A deep protocol network security adjustment method based on dynamic defense

Abstract

The present invention discloses a deep protocol network security adjustment method based on dynamic defense, which relates to the field of dynamic network security and comprises the following steps: Step 1, establishing a multi-level dynamic collaborative defense architecture, dividing the multiple levels into a network edge defense layer, a network core defense layer and a network cloud defense layer; The present invention divides network security protection into a network edge defense layer, a network core defense layer and a network cloud defense layer by establishing a multi-level dynamic collaborative defense architecture, thereby forming a comprehensive security protection system; by introducing a dynamic reputation mechanism in each defense layer, adjusting the reputation score and utilizing a real-time update mechanism to ensure that it can respond to changes in user behavior in a timely manner, by transmitting changes in the reputation score to the dynamic collaborative defense architecture through a feedback mechanism, it is possible to identify potential malicious behaviors in a timely manner; by introducing a ridge regression model, in combination with the access control state and the security protection state, it is possible to quantify the degree of influence on the dynamic adjustment result of network security protection.

Description

Technical Field

[0001] The present invention relates to the field of dynamic network security, and in particular to a deep protocol network security adjustment method based on dynamic defense. Background Art

[0002] With the rapid development of information technology, cybersecurity has become an important issue that needs to be addressed worldwide. Driven by digital transformation, modern society is increasingly dependent on information technology, and Internet applications have penetrated into all walks of life. However, the convenience and innovation brought by information technology also provide more attack surfaces and opportunities for cyber attacks. The complexity of cybersecurity threats is also increasing, which has a profound impact on the global network environment.

[0003] The existing technology has the following deficiencies: most of the existing network security protections rely on protection methods based on known attack features, which can effectively identify known threats, but often cannot respond promptly and effectively to new and unknown threats. As the attackers' technology continues to evolve, they continue to find new loopholes and ways to bypass traditional defenses. The existing network security protection cannot respond promptly and effectively. When facing complex and changeable attack methods, the response speed of the defense system is often insufficient, and it cannot detect and prevent potential threats in time, allowing attackers to continue to lurk in the system after the attack occurs, stealing, controlling or destroying data for a long time. Most of the current network security measures work in an isolated manner. There is a lack of effective information sharing and collaborative work between different security technologies and protection measures, which makes it impossible to share security information between different platforms and systems in real time, resulting in the inability to fully monitor and protect potential threats in the entire network environment. Once an attack occurs, network security cannot respond quickly, which in turn allows attackers to operate in the network for a long time, causing greater damage. As the scale of the network continues to expand and the network environment becomes more and more complex, it is difficult for defense measures to achieve end-to-end comprehensive coverage, resulting in security vulnerabilities and weak links becoming potential targets for attackers.

[0004] The above information disclosed in this Background section is only for enhancement of understanding of the background of the present disclosure and therefore it may contain information that does not constitute the prior art that is already known to one of ordinary skill in the art. Summary of the invention

[0005] The purpose of the present invention is to provide a deep protocol network security adjustment method based on dynamic defense to solve the problems in the above-mentioned background technology.

[0006] In order to achieve the above object, the present invention provides the following technical solution: a deep protocol network security adjustment method based on dynamic defense, comprising the following steps:

[0007] Step 1: Establish a multi-layer dynamic collaborative defense architecture, dividing the multiple layers into network edge defense layer, network core defense layer and network cloud defense layer;

[0008] Step 2: Introduce the dynamic reputation mechanism into the multi-level dynamic collaborative defense architecture, calculate the reputation score change of the user behavior data at the current time point, dynamically update the reputation score according to the reputation score change of the user behavior data at the current time point, and output the security protection status;

[0009] Step 3: Define the access control status of network security protection and determine the access control status based on the reputation score;

[0010] Step 4: The ridge regression model combines the access control status and security protection status into a design matrix and uses the regularization parameter to optimize the regression coefficient to evaluate its impact on the dynamic adjustment results of network security protection.

