Adaptive network security policy dynamic adjustment method

Abstract

The present invention relates to the field of network security technology, specifically to an adaptive network security strategy dynamic adjustment method, integrating real-time data from multiple threat intelligence sources to establish a threat intelligence and behavior analysis fusion center, identifying APT attack patterns and abnormal employee behaviors, and building an APT feature library based on the identified APT attack patterns and abnormal employee behaviors, including attack vectors, malware signatures, and attacker behavior patterns, for defining the APT feature library and employee risk portraits, using the APT feature library and employee risk portraits as inputs, combined with real-time network traffic analysis, log auditing, and threat intelligence updates. The present invention can comprehensively cover all aspects and potential threats of the network system by building an APT feature library and employee risk portraits, combined with real-time network traffic analysis and log auditing data, and fine-tuning security policies according to factors such as employee roles, work habits, and historical behavior preferences, to ensure that the policies are both strict and practical, and to improve employee acceptance and execution.

Description

Technical Field

[0001] The present invention relates to the technical field of network security, and in particular to a method for dynamically adjusting an adaptive network security strategy. Background Art

[0002] Network security refers to measures and technologies to protect the hardware, software and data in the network system from malicious attacks, destruction, leakage or illegal use. It covers all aspects of the network system, including the confidentiality, integrity, availability and authenticity of information, while the network security policy is a set of regulations and measures to guide organizations on how to protect their network resources and information assets from threats. It usually includes access control policies, encryption policies, security audit policies, emergency response policies, etc., aiming to ensure the security and stability of the network system.

[0003] However, in general, the purpose of customizing traditional network security strategies is mainly to prevent known security threats and attacks and protect the organization's information assets from damage. The formulation method is usually based on the following steps: identify the security threats and vulnerabilities faced by the organization, assess their potential risks and impacts, and determine the information assets and key business processes that the organization needs to protect based on the risk assessment results. Based on security needs analysis, formulate specific network security strategies, including technical measures, management systems, and operating procedures, etc., and implement the formulated network security strategies, including configuring security equipment, training employees, formulating emergency plans, etc. Regularly audit and evaluate network security strategies, and adjust and improve strategies based on audit results and new security threats.

[0004] However, this method of network security policy formulation has the following shortcomings: traditional policies are often formulated based on known threats and vulnerabilities, and are difficult to cope with the ever-changing network environment and new attack methods. Once the policy is formulated, it is often difficult to dynamically adjust it according to the real-time threat situation, resulting in limited effectiveness of the policy. Due to the complexity and diversity of the network environment, it is difficult for traditional policies to fully cover all possible security threats and attack scenarios.

[0005] In summary, it is necessary to propose an adaptive network security strategy dynamic adjustment method to solve the above problems. Summary of the invention

[0006] The purpose of the present invention is to provide a method for dynamically adjusting an adaptive network security policy to solve the problems raised in the above background technology.

[0007] To achieve the above object, the present invention provides the following technical solutions:

[0008] The method for dynamically adjusting an adaptive network security policy comprises the following steps:

[0009] S1. Integrate real-time data from multiple threat intelligence sources to establish a threat intelligence and behavior analysis fusion center to identify APT attack patterns and abnormal employee behaviors;

[0010] S2. Based on the APT attack patterns and abnormal employee behaviors identified in step S1, an APT feature library is constructed, including attack vectors, malware signatures, and attacker behavior patterns, which are used to define the APT feature library and employee risk profiles;

[0011] S3. Take the APT signature library and employee risk profile in step S2 as input, combine real-time network traffic analysis, log auditing and threat intelligence updates, and use the LSTM deep learning model to perform real-time threat assessment;

[0012] S4. Construct an adaptive security policy generation rule engine based on the risk score of step S3, wherein the settings of the rule engine include access control policy, monitoring level adjustment, and alarm threshold setting;

[0013] S5. Fine-tune the security policy generated in step S4 based on employee roles, work habits, and historical behavior preferences;

[0014] S6. Simulate the risk behavior based on the employee risk behavior data of step S1, and perform simulation and strategy testing through the rule engine generated in step S4;

[0015] S7. Collect the security incident data, employee feedback and policy execution results in steps S1 to S6 to form a feedback loop, and establish a feedback loop and policy iteration mechanism;

[0016] S8. Build a cross-department information sharing platform based on blockchain technology to ensure the security and immutability of data and realize cross-department collaboration and information sharing mechanism;

[0017] S9. Customize personalized security education content, including case analysis and simulation drills, based on employee risk profiles and real-time threat situations.

