records the entire process of work order processing, and then triggers the adaptive update of the risk prediction module in a timely manner according to data changes.

[0064] Firewall automation management system based on work order system, the management system includes work order system module and data collection module;

[0065] The output end of the work order system module is unidirectionally connected to the input end of the data acquisition module, the input end of the data acquisition module is unidirectionally connected to the firewall and the external intelligence library respectively, the data acquisition module is bidirectionally connected to the machine learning and risk prediction module, the output end of the data acquisition module is unidirectionally connected to the monitoring and auditing module, the machine learning and risk prediction module is bidirectionally connected to the monitoring and auditing module, the machine learning and risk prediction module is bidirectionally connected to the work order system module, the work order system module is bidirectionally connected to the user terminal, the work order adjustment module and the automation execution module respectively, and the automation execution module is bidirectionally connected to the firewall.

[0066] The data acquisition module is responsible for collecting data from multiple data sources, including historical network connection information recorded in the firewall log, all work order details in the past work order system, external security threat intelligence sources, and real-time firewall operation status data. The work order system module is used to receive the original firewall configuration change work order submitted by the user, and pass the work order information to the machine learning and risk prediction module for risk prediction. The monitoring and auditing module is used to monitor the operating status of the firewall in real time and interact with the risk prediction module to provide real-time data support for risk prediction. The user terminal is used for users to submit firewall configuration change work orders to the work order system.

[0067] The automated execution module is used to interact with the firewall device after the adjusted work order is approved, and send the adjusted firewall configuration instructions to the target firewall device for configuration change operations. The work order adjustment module checks the risk assessment report generated by the risk prediction module. When the risk exceeds the preset threshold, the work order adjustment module will start the dynamic work order adjustment mechanism to adjust the firewall configuration change content in the work order.

[0068] A specific application of this embodiment is:

[0069] The data acquisition module first collects data from multiple sources, and then cleans, organizes and standardizes it to remove noise data and invalid data and extract key feature information, such as calculating the source IP address geographic location risk weight, source IP historical access behavior coding and firewall work order configuration change vector coding according to a specific formula. Then, when the user submits a firewall configuration change work order through the work order system, the machine learning and risk prediction module combines the processed data to perform risk prediction, outputs the risk quantification value and risk type probability distribution, and generates a risk assessment report. If the risk exceeds the preset threshold, the work order adjustment module intelligently optimizes and adjusts the work order according to the rule base, resubmits it for approval and pushes a notification. If the approval is passed, the automated execution module communicates with the firewall device according to the instructions to execute the configuration change and feedback the results. At the same time, the monitoring and audit module monitors the firewall operation status in real time, triggers the machine learning and risk prediction module to adaptively update according to data changes, and the entire audit record is used for subsequent work. The specific steps are as follows:

[0070] Step S1: Data collection, preprocessing and model building:

[0071] Step S11: The data collection module continuously collects various types of data from firewalls, work order systems, external security intelligence sources, etc., and cleans, organizes and standardizes the data, removes noise data and invalid data, extracts key feature information, and then converts the data into an input format acceptable to the algorithm according to the data feature extraction and encoding rules of the dynamic risk assessment algorithm, providing high-quality data input for the machine learning and risk prediction modules;

[0072] Step S12: The machine learning and risk prediction module constructs a dynamic risk assessment model of the dynamic risk assessment algorithm, determines the model architecture (multi-layer neural network, including the setting of input layer, hidden layer and output layer), trains the model using historical data, inputs the encoded feature data into the model, and adjusts the weights and biases of the model according to the mean square error loss function through the back propagation algorithm combined with the stochastic gradient descent optimization algorithm, so that the model can learn the feature associations and risk patterns in the data until the model converges to achieve better prediction performance;

[0073] The data collection module is responsible for collecting data from multiple data sources, including historical network connection information recorded in the firewall log, all work order details in the past work order system (such as configuration change content, submission time, approval results, etc.), external security threat intelligence sources (such as vulnerability information released by well-known security organizations, malicious IP address databases, etc.), and real-time firewall operation status data (such as the current number of connections, traffic load, status of each port, etc.);