[0011] Preferably, a multi-level dynamic collaborative defense architecture for network security protection is established, and the multiple levels are divided into a network edge defense layer, a network core defense layer, and a network cloud defense layer. The network edge defense layer is used to capture data packets of user devices through deep packet inspection technology, and a tree structure is constructed. The branch nodes inside the tree structure are represented as data packets, and the leaf nodes inside the tree structure are represented as classification results of data packets. The protocol type, port number, and traffic characteristics of the data packets are randomly selected to construct multiple decision trees and perform optimal splitting. Data packets are independently classified for each decision tree, and a voting mechanism is established to select the most classified votes from all decision trees that classify the data packets as legal or suspicious as the final classification result of the current data packet and mark it as legal or suspicious. The network core defense layer is used to receive the final classification result, traffic log, and user behavior data, and the specific port mirror of the network is copied to another port and the inbound and outbound traffic is fully monitored according to the traffic log. The average traffic within each minute is recorded to calculate the standard deviation, and the traffic baseline is set to 3 times the standard deviation. By comparing with the traffic baseline, abnormal surges in traffic are detected, and current traffic events and historical data are associated to identify repetitive attack patterns. The network cloud defense layer is used to detect abnormal surges in traffic through AP I receives the final classification results, abnormal surges in traffic logs, and user behavior data and stores them in a distributed database. It analyzes the final classification results, abnormal surges in traffic logs, and user behavior data in real time and offline through batch processing and stream processing, and automatically generates periodic security status decisions, including attack trends and decision effectiveness.

[0012] Preferably, a dynamic reputation mechanism is introduced into the network edge defense layer, the network core defense layer and the network cloud defense layer, the first input of user behavior data is detected, the user behavior data is divided into login frequency, request type and access time, the user behavior factors affecting the reputation score are defined and the corresponding reputation score weights are assigned, including adding 5 points to the reputation score for successful login on time, subtracting 10 points from the reputation score for frequent failed logins, adding 5 points to the reputation score for normal request access, subtracting 10 points from the reputation score for abnormal request access, and adjusting the reputation score according to the login time period, wherein the login time period of 8:00-21:00 is divided into the normal login time period and the reputation score is added by 5 points, and the login time period of 21:01-7:59 is divided into the abnormal login time period and the reputation score is subtracted by 5 points. The user behavior features are extracted for structuring, the reputation score is initialized, the range of the reputation score is defined as [-100 points, 100 points], and the change in the reputation score of the user behavior data at the current time point is calculated. The specific formula is:

[0013] ΔR i (t) = w 11 *B 11 (t)+w 12 *B 12 (t)+w 21 *B 21 (t)+w 22 *B 22 (t)+w 31 *B 31 (t)+w 32 *B 32 (t)

[0014] Among them, ΔR i (t) represents the change in the reputation score of the user behavior data at the current time point, w 11 Indicates the corresponding credit score weight for successful login on time, B 11 (t) represents the number of successful logins at the current time point, w 12 Indicates the corresponding reputation score weight for frequent failed logins, B 12 (t) represents the number of frequent failed logins at the current time point, w 21 Indicates the corresponding reputation score weight for normal request access, B 21 (t) represents the number of normal request access behaviors at the current time point, w 22 Indicates the corresponding reputation score weight of abnormal request access, B 22 (t) represents the number of abnormal request access behaviors at the current time point, w 31 represents the corresponding reputation score weight during the normal login period, B 31 (t) represents the number of behaviors at the current time point during the normal login period, w32 represents the corresponding reputation score weight of the abnormal login time period, B 32 (t) represents the number of behaviors during the abnormal login period at the current time point. The reputation score is dynamically updated based on the changes in the reputation score of the user behavior data at the current time point, and is fed back to the network edge defense layer, network core defense layer, and network cloud defense layer to output the security protection status.

[0015] Preferably, the access control state of network security protection is defined, including the allowed access control state indicating loose permissions and the denied access control state indicating restricted permissions, and the reputation threshold is set to 70. The access control state is determined and dynamically adjusted according to the reputation score. The specific formula is:

[0016]

[0017] Among them, A i Indicates the access control status, R i (t) represents the reputation score of the user behavior data at the current time point, T a Indicates the reputation threshold. 1 indicates the access control state is allowed, and 0 indicates the access control state is denied.

[0018] Preferably, a ridge regression model is established to combine the influence of access control status and security protection status on the dynamic defense adjustment results of network security protection, and a multi-level dynamic collaborative defense architecture is combined to make the access control status and security protection status into a design matrix, and the regression coefficient is initialized to a zero vector. The optimal regularization parameter value is selected through cross-validation, and the closed-form solution formula of ridge regression is used to calculate the regression coefficient vector. The specific formula is:

[0019] W=(A T A+αI) -1 A T B

[0020] Among them, W represents the regression coefficient vector, A represents the design matrix, α represents the regularization parameter in ridge regression, I represents the identity matrix, and B represents the dynamic defense adjustment result of network security protection.