[0018] Preferably, the implementation steps of step S1 are:

[0019] S1.1. Collect intelligence data regularly using API interfaces or data scraping technology and store them in a centralized database;

[0020] S1.2. Clean the collected threat intelligence, remove duplicate and invalid information, and use natural language processing technology, including word segmentation, part-of-speech tagging, and entity recognition, to extract key information such as IP addresses, domain names, and malware names;

[0021] S1.3. Collect employee behavior logs, including login time, access resources, and operation records, and use K-means clustering method to group behavior data and identify normal and abnormal behavior patterns;

[0022] S1.4. Combine threat intelligence and employee behavior data, use anomaly detection algorithms to identify APT attack patterns and abnormal employee behaviors, and output identification results, including APT attack characteristics, abnormal behavior patterns, and associated employees.

[0023] Preferably, the implementation steps of step S2 are:

[0024] S2.1. Based on the identification results of S1.4, build an APT feature library, including phishing emails, malicious attachments, malware signatures, and lurking and data stealing attacker behavior patterns. Use a database management system to store the feature library for easy query and update;

[0025] S2.2. Define employee risk profiles based on employee roles, historical behavior data, and violation record information, use decision trees or random forest algorithms to assess employee safety risk levels, and output risk profiles;

[0026] S2.3. Regularly review and update the APT signature library to ensure that it reflects the latest threat trends, and dynamically adjust employee risk profiles based on changes in employee behavior and violations.

[0027] Preferably, the implementation steps of step S3 are:

[0028] S3.1. Combine APT signature database, employee risk profiles, real-time network traffic analysis, and log audit data, and use data fusion technology to integrate data from different sources to ensure data consistency and timeliness;

[0029] S3.2. Build an LSTM deep learning model for real-time threat assessment. The model input includes network traffic characteristics, log audit records, and employee behavior data, and the output is a risk score.

[0030] S3.3. Use historical data to train the LSTM model to ensure that the model can accurately identify threats, evaluate the model performance through cross-validation techniques, and adjust the model parameters to improve accuracy;

[0031] S3.4. Input real-time data into the LSTM model, perform threat assessment, and output a risk score to indicate the security threat level of the current network activity.

[0032] Preferably, the implementation steps of step S4 are:

[0033] S4.1. Based on risk scores, design adaptive security policy generation rules, including access control policies, monitoring level adjustment, and alarm threshold settings, so that the rule engine supports dynamic adjustment and automatically updates policies according to changes in risk scores;

[0034] S4.2. Generate access control strategies based on employee risk profiles and real-time threat situations, including limiting access rights of high-risk employees and implementing access control strategies using firewalls and identity authentication systems;

[0035] S4.3. Dynamically adjust monitoring levels based on risk scores, including increasing monitoring frequency for high-risk areas and using intrusion detection systems and log analysis tools to adjust monitoring levels;

[0036] S4.4. Set reasonable alarm thresholds based on risk scores and threat situations to avoid false positives and false negatives, and use the security event management system to manage alarm thresholds and alarm information.

[0037] Preferably, the implementation steps of step S5 are:

[0038] S5.1. Analyze employee roles, work habits, and historical behavior preferences, obtain employee needs and expectations for security policies, and conduct behavioral analysis of employees;

[0039] S5.2. Fine-tune the generated security policies according to the roles and work habits of employees to ensure that the policies are both strict and practical. Use the security policy editor to fine-tune the policies.

[0040] S5.3. Evaluate the effectiveness of the fine-tuned security strategy, including employee satisfaction and the incidence of safety incidents. Based on the evaluation results, further adjust the strategy to ensure the best results.

[0041] Preferably, the implementation steps of step S6 are:

[0042] S6.1. Based on the abnormal employee behavior data identified in S1.4, simulate risk behavior scenarios and use a behavior simulator to perform risk behavior simulation operations;

[0043] S6.2. Build a simulated test environment to simulate the real network environment and employee behavior, and use virtual machines or container virtualization technology to build the test environment;

[0044] S6.3. Apply the generated security policy to the simulation environment and perform policy testing operations;

[0045] S6.4. Analyze the test results, evaluate the effectiveness of the strategy in preventing attacks with respect to success rate, false positive rate, and missed negative rate, and optimize the strategy parameters and improve the strategy performance based on the test results.