[0074] Machine learning and risk prediction module: The dynamic network risk perception algorithm is used to process data and predict risks. The dynamic network risk perception algorithm is an algorithm specially designed for accurate risk assessment in the firewall automation management system. It mainly includes the following key parts:

[0075] Data feature extraction and encoding:

[0076] Calculate the risk weight of the source IP address geographic location: Where n is the number of historical security incidents related to the geographic area, and W i is the severity score of the ith historical security event, E i is the frequency of occurrence of the i-th historical security event. In this way, the geographical location information of the source IP address is combined with the historical security situation to provide geographical considerations for subsequent risk assessment;

[0077] Calculate the source IP historical access behavior code: Where T is the access frequency in the past time window, Y is the total duration of the time window, and U r is the number of different port ranges accessed, U t is the total number of ports, I is the number of abnormal connection interruptions (1 if any, 0 if none), σ, τ is an adjustable weight coefficient. This code combines multiple factors such as the historical access activity, access diversity, and abnormal situations of the source IP to quantify the risk level of its behavior pattern;

[0078] Calculate the firewall ticket configuration change vector encoding: Among them, P nu is the number of IPs covered by the source IP range, P to is the total number of IPs in the entire network, k 1 and k 2 It is a constant set according to the network scale and security policy. A represents a threshold, which is used to distinguish the different risk levels of the number of IPs covered by the source IP range. This code focuses on the source IP range configuration in the firewall work order and performs preliminary risk quantification based on the range size.

[0079] Dynamic risk assessment model construction:

[0080] A multi-layer neural network architecture is used to determine the correspondence between the number of input layer neurons and the dimension of the encoded feature data. For example, the source IP geographic location risk weight, source IP historical access behavior encoding, firewall work order configuration change vector encoding, etc. are used as inputs of the input layer neurons. The hidden layer structure is designed, and the appropriate number of hidden layers and the number of neurons in each layer are set. The hidden layer neuron activation function uses the ReLU function: f(x) = max(0, x);

[0081] Determine the output layer, output the risk quantification value and the probability distribution of risk types (such as intrusion risk, network performance degradation risk, data leakage risk, etc.);

[0082] The model training uses the mean square error (MSE) loss function: Among them, m is the number of training samples, y j is the true risk value of the jth sample, is the risk value of the jth sample predicted by the module, and the weight update adopts the stochastic gradient descent (SGD) formula: Among them, ω i is the i-th weight in the neural network, η = 0.01 (example learning rate), trained through a large number of historical data samples, using the back propagation algorithm to calculate the gradient according to the loss function, and constantly adjusting the weights and biases of the neural network to minimize the loss function value, so that the model gradually converges to a better risk prediction performance state;

[0083] When a new work order is submitted, the work order related data and the current network environment data are processed according to the coding rules and input into the dynamic risk assessment model. The module outputs the risk quantification value and the probability distribution of the risk type (such as intrusion risk, network performance degradation risk, data leakage risk, etc.) through forward propagation calculation, and generates a risk assessment report;

[0084] Step S2: Work order submission and risk prediction:

[0085] Step S21: The user submits a firewall configuration change work order to the work order system through the user terminal, and fills in the configuration change requirements in detail (such as new or modified firewall rules, source IP address range, destination port number, protocol type, etc.);

[0086] Step S22: The work order system module passes the work order information to the machine learning and risk prediction module, which uses the trained dynamic risk assessment model combined with the current network environment data and security threat intelligence to predict the risk of the work order. First, the new work order data and the current related data are processed according to the coding rules, and then input into the dynamic risk assessment model. The model uses forward propagation calculation and a multi-layer neural network architecture (the hidden layer neuron activation function is f(x)=max(0,x)) to output the predicted risk type (such as DDoS attack, port scan attack, network congestion, etc.) and risk degree quantitative indicators (such as risk probability value), and generate a risk assessment report;

[0087] Among them, the work order system module is used to receive the original firewall configuration change work order submitted by the user, and pass the work order information to the machine learning and risk prediction module for risk prediction;

[0088] After the adjusted work order is resubmitted in the work order adjustment module, it will be circulated according to the regular approval process, including approval by department heads and review by the security team. At the same time, notifications containing risk warning information and details of the adjusted work order can be pushed to relevant personnel, making it easier for the approvers to make decisions by comprehensively considering risk factors during the approval process.