[0021] In the above technical solution, the technical effects and advantages provided by the present invention are:

[0022] 1. By establishing a multi-level dynamic collaborative defense architecture, network security protection is divided into network edge defense layer, network core defense layer and network cloud defense layer, forming a comprehensive security protection system. At the network edge defense layer, deep packet inspection technology is used to capture data packets from user devices, and a tree structure is constructed to classify data packets. Each decision tree independently classifies data packets and determines the final classification results through a voting mechanism, which enhances the real-time monitoring capability of network traffic, can quickly identify legitimate and suspicious data packets, and prevent potential security threats at the source. The network core defense layer receives the final classification results and traffic logs and comprehensively monitors the traffic. By calculating the standard deviation of traffic and setting a traffic baseline, it is possible to detect abnormal surges in traffic in a timely manner. Combined with historical data comparison, it can effectively identify repetitive attack patterns and enhance the defense capability against persistent attacks. The network cloud defense layer receives and stores abnormal data through APIs, and uses batch and stream processing technologies for real-time and offline analysis. It can not only automatically generate periodic security status decisions, but also optimize protection strategies based on attack trends and decision effectiveness. By introducing a dynamic reputation mechanism at each defense layer, it can evaluate user behavior in real time, adjust reputation scores, ensure continuous monitoring of user behavior, and identify potential malicious behavior in a timely manner.

[0023] 2. By subdividing user behavior data into multiple factors, such as login frequency, request type and access time, and defining specific reputation score weights, user behavior is evaluated in real time, which can quickly identify high-risk users. This not only improves the accuracy of reputation scores, but the real-time update mechanism of reputation scores ensures that changes in user behavior can be responded to in a timely manner. The changes in reputation scores are transmitted to the dynamic collaborative defense architecture through the feedback mechanism, so that the access control status can be dynamically adjusted, and real-time feedback can be provided to enhance adaptability. In the face of a changing network environment, security policies can be flexibly adjusted. By setting a reputation threshold, the access control status can be automatically adjusted according to changes in the reputation score. The dynamic switching of allowing access and denying access ensures the convenience of high-reputation users, and strict access restrictions are imposed on low-reputation users, which can effectively reduce security risks and protect overall security. By introducing a ridge regression model and combining the access control status and security protection status, the degree of impact on the dynamic adjustment results of network security protection can be quantified. BRIEF DESCRIPTION OF THE DRAWINGS

[0024] In order to more clearly illustrate the embodiments of the present application or the technical solutions in the prior art, the drawings required for use in the embodiments will be briefly introduced below. Obviously, the drawings described below are only some embodiments recorded in the present invention. For ordinary technicians in this field, other drawings can also be obtained based on these drawings.

[0025] Figure 1This is a method flow chart of the deep protocol network security adjustment method based on dynamic defense of the present invention. DETAILED DESCRIPTION

[0026] Example embodiments will now be described more fully with reference to the accompanying drawings. However, example embodiments can be implemented in a variety of forms and should not be construed as limited to the examples set forth herein; rather, these example embodiments are provided so that the description of the present disclosure will be more comprehensive and complete, and the concept of the example embodiments will be fully conveyed to those skilled in the art.

[0027] Example 1

[0028] The present invention provides Figure 1 The deep protocol network security adjustment method based on dynamic defense shown includes the following steps:

[0029] Step 1: Establish a multi-layer dynamic collaborative defense architecture, dividing the multiple layers into network edge defense layer, network core defense layer and network cloud defense layer;

[0030] Establish a multi-level dynamic collaborative defense architecture for network security protection, divide the multiple levels into network edge defense layer, network core defense layer and network cloud defense layer, use the network edge defense layer to capture the data packets of user devices through deep packet inspection technology, build a tree structure, represent the branch nodes inside the tree structure as data packets, and represent the leaf nodes inside the tree structure as the classification results of the data packets. Randomly select the protocol type, port number and traffic characteristics of the data packets to build multiple decision trees and perform the best split. Independently classify the data packets for each decision tree, establish a voting mechanism, select all decision trees that classify the data packets as legal or suspicious with the most classification votes as the final classification result of the current data packet and mark it as legal or suspicious, use the network core defense layer to receive the final classification result, traffic logs and user behavior data, copy the specific port mirror of the network to another port and comprehensively monitor the inbound and outbound traffic according to the traffic log, record the average traffic within one minute to calculate the standard deviation, set the traffic baseline to 3 times the standard deviation, detect abnormal surges in traffic by comparing with the traffic baseline, associate current traffic events with historical data to identify repetitive attack patterns, and use the network cloud defense layer to detect abnormal surges in traffic through AP I receives the final classification results, abnormal surges in traffic logs, and user behavior data and stores them in a distributed database. It analyzes the final classification results, abnormal surges in traffic logs, and user behavior data in real time and offline through batch processing and stream processing, and automatically generates periodic security status decisions, including attack trends and decision effectiveness.

