Automatic configuration method of network security policy

Abstract

The invention relates to the technical field of network security, in particular to an automatic configuration method of a network security policy. The method comprises the steps of data receiving and preprocessing, strategy mapping model construction, knowledge base initialization and data entry, security configuration strategy analysis and translation, configuration generation and optimization, configuration difference and pilot run verification, user matching and configuration sending, alarm and error configuration processing and configuration repair and re-verification. The security configuration strategy and the established strategy mapping model are input into the knowledge base, and the processed security configuration strategy data are analyzed by referring to the related data of the previous security configuration strategy stored in the knowledge base, so that the security configuration strategy generation automation is improved, and meanwhile, the security configuration strategy generation efficiency is improved. According to the invention, after the security configuration is generated, the wrong configuration is repaired and verified for multiple times, so that the network risk caused by the equipment configuration error in the network is reduced.

Description

Technical Field

[0001] The present invention relates to the technical field of network security, and in particular to an automatic configuration method for network security strategies. Background Art

[0002] In the prior art, for example, Chinese patent CN109274539A discloses a genetic algorithm-based network security configuration automatic generation system, including: a network multi-domain configuration semantic analysis module that extracts corresponding semantic information from the multi-domain configuration of the network to obtain network multi-domain entities, entity relationships and security policy information; a network multi-domain information management module that centrally stores and manages entity information, entity relationship information and security policy information in the network multi-domain and is responsible for verifying their correctness; a user actual authority inference module that infers actual authority from user initial authority according to the rule; and a security configuration automatic generation module that automatically searches for the optimal configuration of the corresponding network security device based on the input user deserved authority matrix and user initial authority matrix, and outputs the configuration and the corresponding user actual authority matrix.

[0003] Therefore, the above solution automatically configures the network security devices, which is not convenient for comparison and verification after configuration, resulting in difficulty in avoiding potential network security risks when the configuration is wrong or unreasonable.

[0004] Based on this, the present invention provides an automatic configuration method of network security policy to solve the above-mentioned technical problems. Summary of the invention

[0005] The purpose of the present invention is to provide an automatic configuration method for network security policies to solve the problems raised by the above background technology.

[0006] To achieve the above object, the present invention provides the following technical solutions:

[0007] A method for automatically configuring a network security policy is provided, comprising the following steps:

[0008] S1. Receive raw data from the network device, and use the preprocessing module to clean, unify the format and perform preliminary analysis on the data;

[0009] S2. Based on the preprocessed data, a policy mapping model is constructed to understand and transform the security configuration policy through the policy mapping model;

[0010] S3. Initialize the knowledge base and enter historical security configuration policy data into the knowledge base, including successful and failed configuration cases;

[0011] S4. Use the data in the knowledge base and the policy mapping model to conduct in-depth analysis of the input security configuration policy and perform necessary translation;

[0012] S5. Generate preliminary security configuration based on the analysis results and translated strategies, and optimize it through intelligent algorithms;

[0013] S6. Compare the generated configuration with the historical configuration in the knowledge base to observe the differences, and perform a trial run in a simulation environment for verification;

[0014] S7. According to the user's role and needs, the verified configuration policy is matched with the user and sent to the user;

[0015] S8. When an error or abnormal situation is encountered during the configuration execution process, an alarm is immediately triggered and an alarm message is sent to the user and the terminal device;

[0016] S9. After receiving the alarm, the user sends the wrong configuration back to the system for repair, and verifies the repaired configuration again.

[0017] Preferably, the implementation steps of step S1 are:

[0018] S1.1. Receive the original data stream from the network device and perform integrity check on the received data to ensure that the data is not lost or damaged;

[0019] S1.2. Remove irrelevant characters and noise from the data, including blank characters and special symbols, format the data, and ensure the consistency of the data format;

[0020] S1.3. Convert the data into a unified format to facilitate subsequent processing and analysis, and check whether the data conforms to the expected format requirements;

[0021] S1.4. Perform preliminary analysis on the data, identify the security configuration policy information in the data, and store the identified security configuration policy information in a temporary database for subsequent use;

[0022] S1.5. Verify the data after preliminary analysis to ensure its accuracy and completeness. If there are errors or inconsistencies in the data, perform error processing or receive the data again.