[0046] Preferably, the implementation steps of step S7 are:

[0047] S7.1. Collect security incident data in actual operation, including the type of security incident, time of occurrence, and scope of impact, and use the security incident management system to collect incident data;

[0048] S7.2. Collect employee feedback on safety strategies, obtain employee acceptance of strategies and suggestions for improvement, and collect employee feedback through questionnaires and interviews;

[0049] S7.3. Evaluate the effectiveness of policy implementation, including the reduction rate of security incidents and the improvement of employee satisfaction, and use the effectiveness evaluation model to evaluate the effectiveness of policy implementation;

[0050] S7.4. Based on security incident data, employee feedback, and policy execution results, a feedback loop is formed, and the APT feature library, employee risk profiles, and security policies are updated in real time using online random forests. The effectiveness of the policy system is regularly evaluated, and necessary adjustments and optimizations are made.

[0051] Preferably, the implementation steps of step S8 are:

[0052] S8.1. Select blockchain technology suitable for cross-departmental information sharing, including consortium blockchain or private blockchain, and ensure data security and immutability through the consensus mechanism and smart contract functional characteristics of blockchain;

[0053] S8.2. Design the architecture of the cross-departmental information sharing platform, including the data layer, network layer, and application layer, and use the blockchain development framework for platform development;

[0054] S8.3. Develop smart contracts to manage data access rights, ensure the security and transparency of data sharing, and use smart contract programming languages ​​for contract writing and testing;

[0055] S8.4. Deploy a cross-departmental information sharing platform, conduct functional testing and performance testing, and use the blockchain testing framework to perform platform testing operations to ensure that the platform can meet the needs of cross-departmental collaboration and information sharing.

[0056] Preferably, the implementation steps of step S9 are:

[0057] S9.1. Analyze employee risk profiles to obtain employee security risk levels and potential threats;

[0058] S9.2. Analyze real-time threat situations, obtain the main security threats and attack methods in the current network environment, and use threat intelligence analysis tools to analyze threat situations;

[0059] S9.3. Customize and manage the safety education content based on employee risk profiles and real-time threat situations, including historical safety incident reviews, case analysis, and emergency response drills;

[0060] S9.4. Push customized safety education content to employees via email and mobile applications, collect employees’ feedback on the education content, obtain employees’ learning effects and improvement suggestions, evaluate the education effect, and adjust the education content based on the feedback results.

[0061] Compared with the prior art, the beneficial effects of the present invention are as follows: by integrating real-time threat intelligence and employee behavior data and using deep learning models for real-time threat assessment, the present invention can timely discover and respond to new attacks and threats, and dynamically adjust security policies, including access control policies, monitoring levels, and alarm thresholds, according to risk scores and real-time threat situations, to ensure the effectiveness and adaptability of policies. By constructing an APT feature library and employee risk profiles, combined with real-time network traffic analysis and log audit data, it can comprehensively cover all aspects and potential threats of the network system, and fine-tune security policies according to factors such as employee roles, work habits, and historical behavioral preferences to ensure that policies are both strict and practical, thereby improving employee acceptance and execution. At the same time, the present invention also forms a circular feedback mechanism by collecting security event data, employee feedback, and policy execution effects, continuously optimizes and iterates security policies, and improves the level of network security protection. BRIEF DESCRIPTION OF THE DRAWINGS

[0062] Figure 1 A flow chart of the adaptive network security strategy dynamic adjustment method of the present invention is shown. DETAILED DESCRIPTION

[0063] The following will be combined with the drawings in the embodiments of the present invention to clearly and completely describe the technical solutions in the embodiments of the present invention. Obviously, the described embodiments are only part of the embodiments of the present invention, not all of the embodiments. Based on the embodiments of the present invention, all other embodiments obtained by ordinary technicians in this field without creative work are within the scope of protection of the present invention.

[0064] See also Figure 1 The present invention proposes a method for dynamically adjusting an adaptive network security strategy, comprising the following steps:

[0065] S1. Integrate real-time data from multiple threat intelligence sources to establish a threat intelligence and behavior analysis fusion center to identify APT attack patterns and abnormal employee behaviors;

[0066] Specifically, the implementation steps of step S1 are:

[0067] S1.1. Collect intelligence data regularly using API interfaces or data scraping technology and store them in a centralized database;

[0068] S1.2. Clean the collected threat intelligence, remove duplicate and invalid information, and use natural language processing technology, including word segmentation, part-of-speech tagging, and entity recognition, to extract key information such as IP addresses, domain names, and malware names;