[0031] In this embodiment, what needs to be explained specifically is step 1, establishing a multi-level dynamic collaborative defense architecture to enhance the overall capability of network security protection, wherein the architecture is divided into three main levels: a network edge defense layer, a network core defense layer, and a network cloud defense layer. The network edge defense layer is responsible for capturing data packets generated by user devices, and obtaining all inbound and outbound data packet information by monitoring network traffic using deep packet inspection technology. The network core defense layer is responsible for receiving the final classification results, traffic logs, and user behavior data from the network edge defense layer. Through mirroring technology, the network's specific port traffic is copied to another port to comprehensively monitor inbound and outbound traffic, record the average traffic per minute, and calculate the standard deviation of the traffic. The traffic baseline is set to 3 times the standard deviation. By comparing with the traffic baseline, an abnormal surge in traffic is detected, which helps to identify potential attack behaviors. The network cloud defense layer receives the final classification results, abnormal surge in traffic logs, and user behavior data from the network edge and core defense layers through an API, and stores this information in a distributed database. Using batch processing and stream processing technology, the stored data is analyzed in real time and offline. By analyzing the final classification results, abnormal surge in traffic logs, and user behavior data, potential security threats can be identified.

[0032] Step 2: Introduce the dynamic reputation mechanism into the multi-level dynamic collaborative defense architecture, calculate the reputation score change of the user behavior data at the current time point, dynamically update the reputation score according to the reputation score change of the user behavior data at the current time point, and output the security protection status;

[0033] The dynamic reputation mechanism is introduced into the network edge defense layer, network core defense layer and network cloud defense layer. The first input of user behavior data is detected, and the user behavior data is divided into login frequency, request type and access time. The user behavior factors that affect the reputation score are defined and the corresponding reputation score weights are assigned, including adding 5 points to the reputation score for successful login on time, subtracting 10 points from the reputation score for frequent failed logins, adding 5 points to the reputation score for normal request access, and subtracting 10 points from the reputation score for abnormal request access. The reputation score is adjusted according to the login time period, where the login time period of 8:00-21:00 is divided into the normal login time period and the reputation score is added by 5 points, and the login time period of 21:01-7:59 is divided into the abnormal login time period and the reputation score is subtracted by 5 points. The user behavior features are extracted and structured, and the reputation score is initialized. The range of the reputation score is defined as [-100 points, 100 points]. The higher the reputation score, the higher the security of the current user behavior data in network security protection. The change in the reputation score of the user behavior data at the current time point is calculated, and the specific formula is:

[0034] ΔR i (t) = w 11 *B 11(t)+w 12 *B 12 (t)+w 21 *B 21 (t)+w 22 *B 22 (t)+w 31 *B 31 (t)+w 32 *B 32 (t)

[0035] Among them, ΔR i (t) represents the change in the reputation score of the user behavior data at the current time point, w 11 Indicates the corresponding credit score weight for successful login on time, B 11 (t) represents the number of successful logins at the current time point, w 12 Indicates the corresponding reputation score weight for frequent failed logins, B 12 (t) represents the number of frequent failed logins at the current time point, w 21 Indicates the corresponding reputation score weight for normal request access, B 21 (t) represents the number of normal request access behaviors at the current time point, w 22 Indicates the corresponding reputation score weight of abnormal request access, B 22 (t) represents the number of abnormal request access behaviors at the current time point, w 31 represents the corresponding reputation score weight during the normal login period, B 31 (t) represents the number of behaviors at the current time point during the normal login period, w 32 represents the corresponding reputation score weight of the abnormal login time period, B 32 (t) represents the number of behaviors during the abnormal login period at the current time point. The reputation score is dynamically updated based on the changes in the reputation score of the user behavior data at the current time point, and is fed back to the network edge defense layer, network core defense layer, and network cloud defense layer to output the security protection status.

[0036] In this embodiment, what needs to be explained specifically is step 2. For example, the number of successful logins at the current time point is 2 times, the number of frequent failed logins at the current time point is 3 times, the number of normal request accesses at the current time point is 5 times, the number of abnormal request accesses at the current time point is 0 times, the number of normal login time period at the current time point is 4 times, and the number of abnormal login time period at the current time point is 1 time, then the credit score change of the user behavior data at the current time point is: ΔR i (t)=5*2-10*3+5*5-0*10+4*5-1*5=20.