[0023] Preferably, the implementation steps of step S2 are:

[0024] S2.1. Initialize the strategy mapping model, set the parameters and structure of the model, load the relevant algorithms and library files, and provide necessary support for model construction;

[0025] S2.2. Further process the preprocessed data to extract feature information for model construction, encode and transform the feature information to make it suitable for model construction;

[0026] S2.3. Use the extracted feature information to train the strategy mapping model, and monitor and adjust the performance of the model during the training process;

[0027] S2.4. Use the validation data set to validate the trained model, and optimize and adjust the model based on the validation results to ensure the accuracy and reliability of the model;

[0028] S2.5. Save the trained strategy mapping model to disk for subsequent use, and record the model version and related information to facilitate model tracking and management.

[0029] Preferably, the implementation steps of step S3 are:

[0030] S3.1. Create a new knowledge base to store historical security configuration policy data, and set the structure and index of the knowledge base to facilitate data query and retrieval;

[0031] S3.2. Collect historical security configuration policy data from various sources, including databases, file systems, and networks, and perform deduplication and filtering on the collected data to ensure data uniqueness and accuracy;

[0032] S3.3. Enter the collected historical security configuration policy data into the knowledge base, classify and annotate the data to facilitate subsequent query and analysis;

[0033] S3.4. Verify the entered knowledge base data to ensure the integrity and consistency of the data. If there are errors or inconsistencies in the data, error handling or re-collection of data is performed;

[0034] S3.5. Update the data in the knowledge base regularly to ensure its timeliness and accuracy, and test and verify the updated data to ensure its compatibility with existing systems.

[0035] Preferably, the implementation steps of step S4 are:

[0036] S4.1. Read relevant historical security configuration policy data from the knowledge base, and preprocess and format the read data for subsequent analysis;

[0037] S4.2. Conduct in-depth analysis of the input security configuration policy, including the syntax, semantics and logic of the policy, and generate an analysis report based on the analysis results, pointing out possible problems and improvement suggestions in the policy;

[0038] S4.3. Match the analyzed security configuration policy with the rules in the policy mapping model, and generate a configuration mapping table based on the matching results for subsequent configuration generation;

[0039] S4.4. Perform necessary translation on the matched security configuration policy to ensure that it complies with the current network environment and security requirements, and store the translated policy data in a temporary database for subsequent use;

[0040] S4.5. Verify and adjust the translated policy data to ensure its accuracy and completeness. If there are errors or inconsistencies in the data, error handling or re-translation shall be performed.

[0041] Preferably, the implementation steps of step S5 are:

[0042] S5.1. Generate a preliminary security configuration based on the policy mapping table and the translated policy data, and store the generated security configuration in a temporary database for subsequent optimization;

[0043] S5.2. Introduce genetic algorithms or reinforcement learning to optimize the initially generated security configuration, and set optimization goals, constraints and optimization parameters;

[0044] S5.3. Perform multiple iterations during the optimization process, gradually adjust the parameters and structure of the security configuration, evaluate the performance and effect of the configuration after each iteration, and make adjustments and optimizations based on the evaluation results;

[0045] S5.4. Verify and test the optimized security configuration to ensure that it meets the expected goals and requirements. If the verification results do not meet the requirements, re-optimize and adjust;

[0046] S5.5. Output the optimized security configuration to a specified location or file for subsequent use, and record the configuration version number and generation time related information for subsequent tracking and management.

[0047] Preferably, the implementation steps of step S6 are:

[0048] S6.1. Compare the generated security configuration with the historical configuration in the knowledge base, observe the differences, generate a comparison report, and point out the main differences and differences between the configurations;

[0049] S6.2. Prepare a simulation environment or test platform for trial operation verification of the generated security configuration, and set the parameters and conditions of the simulation environment to ensure that it is similar to the actual network environment;

[0050] S6.3. Conduct a trial run to verify the generated security configuration in a simulated environment, monitor the performance indicators and log information during the trial run, and promptly identify and handle potential problems;

[0051] S6.4. Analyze and evaluate the test run verification results to determine the validity and reliability of the configuration. If the verification results do not meet the requirements, readjust and optimize;

[0052] S6.5. Generate a trial run verification report, record the verification process, results and conclusion information, and submit the verification report to relevant personnel or departments for review and confirmation.