[0089] Step S3, work order adjustment decision: The work order adjustment module receives the risk assessment report and determines whether the risk exceeds the preset threshold. If it does not exceed the threshold, the original work order is directly submitted to the regular approval process of the work order system; if it exceeds the threshold, the work order is intelligently adjusted to generate an adjusted work order, and it is resubmitted to the approval process of the work order system together with the adjustment description document, and at the same time, a message of risk warning notification and adjusted work order details is pushed to relevant personnel (such as work order submitters, approvers, security administrators, etc.);

[0090] Among them, the work order adjustment module can view the risk assessment report generated by the risk prediction module. If the risk exceeds the preset threshold, the module starts the dynamic work order adjustment mechanism to adjust the firewall configuration change content in the work order. For example, a risk response rule base is established in advance. When it is predicted that opening a certain port may lead to a higher intrusion risk, according to the response rules for port opening risks in the rule base, such as "if the probability of intrusion risk caused by port opening is greater than 60%, the port opening range will be reduced to 50% of the original range, and access restrictions based on source IP reputation will be added to allow only high-reputation source IPs to access", the work order will be modified according to this rule;

[0091] Submit the adjusted work order back to the approval process of the work order system, and generate a detailed adjustment description document, recording the reasons for the adjustment, the comparison of the work order configuration before and after the adjustment, and other information, so that the approval personnel and relevant technical personnel can understand the situation;

[0092] Step S4, work order approval and execution: The adjusted work order is circulated in the work order system according to the preset approval process. The approver reviews the work order based on the risk warning information, adjustment instructions, and the company's security policies and business needs. If the approval is passed, the automated execution module interacts with the firewall device and sends the adjusted configuration instructions to the firewall device to execute the configuration change operation. If the approval is not passed, the work order is returned to the submitter or the adjustment module for further modification, and the rejection reason and modification suggestions are attached;

[0093] Among them, after the adjusted work order is approved, the automatic execution module interacts with the firewall device and sends the adjusted firewall configuration instructions to the target firewall device to perform configuration change operations;

[0094] Receive the configuration execution result information returned by the firewall device. If the configuration is successful, record the operation log and notify the work order system module that the work order processing is completed; if the configuration fails, record the detailed error information and feedback to the work order system module, and trigger the monitoring and auditing module to record the fault and further analyze it;

[0095] Step S5: Execution result feedback and monitoring audit:

[0096] Step S51: After sending the configuration instruction, the automation execution module waits for feedback information from the firewall device. If the configuration is successful, the operation log is recorded and the work order system module is notified that the work order processing is completed; if the configuration fails, the detailed error information is recorded and fed back to the work order system module, and the monitoring and auditing module is triggered to record the fault and conduct further analysis;

[0097] Step S52: The monitoring and auditing module monitors the firewall operation status in real time during the whole process, and audits the whole process of work order processing, generates an audit report, and facilitates subsequent security review, compliance inspection, and troubleshooting. By regularly analyzing the audit report, the parameters of the risk prediction module and the risk response rule base can be continuously optimized to improve the accuracy and effectiveness of the system. At the same time, according to the data changes (such as calculating the mean change rate of the source IP access frequency feature), the risk prediction module can be optimized. When it exceeds 0.3), the adaptive update of the risk prediction module is triggered in time to ensure that the module always adapts to the dynamic changes of the network environment;

[0098] The monitoring and auditing module is used to monitor the operation status of the firewall in real time, including the number of connections, traffic rate, rule matching, etc., and interacts with the risk prediction module to provide real-time data support for risk prediction.