[0037] Step 3: Define the access control status of network security protection and determine the access control status based on the reputation score;

[0038] Define the access control status of network security protection, including the allow access control status indicating loose permissions and the deny access control status indicating restricted permissions. Set the reputation threshold to 70, and dynamically adjust the access control status based on the reputation score. The specific formula is:

[0039]

[0040] Among them, A i Indicates the access control status, R i (t) represents the reputation score of the user behavior data at the current time point, T a Represents the reputation threshold, 1 indicates the access control state is allowed, and 0 indicates the access control state is denied. For example, if the user's reputation score is increased above the threshold, his access rights are increased.

[0041] In this embodiment, what needs to be explained specifically is step three. The allowed access control state indicates that the user has loose access rights and can perform normal operations and access network resources. The denied access control state indicates that the user's access rights are restricted and cannot perform certain operations or access specific resources. The reputation score range of the user behavior data at the current time point is set to [-100, 100], which is used to quantify the user's trust level. The reputation threshold is set to 70, which is used to determine whether the user has sufficient reputation to obtain access rights. Assuming that a user's reputation score is 75, which exceeds the set reputation threshold of 70, the access control state will be automatically set to the allowed access control state. On the contrary, if a user's reputation score is 65, which is lower than the reputation threshold of 70, the access control state will be set to the denied access control state. In this case, the user may not be able to access certain sensitive data or perform specific operations to reduce potential security risks. The access control state can be dynamically adjusted according to the user's reputation score to ensure the flexibility and effectiveness of network security protection.

[0042] Step 4: The ridge regression model combines the access control status and security protection status into a design matrix and uses the regularization parameter to optimize the regression coefficient to evaluate its impact on the dynamic adjustment results of network security protection;

[0043] A ridge regression model is established to combine the influence of access control status and security protection status on the dynamic defense adjustment results of network security protection. The multi-level dynamic collaborative defense architecture is combined to make the access control status and security protection status into a design matrix. The regression coefficient is initialized as a zero vector. The optimal regularization parameter value is selected through cross-validation. The closed-form solution formula of ridge regression is used to calculate the regression coefficient vector. The specific formula is:

[0044] W=(A T A+αI) -1 A T B

[0045] Among them, W represents the regression coefficient vector, A represents the design matrix, α represents the regularization parameter in ridge regression, I represents the identity matrix, and B represents the dynamic defense adjustment result of network security protection.

[0046] In this embodiment, what needs to be explained specifically is step 4, which uses the ridge regression model to evaluate the influence of the access control state and the security protection state on the dynamic adjustment result of the network security protection, and combines the access control state and the security protection state into a design matrix, where each row corresponds to a sample (for example, the access behavior of different users at different times), and each column corresponds to a feature (for example, including the access control state and the security protection state). The design matrix is ​​expressed as The regression coefficient vector is initialized to the zero vector, the optimal regularization parameter is selected through the cross-validation method, and the impact of the access control status and security protection status on the dynamic adjustment results of network security protection is evaluated through the regression coefficient.

[0047] The above description is only by way of illustration of certain exemplary embodiments of the present invention. It is undoubted that those skilled in the art can modify the described embodiments in various ways without departing from the spirit and scope of the present invention. Therefore, the above drawings and descriptions are illustrative in nature and should not be construed as limiting the scope of protection of the claims of the present invention.

Claims

1. A deep protocol network security adjustment method based on dynamic defense, characterized in that: The following steps are involved: Step 1: Establish a multi-layer dynamic collaborative defense architecture, dividing the multiple layers into network edge defense layer, network core defense layer and network cloud defense layer; Step 2: Introduce the dynamic reputation mechanism into the multi-level dynamic collaborative defense architecture, calculate the reputation score change of the user behavior data at the current time point, dynamically update the reputation score according to the reputation score change of the user behavior data at the current time point, and output the security protection status; Step 3: Define the access control status of network security protection and determine the access control status based on the reputation score; Step 4: The ridge regression model combines the access control status and security protection status into a design matrix and uses the regularization parameter to optimize the regression coefficient to evaluate its impact on the dynamic adjustment results of network security protection.