[0053] Preferably, the implementation steps of step S7 are:

[0054] S7.1. Identify the corresponding security configuration policy according to the user's role and needs, and generate a mapping table between user role and configuration policy;

[0055] S7.2. According to the mapping table between user roles and configuration policies, match the corresponding security configuration for the user to ensure that the matching configuration meets the user's security needs and business requirements;

[0056] S7.3. Package the matching security configuration to generate a configuration package file, encrypt and sign the configuration package file to ensure its security and integrity;

[0057] S7.4. Send the encrypted configuration package file to the corresponding user or device, and record the sending time, method and recipient information for subsequent tracking and management;

[0058] S7.5. Collect user feedback and opinions on the configuration, and continuously improve and optimize the configuration based on user feedback.

[0059] Preferably, the implementation steps of step S8 are:

[0060] S8.1. Introduce a real-time monitoring mechanism to monitor abnormal situations during configuration execution in real time, and set monitoring thresholds and alarm condition parameters;

[0061] S8.2. When an abnormal situation is detected, an alarm is immediately triggered and alarm information is generated, and the alarm information is sent to relevant personnel or equipment for timely processing;

[0062] S8.3. Conduct in-depth analysis of the abnormal situation that triggered the alarm, determine the cause and impact of the abnormality, and generate an abnormality analysis report to provide a basis for subsequent processing;

[0063] S8.4. Locate the specific location and cause of the misconfiguration based on the anomaly analysis report, and generate a misconfiguration location report so that relevant personnel can handle and repair it;

[0064] S8.5. Process and repair incorrect configurations to ensure the normal operation and safety of the system, and feedback the processing results and repair measures to relevant personnel or equipment so that they can understand and handle them.

[0065] Preferably, the implementation steps of step S9 are:

[0066] S9.1. Collect user feedback or monitoring system report of error configuration information, classify and organize the error configuration for subsequent processing;

[0067] S9.2. Develop corresponding repair plans based on the specific circumstances and causes of the incorrect configuration to ensure the effectiveness and feasibility of the repair plans;

[0068] S9.3. Repair the incorrect configuration according to the repair plan, and record the repair process, results and related log information;

[0069] S9.4. Re-verify and test the repaired configuration to ensure that it meets the expected goals and requirements. If the verification results do not meet the requirements, readjust and optimize them;

[0070] S9.5. When the repaired configuration passes verification, confirm that the repair is complete and update the relevant configuration information, and notify the relevant personnel or equipment of the repair results and updated configuration information.

[0071] Compared with the prior art, the present invention has the following beneficial effects:

[0072] The present invention inputs the security configuration policy and the established policy mapping model into a knowledge base, retrieves the relevant data of the previous security configuration policy collected in the knowledge base, analyzes the processed security configuration policy data by referring to the relevant data of the previous security configuration policy stored in the knowledge base, translates the analyzed security configuration policy, and generates configuration with the translated security configuration policy data. When performing the security configuration policy generation process, the traditional way of manually generating network security device configuration by an administrator is changed, and the automation of security configuration policy generation is improved. At the same time, after generating the security configuration, the present invention repairs and verifies the wrong configuration for multiple times, thereby reducing the network risk caused by device configuration errors in the network. BRIEF DESCRIPTION OF THE DRAWINGS

[0073] Figure 1 This is a flow chart of the automatic configuration method of the network security policy of the present invention. DETAILED DESCRIPTION

[0074] The following will be combined with the embodiments of the present invention to clearly and completely describe the technical solutions in the embodiments of the present invention. Obviously, the described embodiments are only part of the embodiments of the present invention, not all of the embodiments. Based on the embodiments of the present invention, all other embodiments obtained by ordinary technicians in this field without creative work are within the scope of protection of the present invention.