[0099] Regularly analyze the differences between the newly-incoming data and the historical data, and calculate the feature mean change rate (taking the source IP access frequency feature as an example, ): When the change rate exceeds the set threshold (assuming it is 0.3), the dynamic risk assessment model is triggered to update and train. The incremental learning method is used to retain some of the weights and knowledge learned in the original model, and only some model parameters related to the new data features are adjusted.

[0100] Audit records are kept for the entire work order processing process, including original work order information, risk prediction results, work order adjustment details, approval process, automated execution results, etc., and a detailed audit report is generated to facilitate subsequent security reviews, compliance checks, and troubleshooting.

[0101] In the description of this specification, the description with reference to the terms "one embodiment", "example", "specific example", etc. means that the specific features, structures, materials or characteristics described in conjunction with the embodiment or example are included in at least one embodiment or example of the present invention. In this specification, the schematic representation of the above terms does not necessarily refer to the same embodiment or example. Moreover, the specific features, structures, materials or characteristics described can be combined in any one or more embodiments or examples in a suitable manner.

[0102] The preferred embodiments of the present invention disclosed above are only used to help illustrate the present invention. The preferred embodiments do not describe all the details in detail, nor do they limit the invention to the specific implementation methods described. Obviously, many modifications and changes can be made according to the content of this specification. This specification selects and specifically describes these embodiments in order to better explain the principles and practical applications of the present invention, so that those skilled in the art can understand and use the present invention well. The present invention is limited only by the claims and their full scope and equivalents.

Claims

1. A firewall automation management method based on a work order system, characterized in that: The management method comprises: Step S1, data collection, preprocessing and model building; The process of step S1, data collection, preprocessing and model building is as follows: Step S11: The data collection module continuously collects various types of data, extracts key feature information, and converts the data into an input format acceptable to the algorithm according to the data feature extraction and encoding rules of the dynamic risk assessment algorithm, providing high-quality data input for the machine learning and risk prediction modules; Step S12: The machine learning and risk prediction module constructs a dynamic risk assessment model of the dynamic risk assessment algorithm, determines the model architecture, trains the model using historical data, inputs the encoded feature data into the model, and adjusts the weights and biases of the model according to the mean square error loss function through the back propagation algorithm combined with the stochastic gradient descent optimization algorithm, so that the model can learn the feature associations and risk patterns in the data until the model converges to achieve better prediction performance; Step S2: Work order submission and risk prediction; Step S3, work order adjustment decision: The work order adjustment module receives the risk assessment report and determines whether the risk exceeds the preset threshold. When the risk does not exceed the threshold, the original work order is directly submitted to the regular approval process of the work order system. When the risk exceeds the threshold, the work order is intelligently adjusted according to the rule-based optimization algorithm and the pre-established risk response rule library to generate an adjusted work order, which is resubmitted to the approval process of the work order system together with the adjustment description document, and at the same time triggers the push of risk warning notifications and adjusted work order details to relevant personnel; Step S4, work order approval and execution: The adjusted work order is circulated in the work order system according to the preset approval process. The approver reviews the work order based on the risk warning information, adjustment instructions, enterprise security policies and business needs. If the approval is passed, the automated execution module interacts with the firewall device and sends the adjusted configuration instructions to the firewall device to perform the configuration change operation. If the approval is not passed, the work order will be returned to the submitter or the adjustment module for further modification, with the rejection reason and modification suggestions attached; Step S5: Execution result feedback and monitoring audit.