[0069] S1.3. Collect employee behavior logs, including login time, access resources, and operation records, and use K-means clustering method to group behavior data and identify normal and abnormal behavior patterns;

[0070] S1.4. Combine threat intelligence and employee behavior data, use anomaly detection algorithms to identify APT attack patterns and abnormal employee behaviors, and output identification results, including APT attack characteristics, abnormal behavior patterns, and associated employees;

[0071] S2. Based on the APT attack patterns and abnormal employee behaviors identified in step S1, an APT feature library is constructed, including attack vectors, malware signatures, and attacker behavior patterns, which are used to define the APT feature library and employee risk profiles;

[0072] Specifically, the implementation steps of step S2 are:

[0073] S2.1. Based on the identification results of S1.4, build an APT feature library, including phishing emails, malicious attachments, malware signatures, and lurking and data stealing attacker behavior patterns. Use a database management system to store the feature library for easy query and update;

[0074] S2.2. Define employee risk profiles based on employee roles, historical behavior data, and violation record information, use decision trees or random forest algorithms to assess employee safety risk levels, and output risk profiles;

[0075] S2.3. Review and update the APT signature database regularly to ensure that it reflects the latest threat trends and dynamically adjust employee risk profiles based on changes in employee behavior and violations;

[0076] S3. Take the APT signature library and employee risk profile in step S2 as input, combine real-time network traffic analysis, log auditing and threat intelligence updates, and use the LSTM deep learning model to perform real-time threat assessment;

[0077] Specifically, the implementation steps of step S3 are:

[0078] S3.1. Combine APT signature database, employee risk profiles, real-time network traffic analysis, and log audit data, and use data fusion technology to integrate data from different sources to ensure data consistency and timeliness;

[0079] S3.2. Build an LSTM deep learning model for real-time threat assessment. The model input includes network traffic characteristics, log audit records, and employee behavior data, and the output is a risk score.

[0080] S3.3. Use historical data to train the LSTM model to ensure that the model can accurately identify threats, evaluate the model performance through cross-validation techniques, and adjust the model parameters to improve accuracy;

[0081] S3.4. Input real-time data into the LSTM model, perform threat assessment, and output a risk score to indicate the security threat level of the current network activity;

[0082] S4. Construct an adaptive security policy generation rule engine based on the risk score of step S3, wherein the settings of the rule engine include access control policy, monitoring level adjustment, and alarm threshold setting;

[0083] Specifically, the implementation steps of step S4 are:

[0084] S4.1. Based on risk scores, design adaptive security policy generation rules, including access control policies, monitoring level adjustment, and alarm threshold settings, so that the rule engine supports dynamic adjustment and automatically updates policies according to changes in risk scores;

[0085] S4.2. Generate access control strategies based on employee risk profiles and real-time threat situations, including limiting access rights of high-risk employees and implementing access control strategies using firewalls and identity authentication systems;

[0086] S4.3. Dynamically adjust monitoring levels based on risk scores, including increasing monitoring frequency for high-risk areas and using intrusion detection systems and log analysis tools to adjust monitoring levels;

[0087] S4.4. Set reasonable alarm thresholds based on risk scores and threat situations to avoid false positives and false negatives, and use security event management systems to manage alarm thresholds and alarm information;

[0088] S5. Fine-tune the security policy generated in step S4 based on employee roles, work habits, and historical behavior preferences;

[0089] Specifically, the implementation steps of step S5 are:

[0090] S5.1. Analyze employee roles, work habits, and historical behavior preferences, obtain employee needs and expectations for security policies, and conduct behavioral analysis of employees;

[0091] S5.2. Fine-tune the generated security policies according to the roles and work habits of employees to ensure that the policies are both strict and practical. Use the security policy editor to fine-tune the policies.

[0092] S5.3. Evaluate the effectiveness of the fine-tuned security strategy, including employee satisfaction and the incidence of security incidents. Based on the evaluation results, further adjust the strategy to ensure the best results.