[0075] Example 1

[0076] See also Figure 1 The present invention proposes an automatic configuration method for network security strategy, comprising the following steps:

[0077] S1. Receive raw data from the network device, and use the preprocessing module to clean, unify the format and perform preliminary analysis on the data;

[0078] In this embodiment, it should be noted that the implementation steps of step S1 are:

[0079] S1.1. Receive the original data stream from the network device and perform integrity check on the received data to ensure that the data is not lost or damaged;

[0080] S1.2. Remove irrelevant characters and noise from the data, including blank characters and special symbols, format the data, and ensure the consistency of the data format;

[0081] S1.3. Convert the data into a unified format to facilitate subsequent processing and analysis, and check whether the data conforms to the expected format requirements;

[0082] S1.4. Perform preliminary analysis on the data, identify the security configuration policy information in the data, and store the identified security configuration policy information in a temporary database for subsequent use;

[0083] S1.5. Verify the data after preliminary analysis to ensure the accuracy and completeness of the data. If there are errors or inconsistencies in the data, error processing will be carried out or the data will be received again;

[0084] S2. Based on the preprocessed data, a policy mapping model is constructed to understand and transform the security configuration policy through the policy mapping model;

[0085] In this embodiment, it should be noted that the implementation steps of step S2 are:

[0086] S2.1. Initialize the strategy mapping model, set the parameters and structure of the model, load the relevant algorithms and library files, and provide necessary support for model construction;

[0087] S2.2. Further process the preprocessed data to extract feature information for model construction, encode and transform the feature information to make it suitable for model construction;

[0088] S2.3. Use the extracted feature information to train the strategy mapping model, and monitor and adjust the performance of the model during the training process;

[0089] S2.4. Use the validation data set to validate the trained model, and optimize and adjust the model based on the validation results to ensure the accuracy and reliability of the model;

[0090] S2.5. Save the trained strategy mapping model to disk for subsequent use, and record the model version and related information to facilitate model tracking and management;

[0091] S3. Initialize the knowledge base and enter historical security configuration policy data into the knowledge base, including successful and failed configuration cases;

[0092] In this embodiment, it should be noted that the implementation steps of step S3 are:

[0093] S3.1. Create a new knowledge base to store historical security configuration policy data, and set the structure and index of the knowledge base to facilitate data query and retrieval;

[0094] S3.2. Collect historical security configuration policy data from various sources, including databases, file systems, and networks, and perform deduplication and filtering on the collected data to ensure data uniqueness and accuracy;

[0095] S3.3. Enter the collected historical security configuration policy data into the knowledge base, classify and annotate the data to facilitate subsequent query and analysis;

[0096] S3.4. Verify the entered knowledge base data to ensure the integrity and consistency of the data. If there are errors or inconsistencies in the data, error handling or re-collection of data is performed;

[0097] S3.5. Update the data in the knowledge base regularly to ensure its timeliness and accuracy, and test and verify the updated data to ensure its compatibility with existing systems;

[0098] S4. Use the data in the knowledge base and the policy mapping model to conduct in-depth analysis of the input security configuration policy and perform necessary translation;

[0099] In this embodiment, it should be noted that the implementation steps of step S4 are:

[0100] S4.1. Read relevant historical security configuration policy data from the knowledge base, and preprocess and format the read data for subsequent analysis;

[0101] S4.2. Conduct in-depth analysis of the input security configuration policy, including the syntax, semantics and logic of the policy, and generate an analysis report based on the analysis results, pointing out possible problems and improvement suggestions in the policy;

[0102] S4.3. Match the analyzed security configuration policy with the rules in the policy mapping model, and generate a configuration mapping table based on the matching results for subsequent configuration generation;

[0103] S4.4. Perform necessary translation on the matched security configuration policy to ensure that it complies with the current network environment and security requirements, and store the translated policy data in a temporary database for subsequent use;

[0104] S4.5. Verify and adjust the translated policy data to ensure its accuracy and completeness. If there are errors or inconsistencies in the data, error handling or re-translation shall be performed;