2. The firewall automation management method based on the work order system according to claim 1 is characterized in that: The dynamic network risk perception algorithm in step S11 specifically includes: Data feature extraction and encoding: Calculate the risk weight Q of the source IP address geographic location: Where n is the number of historical security incidents related to the geographical area, W i Score the severity of the i-th historical security event, E i is the occurrence frequency of the i-th historical security event; Calculate the source IP historical access behavior code R: Among them, T is the access frequency in the past time window, Y is the total length of the time window, and U r is the number of different port ranges visited, U t is the total number of ports, I is the number of abnormal connection interruptions, σ, τ is an adjustable weight coefficient; Calculate the firewall work order configuration change vector encoding O: Among them, P nu is the number of IP addresses covered by the source IP range, P to is the total number of IPs in the entire network, k1 and k2 are constants set according to the network scale and security policy, and A represents a threshold, which is used to distinguish different risk levels of the number of IPs covered by the source IP range; Dynamic risk assessment model construction: A multi-layer neural network architecture is used, and the hidden layer neuron activation function is: f(x) = max(0,x); The model training uses the mean square error (MSE) loss function: Among them, m is the number of training samples, y j is the true risk value of the jth sample, is the risk value of the jth sample predicted by the module, and the weight update adopts the formula: Among them, ω i is the i-th weight in the neural network, η = 0.

01.

3. The firewall automation management method based on the work order system according to claim 1 is characterized in that: The step S2, work order submission and risk prediction specifically includes: Step S21: The user submits a firewall configuration change work order through the work order system and fills in the configuration change requirements; Step S22: The work order system module passes the work order information to the machine learning and risk prediction module, and uses the trained dynamic risk assessment model in combination with the current network environment data and security threat intelligence to predict the risk of the work order. The new work order data and current related data are processed according to the coding rules and input into the dynamic risk assessment model. The module performs forward propagation calculations, outputs the predicted risk type and risk degree quantitative indicators, and generates a risk assessment report.

4. The firewall automation management method based on the work order system according to claim 1 is characterized in that: The step S5, execution result feedback and monitoring audit specifically includes: Step S51: After sending the configuration instruction, the automation execution module waits for feedback information from the firewall device; when the configuration is successful, the automation execution module will record the operation log and notify the work order system module that the work order processing is completed; when the configuration fails, the automation execution module will record detailed error information and feedback to the work order system module, and at the same time trigger the monitoring and auditing module to record the fault and further analyze it; Step S52: The monitoring and auditing module monitors the firewall operation status in real time during the entire process, audits and records the entire process of work order processing, and then triggers the adaptive update of the risk prediction module in a timely manner according to data changes.

5. A firewall automation management system based on a work order system, the management system includes a work order system module and a data acquisition module, characterized in that: The output end of the work order system module is unidirectionally connected to the input end of the data acquisition module, and the input end of the data acquisition module is respectively unidirectionally connected to the firewall and the external intelligence library, the data acquisition module is bidirectionally connected to the machine learning and risk prediction module, the output end of the data acquisition module is unidirectionally connected to the monitoring and auditing module, the machine learning and risk prediction module is bidirectionally connected to the monitoring and auditing module, the machine learning and risk prediction module is bidirectionally connected to the work order system module, the work order system module is respectively bidirectionally connected to the user terminal, the work order adjustment module and the automation execution module, and the automation execution module is bidirectionally connected to the firewall.

6. The firewall automation management system based on the work order system according to claim 5 is characterized in that: The data acquisition module is responsible for collecting data from multiple data sources, including historical network connection information recorded in firewall logs, all work order details in past work order systems, external security threat intelligence sources, and real-time firewall operation status data. The work order system module is used to receive the original firewall configuration change work order submitted by the user, and pass the work order information to the machine learning and risk prediction module for risk prediction. The monitoring and auditing module is used to monitor the operation status of the firewall in real time, and interact with the risk prediction module for data to provide real-time data support for risk prediction. The user terminal is used for users to submit firewall configuration change work orders to the work order system.

7. The firewall automation management system based on the work order system according to claim 6 is characterized in that: The automated execution module is used to interact with the firewall device after the adjusted work order is approved, and send the adjusted firewall configuration instructions to the target firewall device to perform configuration change operations. The work order adjustment module checks the risk assessment report generated by the risk prediction module. When the risk exceeds the preset threshold, the work order adjustment module will start the dynamic work order adjustment mechanism to adjust the firewall configuration change content in the work order.

Images