[0093] S6. Simulate the risk behavior based on the employee risk behavior data of step S1, and perform simulation and strategy testing through the rule engine generated in step S4;

[0094] Specifically, the implementation steps of step S6 are:

[0095] S6.1. Based on the abnormal employee behavior data identified in S1.4, simulate risk behavior scenarios and use a behavior simulator to perform risk behavior simulation operations;

[0096] S6.2. Build a simulated test environment to simulate the real network environment and employee behavior, and use virtual machines or container virtualization technology to build the test environment;

[0097] S6.3. Apply the generated security policy to the simulation environment and perform policy testing operations;

[0098] S6.4. Analyze the test results, evaluate the effectiveness of the strategy in preventing attacks, the false positive rate, and the false negative rate, and optimize the strategy parameters and improve the strategy performance based on the test results;

[0099] S7. Collect the security incident data, employee feedback and policy execution results in steps S1 to S6 to form a feedback loop, and establish a feedback loop and policy iteration mechanism;

[0100] Specifically, the implementation steps of step S7 are:

[0101] S7.1. Collect security incident data in actual operation, including the type of security incident, time of occurrence, and scope of impact, and use the security incident management system to collect incident data;

[0102] S7.2. Collect employee feedback on safety strategies, obtain employee acceptance of strategies and suggestions for improvement, and collect employee feedback through questionnaires and interviews;

[0103] S7.3. Evaluate the effectiveness of policy implementation, including the reduction rate of security incidents and the improvement of employee satisfaction, and use the effectiveness evaluation model to evaluate the effectiveness of policy implementation;

[0104] S7.4. Based on security incident data, employee feedback and policy execution results, a feedback loop is formed, and the APT feature library, employee risk profiles and security policies are updated in real time using online random forests. The effectiveness of the policy system is regularly evaluated, and necessary adjustments and optimizations are made;

[0105] S8. Build a cross-department information sharing platform based on blockchain technology to ensure the security and immutability of data and realize cross-department collaboration and information sharing mechanism;

[0106] Specifically, the implementation steps of step S8 are:

[0107] S8.1. Select blockchain technology suitable for cross-departmental information sharing, including consortium blockchain or private blockchain, and ensure data security and immutability through the consensus mechanism and smart contract functional characteristics of blockchain;

[0108] S8.2. Design the architecture of the cross-departmental information sharing platform, including the data layer, network layer, and application layer, and use the blockchain development framework for platform development;

[0109] S8.3. Develop smart contracts to manage data access rights, ensure the security and transparency of data sharing, and use smart contract programming languages ​​for contract writing and testing;

[0110] S8.4. Deploy a cross-department information sharing platform, conduct functional testing and performance testing, and use the blockchain testing framework to conduct platform testing operations to ensure that the platform can meet the needs of cross-department collaboration and information sharing;

[0111] S9. Customize personalized security education content based on employee risk profiles and real-time threat situations, including case analysis and simulation drills;

[0112] Specifically, the implementation steps of step S9 are:

[0113] S9.1. Analyze employee risk profiles to obtain employee security risk levels and potential threats;

[0114] S9.2. Analyze real-time threat situations, obtain the main security threats and attack methods in the current network environment, and use threat intelligence analysis tools to analyze threat situations;

[0115] S9.3. Customize and manage the safety education content based on employee risk profiles and real-time threat situations, including historical safety incident reviews, case analysis, and emergency response drills;

[0116] S9.4. Push customized safety education content to employees via email and mobile applications, collect employees’ feedback on the education content, obtain employees’ learning effects and improvement suggestions, evaluate the education effect, and adjust the education content based on the feedback results.

[0117] Example

[0118] In practical applications, see Figure 1 In order to effectively deal with complex and ever-changing network security threats, enterprises need to establish a set of adaptive network security policy dynamic adjustment processes. The following will combine the adaptive network security policy dynamic adjustment method with actual application scenarios. Specifically, it includes the following steps:

[0119] (1) Establishment of Threat Intelligence and Behavior Analysis Fusion Center

[0120] Intelligence data collection: Enterprises use API interfaces or data scraping technology to regularly collect intelligence data from multiple threat intelligence sources (such as public vulnerability databases, security blogs, business intelligence services, etc.) and store them in a centralized database;

[0121] Data cleaning and key information extraction: Clean the collected threat intelligence to remove duplicate and invalid information. Then, use natural language processing (NLP) technology to perform word segmentation, part-of-speech tagging, and entity recognition to extract key information such as IP addresses, domain names, and malware names.

[0122] Employee behavior data analysis: Collect employee behavior logs, including login time, access resources, operation records, etc., use K-means clustering method to group behavior data, and identify normal and abnormal behavior patterns;

[0123] APT attack and abnormal behavior identification: Combining threat intelligence and employee behavior data, using anomaly detection algorithms to identify APT attack patterns and abnormal employee behaviors, and output identification results, including APT attack features, abnormal behavior patterns, and associated employees;

[0124] (2) Construction of APT feature library and employee risk profile

[0125] APT feature library construction: Based on the identification results of step 4, an APT feature library is constructed, including phishing emails, malicious attachments, malware signatures, and attacker behavior patterns such as lurking and data theft. The feature library is stored in a database management system to facilitate subsequent query and update.