[0105] S5. Generate preliminary security configuration based on the analysis results and translated strategies, and optimize it through intelligent algorithms;

[0106] In this embodiment, it should be noted that the implementation steps of step S5 are:

[0107] S5.1. Generate a preliminary security configuration based on the policy mapping table and the translated policy data, and store the generated security configuration in a temporary database for subsequent optimization;

[0108] S5.2. Introduce genetic algorithms or reinforcement learning to optimize the initially generated security configuration, and set optimization goals, constraints and optimization parameters;

[0109] S5.3. Perform multiple iterations during the optimization process, gradually adjust the parameters and structure of the security configuration, evaluate the performance and effect of the configuration after each iteration, and make adjustments and optimizations based on the evaluation results;

[0110] S5.4. Verify and test the optimized security configuration to ensure that it meets the expected goals and requirements. If the verification results do not meet the requirements, re-optimize and adjust;

[0111] S5.5. Output the optimized security configuration to a specified location or file for subsequent use, and record the configuration version number and generation time information for subsequent tracking and management;

[0112] S6. Compare the generated configuration with the historical configuration in the knowledge base to observe the differences, and perform a trial run in a simulation environment for verification;

[0113] In this embodiment, it should be noted that the implementation steps of step S6 are:

[0114] S6.1. Compare the generated security configuration with the historical configuration in the knowledge base, observe the differences, generate a comparison report, and point out the main differences and differences between the configurations;

[0115] S6.2. Prepare a simulation environment or test platform for trial operation verification of the generated security configuration, and set the parameters and conditions of the simulation environment to ensure that it is similar to the actual network environment;

[0116] S6.3. Conduct a trial run to verify the generated security configuration in a simulated environment, monitor the performance indicators and log information during the trial run, and promptly identify and handle potential problems;

[0117] S6.4. Analyze and evaluate the test run verification results to determine the validity and reliability of the configuration. If the verification results do not meet the requirements, readjust and optimize;

[0118] S6.5. Generate a trial run verification report, record the verification process, results and conclusion information, and submit the verification report to relevant personnel or departments for review and confirmation;

[0119] S7. According to the user's role and needs, the verified configuration policy is matched with the user and sent to the user;

[0120] In this embodiment, it should be noted that the implementation steps of step S7 are:

[0121] S7.1. Identify the corresponding security configuration policy according to the user's role and needs, and generate a mapping table between user role and configuration policy;

[0122] S7.2. According to the mapping table between user roles and configuration policies, match the corresponding security configuration for the user to ensure that the matching configuration meets the user's security needs and business requirements;

[0123] S7.3. Package the matching security configuration to generate a configuration package file, encrypt and sign the configuration package file to ensure its security and integrity;

[0124] S7.4. Send the encrypted configuration package file to the corresponding user or device, and record the sending time, method and recipient information for subsequent tracking and management;

[0125] S7.5. Collect user feedback and opinions on the configuration, and continuously improve and optimize the configuration based on user feedback;

[0126] S8. When an error or abnormal situation is encountered during the configuration execution process, an alarm is immediately triggered and an alarm message is sent to the user and the terminal device;

[0127] In this embodiment, it should be noted that the implementation steps of step S8 are:

[0128] S8.1. Introduce a real-time monitoring mechanism to monitor abnormal situations during configuration execution in real time, and set monitoring thresholds and alarm condition parameters;

[0129] S8.2. When an abnormal situation is detected, an alarm is immediately triggered and alarm information is generated, and the alarm information is sent to relevant personnel or equipment for timely processing;

[0130] S8.3. Conduct in-depth analysis of the abnormal situation that triggered the alarm, determine the cause and impact of the abnormality, and generate an abnormality analysis report to provide a basis for subsequent processing;

[0131] S8.4. Locate the specific location and cause of the misconfiguration based on the anomaly analysis report, and generate a misconfiguration location report so that relevant personnel can handle and repair it;

[0132] S8.5. Process and repair the incorrect configuration to ensure the normal operation and safety of the system, and feedback the processing results and repair measures to relevant personnel or equipment for their understanding and processing;