2. The deep protocol network security adjustment method based on dynamic defense according to claim 1 is characterized in that: In the step 1, the network edge defense layer is used to capture data packets of user devices through deep packet inspection technology, and the final legal or suspicious classification of each data packet is determined by random forest and voting mechanism. The network core defense layer is used to receive the final classification results, traffic logs, and user behavior data and detect abnormal surges in traffic, and associate current traffic events with historical data to identify repetitive attack patterns. The network cloud defense layer is used to receive the final classification results, abnormal surges in traffic logs, and user behavior data through API and store them in a distributed database. The final classification results, abnormal surges in traffic logs, and user behavior data are analyzed in real time and offline through batch processing and stream processing to automatically generate periodic security status decisions.

3. The deep protocol network security adjustment method based on dynamic defense according to claim 2 is characterized in that: The specific steps of the random forest and voting mechanism are: randomly constructing a tree structure, representing the branch nodes inside the tree structure as data packets, and the leaf nodes inside the tree structure as the classification results of the data packets, randomly selecting the protocol type, port number and traffic characteristics of the data packets to construct multiple decision trees and perform optimal splitting, independently classifying the data packets for each decision tree, establishing a voting mechanism, selecting all decision trees that classify the data packets as legal or suspicious with the most classification votes as the final classification result of the current data packet and marking it as legal or suspicious.

4. The deep protocol network security adjustment method based on dynamic defense according to claim 1 is characterized in that: In the step 2, the dynamic reputation mechanism detects the first input of user behavior data and defines user behavior factors that affect the reputation score and assigns corresponding reputation score weights, including adding 5 points to the reputation score for successful login on time, subtracting 10 points from the reputation score for frequent failed logins, adding 5 points to the reputation score for normal access requests, subtracting 10 points from the reputation score for abnormal access requests, and adjusting the reputation score according to the login time period, wherein the login time period of 8:00-21:00 is classified as a normal login time period and the reputation score is added 5 points, and the login time period of 21:01-7:59 is classified as an abnormal login time period and the reputation score is subtracted 5 points.

5. The deep protocol network security adjustment method based on dynamic defense according to claim 1 is characterized in that: In step 2, the specific formula for calculating the change in the reputation score of the user behavior data at the current time point is: ΔR i (t)D 11 *B 11 (t)+w 12 *B 12 (t)+w 21 *B 21 (t)+w 22 *B 22 (t)+w 31 *B 31 (t)+w 32 *B 32 (t) Among them, ΔR i (t) represents the change in the reputation score of the user behavior data at the current time point, w 11 Indicates the corresponding credit score weight for successful login on time, B 11 (t) represents the number of successful logins at the current time point, w 12 Indicates the corresponding reputation score weight for frequent failed logins, B 12 (t) represents the number of frequent failed logins at the current time point, w 21 Indicates the corresponding reputation score weight for normal request access, B 21 (t) represents the number of normal request access behaviors at the current time point, w 22 Indicates the corresponding reputation score weight of abnormal request access, B 22 (t) represents the number of abnormal request access behaviors at the current time point, w 31 represents the corresponding reputation score weight during the normal login period, B 31 (t) represents the number of behaviors at the current time point during the normal login period, w 32 represents the corresponding reputation score weight of the abnormal login time period, B 32 (t) represents the number of abnormal login behaviors at the current time point.

6. The deep protocol network security adjustment method based on dynamic defense according to claim 1 is characterized in that: In step 3, the specific formula for judging and dynamically adjusting the access control status according to the reputation score is: Among them, A i Indicates the access control status, R i (t) represents the reputation score of the user behavior data at the current time point, T a Indicates the reputation threshold. 1 indicates the access control state is allowed, and 0 indicates the access control state is denied.

7. The deep protocol network security adjustment method based on dynamic defense according to claim 1 is characterized in that: In the step four, the specific steps of the ridge regression model are: combining the influence of the access control status and the security protection status on the dynamic defense adjustment results of network security protection, combining the multi-level dynamic collaborative defense architecture to make the access control status and the security protection status a design matrix, initializing the regression coefficient to a zero vector, selecting the optimal regularization parameter value through cross-validation, and using the closed-form solution formula of ridge regression to calculate the regression coefficient vector.

8. The deep protocol network security adjustment method based on dynamic defense according to claim 7 is characterized in that: The specific formula for calculating the regression coefficient vector is: W=(A T A+αI) -1 A T B Among them, W represents the regression coefficient vector, A represents the design matrix, α represents the regularization parameter in ridge regression, I represents the identity matrix, and B represents the dynamic defense adjustment result of network security protection.

Images