[0126] Employee risk profile definition: Define employee risk profiles based on employee roles, historical behavior data, violation records, and other information. Use decision trees or random forest algorithms to assess employee safety risk levels and output risk profiles.

[0127] Update of signature database and risk profile: Regularly review and update the APT signature database to ensure that it reflects the latest threat trends. At the same time, dynamically adjust employee risk profiles based on changes in employee behavior and violations;

[0128] (3) Real-time threat assessment and strategy generation

[0129] Data fusion and preprocessing: Combine APT feature library, employee risk profile, real-time network traffic analysis, and log audit data, and use data fusion technology to integrate data from different sources to ensure data consistency and timeliness;

[0130] LSTM model construction and training: Build an LSTM deep learning model for real-time threat assessment. The model input includes network traffic characteristics, log audit records, employee behavior data, etc. The output is a risk score. The model is trained using historical data, and the model performance is evaluated through cross-validation technology. The model parameters are adjusted to improve accuracy.

[0131] Real-time threat assessment: real-time data is input into the LSTM model to conduct threat assessment and output a risk score to indicate the security threat level of the current network activity;

[0132] Adaptive security policy generation: Based on risk scores, adaptive security policy generation rules are designed, including access control policies, monitoring level adjustments, alarm threshold settings, etc. The rule engine supports dynamic adjustments and automatically updates policies based on changes in risk scores.

[0133] (4) Security policy fine-tuning and testing

[0134] Employee behavior analysis: Analyze employee roles, work habits, and historical behavior preferences to obtain employee needs and expectations for security policies;

[0135] Policy fine-tuning: Fine-tune the generated security policy based on the employee's role and work habits to ensure that the policy is both strict and practical. Use the security policy editor to fine-tune the policy.

[0136] Strategy effectiveness evaluation: Evaluate the effectiveness of the fine-tuned security strategy, including employee satisfaction, safety incident rate, etc. Based on the evaluation results, further adjust the strategy to ensure the best effect;

[0137] Risk behavior simulation and strategy testing: Based on the identified abnormal employee behavior data, simulate risk behavior scenarios, build a simulation test environment, apply the generated security policies to the simulation environment for testing, analyze the test results, evaluate the effectiveness of the policies, and optimize the policy parameters based on the test results;

[0138] (5) Feedback loop and strategy iteration

[0139] Security incident data collection: Collect security incident data in actual operation, including security incident type, occurrence time, impact scope, etc.;

[0140] Collect employee feedback: Collect employee feedback on security strategies through questionnaires, interviews, etc., to understand employees' acceptance of strategies and suggestions for improvement;

[0141] Strategy execution effect evaluation: Use the effect evaluation model to evaluate the effectiveness of strategy execution, including the reduction rate of security incidents, improvement of employee satisfaction, etc.;

[0142] Feedback loop and iteration: Based on security incident data, employee feedback, and policy execution results, a feedback loop is formed. Online learning algorithms (such as online random forests) are used to update the APT feature library, employee risk profiles, and security policies in real time. The effectiveness of the policy system is regularly evaluated, and necessary adjustments and optimizations are made.

[0143] (6) Construction of cross-departmental information sharing platform

[0144] Blockchain technology selection: Choose blockchain technology suitable for cross-department information sharing (such as consortium chain or private chain) to ensure data security and immutability;

[0145] Platform architecture design: Design the architecture of the cross-departmental information sharing platform, including the data layer, network layer, application layer, etc., and use the blockchain development framework for platform development;

[0146] Smart contract development: Develop smart contracts to manage data access rights, ensure the security and transparency of data sharing, and use smart contract programming languages ​​for contract writing and testing;

[0147] Platform deployment and testing: deploy a cross-department information sharing platform and conduct functional and performance tests to ensure that the platform can meet the needs of cross-department collaboration and information sharing;

[0148] (7) Personalized safety education content customization

[0149] Employee risk profile analysis: Analyze employee risk profiles to understand employees’ security risk levels and potential threats;

[0150] Real-time threat situation analysis: Use threat intelligence analysis tools to analyze real-time threat situations and understand the main security threats and attack methods in the current network environment;

[0151] Customization of safety education content: Based on employee risk profiles and real-time threat situations, customized safety education content is provided, including historical safety incident reviews, case analysis, emergency response drills, etc. Safety education content is customized and managed using a content management system;

[0152] Education content push and feedback: Push customized safety education content to employees through email, mobile applications, etc., collect employees' feedback on the education content, understand employees' learning effects and improvement suggestions, and at the same time, evaluate the education effect and adjust the education content based on the feedback results.