[0133] S9. After receiving the alarm, the user sends the wrong configuration back to the system for repair, and the repaired configuration is verified again;

[0134] In this embodiment, it should be noted that the implementation steps of step S9 are:

[0135] S9.1. Collect user feedback or monitoring system report of error configuration information, classify and organize the error configuration for subsequent processing;

[0136] S9.2. Develop corresponding repair plans based on the specific circumstances and causes of the incorrect configuration to ensure the effectiveness and feasibility of the repair plans;

[0137] S9.3. Repair the incorrect configuration according to the repair plan, and record the repair process, results and related log information;

[0138] S9.4. Re-verify and test the repaired configuration to ensure that it meets the expected goals and requirements. If the verification results do not meet the requirements, readjust and optimize them;

[0139] S9.5. When the repaired configuration passes verification, confirm that the repair is complete and update the relevant configuration information, and notify the relevant personnel or equipment of the repair results and updated configuration information.

[0140] Example 2

[0141] In practical applications, the above specifically includes the following steps:

[0142] (1) Data input: Receive data from the network device, perform basic data processing, identify the security configuration policy in the data, input the security configuration policy into the knowledge base, and establish a policy matching model based on the processed data;

[0143] (2) Knowledge base processing: receiving the security policy mapping model input into the knowledge base, analyzing and translating the input security configuration policy;

[0144] (3) Generating configuration: extracting the processed security configuration policy data, building the extracted security configuration policy data into the policy mapping model, generating configuration for the extracted security configuration policy data, inputting the unextracted data into step (2) for further processing using the detection module, extracting the processed data and generating configuration again;

[0145] (4) Configuration verification: Submit the generated configuration to the verification area and verify the generated configuration. The generated configuration strategy is verified by comparing the difference with the previously generated security configuration strategy and running the generated configuration for trial operation. The correctness of the configuration is verified multiple times.

[0146] (5) Configuration and use: The security configuration policy is generated correctly, the generated configuration policy is matched with the user, and the matched configuration policy is sent to the corresponding user. The user uses the correct configuration, and the correct security configuration policy sent is saved in the knowledge base, and the knowledge base is updated;

[0147] (6) Alarm processing: If the security configuration policy verification fails, an alarm message is sent to the user and the terminal device. The terminal device is used to query and locate the alarm message, and the message is backed up and recorded in the work log.

[0148] (7) Configuration repair: When the user receives an alarm message indicating an incorrect configuration, the user sends the incorrect configuration to the generated algorithm for repair. The algorithm corrects the incorrect configuration that sent the alarm and sends the repaired configuration to step 4 for verification.

[0149] Through the above steps, the automated configuration method for network security configuration policy inputs the security configuration policy and the established policy mapping model into the knowledge base, retrieves the relevant data of previous security configuration policies collected in the knowledge base, analyzes the processed security configuration policy data by referring to the relevant data of previous security configuration policies stored in the knowledge base, translates the analyzed security configuration policy, and generates configuration for the translated security configuration policy data. When performing the security configuration policy generation process, the traditional way of manually generating network security device configurations by administrators is changed, thereby improving the automation of security configuration policy generation.

[0150] Therefore, after generating the security configuration, the present invention compares the generated security configuration with the correct security configuration data generated in the past to observe whether the comparison results are different. When the comparison results are different, the alarm configuration is repaired. When the comparison results are not different, the generated configuration is sent to a simulated running program, and a trial run is performed on the generated configuration. The configuration is verified through the trial run result. When the trial run result is correct or the trial run result is wrong, the erroneous configuration for sending the alarm is corrected, and the repaired configuration is re-verified. By repairing and verifying the erroneous configuration multiple times, the network risk caused by device configuration errors in the network is reduced.

[0151] In the description of this specification, the description with reference to the terms "one embodiment", "example", "specific example", etc. means that the specific features, structures, materials or characteristics described in conjunction with the embodiment or example are included in at least one embodiment or example of the present invention. In this specification, the schematic representation of the above terms does not necessarily refer to the same embodiment or example. Moreover, the specific features, structures, materials or characteristics described can be combined in any one or more embodiments or examples in a suitable manner.