[0153] Through the above steps, the adaptive network security policy dynamic adjustment method of the present invention can more effectively cope with complex and changeable network security threats and improve the security protection capability and response speed of the organization.

[0154] Although embodiments of the present invention have been shown and described, it will be appreciated by those skilled in the art that various changes, modifications, substitutions and variations may be made to the embodiments without departing from the principles and spirit of the present invention, and that the scope of the present invention is defined by the appended claims and their equivalents.

Claims

1. A method for dynamically adjusting an adaptive network security policy, characterized in that: The following steps are involved: S1. Integrate real-time data from multiple threat intelligence sources to establish a threat intelligence and behavior analysis fusion center to identify APT attack patterns and abnormal employee behaviors; S2. Based on the APT attack patterns and abnormal employee behaviors identified in step S1, an APT feature library is constructed, including attack vectors, malware signatures, and attacker behavior patterns, which are used to define the APT feature library and employee risk profiles; S3. Take the APT signature library and employee risk profile in step S2 as input, combine real-time network traffic analysis, log auditing and threat intelligence updates, and use the LSTM deep learning model to perform real-time threat assessment; S4. Construct an adaptive security policy generation rule engine based on the risk score of step S3, wherein the settings of the rule engine include access control policy, monitoring level adjustment, and alarm threshold setting; S5. Fine-tune the security policy generated in step S4 based on employee roles, work habits, and historical behavior preferences; S6. Simulate the risk behavior based on the employee risk behavior data of step S1, and perform simulation and strategy testing through the rule engine generated in step S4; S7. Collect the security incident data, employee feedback and policy execution results in steps S1 to S6 to form a feedback loop, and establish a feedback loop and policy iteration mechanism; S8. Build a cross-department information sharing platform based on blockchain technology to ensure the security and immutability of data and realize cross-department collaboration and information sharing mechanism; S9. Customize personalized security education content, including case analysis and simulation drills, based on employee risk profiles and real-time threat situations.

2. The adaptive network security policy dynamic adjustment method according to claim 1 is characterized in that: The implementation steps of step S1 are: S1.

1. Collect intelligence data regularly using API interfaces or data scraping technology and store it in a centralized database; S1.

2. Clean the collected threat intelligence, remove duplicate and invalid information, and use natural language processing technology, including word segmentation, part-of-speech tagging, and entity recognition, to extract key information such as IP addresses, domain names, and malware names; S1.

3. Collect employee behavior logs, including login time, access resources, and operation records, and use K-means clustering method to group behavior data and identify normal and abnormal behavior patterns; S1.

4. Combine threat intelligence and employee behavior data, use anomaly detection algorithms to identify APT attack patterns and abnormal employee behaviors, and output identification results, including APT attack characteristics, abnormal behavior patterns, and associated employees.

3. The adaptive network security policy dynamic adjustment method according to claim 2 is characterized in that: The implementation steps of step S2 are: S2.

1. Based on the identification results of S1.4, build an APT feature library, including phishing emails, malicious attachments, malware signatures, and lurking and data stealing attacker behavior patterns, and use a database management system to store the feature library; S2.

2. Define employee risk profiles based on employee roles, historical behavior data, and violation record information, use decision trees or random forest algorithms to assess employee safety risk levels, and output risk profiles; S2.

3. Regularly review and update the APT signature library to ensure that it reflects the latest threat trends, and dynamically adjust employee risk profiles based on changes in employee behavior and violations.

4. The adaptive network security policy dynamic adjustment method according to claim 3 is characterized in that: The implementation steps of step S3 are: S3.

1. Combine APT signature database, employee risk profiles, real-time network traffic analysis, and log audit data, and use data fusion technology to integrate data from different sources; S3.

2. Build an LSTM deep learning model for real-time threat assessment. The model input includes network traffic characteristics, log audit records, and employee behavior data, and the output is a risk score. S3.

3. Use historical data to train the LSTM model to ensure that the model can accurately identify threats, evaluate model performance through cross-validation techniques, and adjust model parameters; S3.

4. Input real-time data into the LSTM model, perform threat assessment, and output a risk score to indicate the security threat level of the current network activity.