[0152] The preferred embodiments of the present invention disclosed above are only used to help illustrate the present invention. The preferred embodiments do not describe all the details in detail, nor do they limit the invention to the specific implementation methods described. Obviously, many modifications and changes can be made according to the content of this specification. This specification selects and specifically describes these embodiments in order to better explain the principles and practical applications of the present invention, so that those skilled in the art can understand and use the present invention well. The present invention is limited only by the claims and their full scope and equivalents.

Claims

1. A method for automatically configuring a network security policy, characterized in that: The following steps are involved: S1. Receive raw data from the network device, and use the preprocessing module to clean, unify the format and perform preliminary analysis on the data; S2. Based on the preprocessed data, a policy mapping model is constructed to understand and transform the security configuration policy through the policy mapping model; S3. Initialize the knowledge base and enter historical security configuration policy data into the knowledge base, including successful and failed configuration cases; S4. Use the data in the knowledge base and the policy mapping model to conduct in-depth analysis of the input security configuration policy and perform necessary translation; S5. Generate preliminary security configuration based on the analysis results and translated strategies, and optimize it through intelligent algorithms; S6. Compare the generated configuration with the historical configuration in the knowledge base to observe the differences, and perform a trial run in a simulation environment for verification; S7. According to the user's role and needs, the verified configuration policy is matched with the user and sent to the user; S8. When an error or abnormal situation is encountered during the configuration execution process, an alarm is immediately triggered and an alarm message is sent to the user and the terminal device; S9. After receiving the alarm, the user sends the wrong configuration back to the system for repair, and verifies the repaired configuration again.

2. The method for automatically configuring a network security policy according to claim 1, characterized in that: The implementation steps of step S1 are: S1.

1. Receive the original data stream from the network device and perform integrity check on the received data; S1.

2. Remove irrelevant characters and noise from the data, including blank characters and special symbols, format the data, and ensure the consistency of the data format; S1.

3. Convert the data into a unified format to facilitate subsequent processing and analysis, and check whether the data conforms to the expected format requirements; S1.

4. Perform preliminary analysis on the data, identify the security configuration policy information in the data, and store the identified security configuration policy information in a temporary database; S1.

5. Verify the data after preliminary analysis. If there are errors or inconsistencies in the data, perform error processing or receive the data again.

3. The method for automatically configuring a network security policy according to claim 2, characterized in that: The implementation steps of step S2 are: S2.

1. Initialize the strategy mapping model, set the parameters and structure of the model, and load the relevant algorithms and library files; S2.

2. Further process the preprocessed data to extract feature information for model construction, encode and transform the feature information to make it suitable for model construction; S2.

3. Use the extracted feature information to train the strategy mapping model, and monitor and adjust the performance of the model during the training process; S2.

4. Use the validation data set to validate the trained model, and optimize and adjust the model based on the validation results; S2.

5. Save the trained strategy mapping model to disk and record the model version and related information.

4. The method for automatically configuring a network security policy according to claim 3, characterized in that: The implementation steps of step S3 are: S3.

1. Create a new knowledge base to store historical security configuration policy data and set the structure and index of the knowledge base; S3.

2. Collect historical security configuration policy data from various sources, including databases, file systems, and networks, and deduplicate and filter the collected data; S3.

3. Enter the collected historical security configuration policy data into the knowledge base, and classify and annotate the data; S3.

4. Verify the entered knowledge base data. If there are errors or inconsistencies in the data, handle the errors or re-collect the data; S3.

5. Update the data in the knowledge base regularly and test and verify the updated data.

5. The method for automatically configuring a network security policy according to claim 4, characterized in that: The implementation steps of step S4 are: S4.

1. Read relevant historical security configuration policy data from the knowledge base, and preprocess and format the read data; S4.

2. Conduct in-depth analysis of the input security configuration policy, including the syntax, semantics and logic of the policy, and generate an analysis report based on the analysis results, pointing out possible problems and improvement suggestions in the policy; S4.

3. Match the analyzed security configuration policy with the rules in the policy mapping model, and generate a configuration mapping table based on the matching results; S4.

4. Perform necessary translation on the matched security configuration policy and store the translated policy data in a temporary database; S4.

5. Verify and adjust the translated policy data. If there are errors or inconsistencies in the data, perform error handling or re-translation.

6. The method for automatically configuring a network security policy according to claim 5, characterized in that: The implementation steps of step S5 are: S5.

1. Generate a preliminary security configuration based on the policy mapping table and the translated policy data, and store the generated security configuration in a temporary database; S5.

2. Introduce genetic algorithms or reinforcement learning to optimize the initially generated security configuration, and set optimization goals, constraints and optimization parameters; S5.

3. Perform multiple iterations during the optimization process, gradually adjust the parameters and structure of the security configuration, evaluate the performance and effect of the configuration after each iteration, and make adjustments and optimizations based on the evaluation results; S5.

4. Verify and test the optimized security configuration to ensure that it meets the expected goals and requirements. If the verification results do not meet the requirements, re-optimize and adjust; S5.

5. Output the optimized security configuration to the specified location or file, and record the configuration version number and generation time related information.

7. The method for automatically configuring a network security policy according to claim 6, characterized in that: The implementation steps of step S6 are: S6.

1. Compare the generated security configuration with the historical configuration in the knowledge base, observe the differences, generate a comparison report, and point out the main differences and differences between the configurations; S6.

2. Prepare a simulation environment or test platform for trial operation verification of the generated security configuration and set the parameters and conditions of the simulation environment; S6.

3. Conduct a trial run to verify the generated security configuration in a simulated environment, monitor the performance indicators and log information during the trial run, and promptly identify and handle potential problems; S6.

4. Analyze and evaluate the test run verification results. If the verification results do not meet the requirements, readjust and optimize them; S6.

5. Generate a trial run verification report, recording the verification process, results and conclusions.

8. The method for automatically configuring a network security policy according to claim 7, characterized in that: The implementation steps of step S7 are: S7.

1. Identify the corresponding security configuration policy according to the user's role and needs, and generate a mapping table between user role and configuration policy; S7.

2. Match the corresponding security configuration for the user according to the mapping relationship table between user roles and configuration policies; S7.

3. Package the matching security configuration to generate a configuration package file, and encrypt and sign the configuration package file; S7.

4. Send the encrypted configuration package file to the corresponding user or device, and record the sending time, method and recipient information; S7.

5. Collect user feedback and opinions on the configuration, and continuously improve and optimize the configuration based on user feedback.

9. The method for automatically configuring a network security policy according to claim 8, characterized in that: The implementation steps of step S8 are: S8.

1. Introduce a real-time monitoring mechanism to monitor abnormal situations during configuration execution in real time, and set monitoring thresholds and alarm condition parameters; S8.

2. When an abnormal situation is detected, an alarm is immediately triggered and alarm information is generated, and the alarm information is sent to relevant personnel or equipment; S8.

3. Conduct in-depth analysis of the abnormal situation that triggered the alarm, determine the cause and impact of the abnormality, and generate an abnormality analysis report; S8.

4. Locate the specific location and cause of the misconfiguration based on the anomaly analysis report and generate a misconfiguration location report; S8.

5. Process and repair the incorrect configuration, and feedback the processing results and repair measures to the relevant personnel or equipment.

10. The method for automatically configuring a network security policy according to claim 9, characterized in that: The implementation steps of step S9 are: S9.

1. Collect user feedback or monitoring system reports of error configuration information, and classify and sort out the error configurations; S9.

2. Develop corresponding repair plans based on the specific circumstances and causes of the incorrect configuration; S9.

3. Repair the incorrect configuration according to the repair plan, and record the repair process, results and related log information; S9.

4. Verify and test the repaired configuration again. If the verification result does not meet the requirements, readjust and optimize it again. S9.

5. When the repaired configuration passes verification, confirm that the repair is complete and update the relevant configuration information, and notify the relevant personnel or equipment of the repair results and updated configuration information.

Images