5. The adaptive network security policy dynamic adjustment method according to claim 4 is characterized in that: The implementation steps of step S4 are: S4.

1. Based on risk scores, design adaptive security policy generation rules, including access control policies, monitoring level adjustment, and alarm threshold settings, so that the rule engine supports dynamic adjustment and automatically updates policies according to changes in risk scores; S4.

2. Generate access control strategies based on employee risk profiles and real-time threat situations, including limiting access rights of high-risk employees and implementing access control strategies using firewalls and identity authentication systems; S4.

3. Dynamically adjust monitoring levels based on risk scores, including increasing monitoring frequency for high-risk areas and using intrusion detection systems and log analysis tools to adjust monitoring levels; S4.

4. Set reasonable alarm thresholds based on risk scores and threat situations to avoid false positives and false negatives, and use the security event management system to manage alarm thresholds and alarm information.

6. The adaptive network security policy dynamic adjustment method according to claim 5 is characterized in that: The implementation steps of step S5 are: S5.

1. Analyze employee roles, work habits, and historical behavior preferences, obtain employee needs and expectations for security policies, and conduct behavioral analysis of employees; S5.

2. Fine-tune the generated security policies according to the roles and work habits of employees, and use the security policy editor to fine-tune the policies; S5.

3. Evaluate the effectiveness of the fine-tuned security strategy, including employee satisfaction and the incidence of safety incidents, and further adjust the strategy based on the evaluation results.

7. The adaptive network security policy dynamic adjustment method according to claim 6 is characterized in that: The implementation steps of step S6 are: S6.

1. Based on the abnormal employee behavior data identified in step S1.4, simulate risk behavior scenarios and use a behavior simulator to perform risk behavior simulation operations; S6.

2. Build a simulated test environment to simulate the real network environment and employee behavior, and use virtual machines or container virtualization technology to build the test environment; S6.

3. Apply the generated security policy to the simulation environment and perform policy testing operations; S6.

4. Analyze the test results, evaluate the effectiveness of the strategy in preventing attacks with respect to success rate, false positive rate, and missed negative rate, and optimize the strategy parameters based on the test results.

8. The adaptive network security policy dynamic adjustment method according to claim 7 is characterized in that: The implementation steps of step S7 are: S7.

1. Collect security incident data in actual operation, including the type of security incident, time of occurrence, and scope of impact, and use the security incident management system to collect incident data; S7.

2. Collect employee feedback on safety strategies, obtain employee acceptance of strategies and suggestions for improvement, and collect employee feedback through questionnaires and interviews; S7.

3. Evaluate the effectiveness of policy implementation, including the reduction rate of security incidents and the improvement of employee satisfaction, and use the effectiveness evaluation model to evaluate the effectiveness of policy implementation; S7.

4. Based on security incident data, employee feedback, and policy execution results, a feedback loop is formed, and the APT feature library, employee risk profiles, and security policies are updated in real time using online random forests. The effectiveness of the policy system is regularly evaluated, and necessary adjustments and optimizations are made.

9. The adaptive network security policy dynamic adjustment method according to claim 8 is characterized in that: The implementation steps of step S8 are: S8.

1. Select blockchain technology suitable for cross-departmental information sharing, including consortium blockchain or private blockchain, and ensure data security and immutability through the consensus mechanism and smart contract functional characteristics of blockchain; S8.

2. Design the architecture of the cross-departmental information sharing platform, including the data layer, network layer, and application layer, and use the blockchain development framework for platform development; S8.

3. Develop smart contracts to manage data access rights, ensure the security and transparency of data sharing, and use smart contract programming languages ​​for contract writing and testing; S8.

4. Deploy a cross-departmental information sharing platform, conduct functional testing and performance testing, and use the blockchain testing framework to perform platform testing operations.

10. The adaptive network security policy dynamic adjustment method according to claim 9 is characterized in that: The implementation steps of step S9 are: S9.

1. Analyze employee risk profiles to obtain employee security risk levels and potential threats; S9.

2. Analyze real-time threat situations, obtain the main security threats and attack methods in the current network environment, and use threat intelligence analysis tools to analyze threat situations; S9.

3. Customize and manage the safety education content based on employee risk profiles and real-time threat situations, including historical safety incident reviews, case analysis, and emergency response drills; S9.

4. Push customized safety education content to employees via email and mobile applications, collect employees’ feedback on the education content, obtain employees’ learning effects and improvement suggestions, evaluate the education results, and adjust the education content based on the feedback results.

Images