Centralized intelligent analysis method and device for security policies and network equipment

Abstract

The invention provides a centralized intelligent analysis method and device for security policies and network equipment. The security policy configuration information of each security device is collected by calling the collector matched with each security device, the security policy configuration information is analyzed by calling the analyzer matched with each security device, the policy analysis results are obtained, and the security policy configuration information is further analyzed for each policy analysis result. According to the method and the device, the security rule matched with the strategy analysis result is searched in the established knowledge base, and the security risk of the security strategy configuration information of the security equipment is analyzed according to the search result, so that the security risk of the security strategy configuration information of the security equipment in the network is automatically and integrally evaluated; the efficiency and accuracy of security policy configuration information analysis are improved.

Description

Technical Field

[0001] The present application relates to the field of information security technology, and in particular to a security policy centralized intelligent analysis method, device and network equipment. Background Art

[0002] At present, the method for detecting security policies in security devices is usually that the administrator manually checks the security policy information configured on the security devices and evaluates the security risks that each policy may bring based on his or her own security knowledge and experience. For some large-scale networks, such as networks that include multiple security devices of different manufacturers and types, analyzing and evaluating the security policy information in the network through the above manual analysis method will consume a lot of time and energy, and it is also prone to omissions and errors. Summary of the invention

[0003] In view of this, the present application provides a security policy centralized intelligent analysis method, apparatus and network equipment to realize automatic centralized analysis of security policies in the network.

[0004] The technical solutions provided by this application are as follows: According to an embodiment of the first aspect of the present application, a security policy centralized intelligent analysis method is provided, the method is applied to a network device in a network, and the method includes: Calling the collector matched with each security device to collect the security policy configuration information of each security device; the security policy configuration information of any security device is used to indicate the behavior rules configured for the security device; Calling the parser matching each security device to parse the collected security policy configuration information of each security device to obtain the policy parsing result corresponding to each security device; For each policy analysis result corresponding to a security device, a security rule matching the policy analysis result is searched in an established knowledge base, and based on the search result, the security risk of the security policy configuration information of the security device is analyzed.

[0005] Optionally, calling a collector matched with each security device to collect security policy configuration information of each security device includes: For each security device, determine the collector that matches the security device; The collector matched with the security device is called to collect the security policy configuration information of the security device according to the preset collection trigger event.

[0006] Optionally, the acquisition triggering event includes: Satisfy the preset collection period; or, Receive a security policy configuration information update notification sent by a security device.

[0007] Optionally, calling a parser matched with each security device to parse the collected security policy configuration information of each security device to obtain a policy parsing result corresponding to each security device includes: For each security device, determine a parser that matches the security device; Preprocessing the security policy configuration information of each security device through a parser matched with each security device, so that the security policy configuration information of each security device after preprocessing has the same format; Decomposing the security policy configuration information preprocessed by each security device into multiple grammatical units according to a preset grammatical structure; The multiple grammatical units are parsed to obtain policy parsing results corresponding to each security device.

[0008] Optionally, each security rule included in the knowledge base corresponds to a security risk, and each security rule is also configured with a corresponding matching method; for the policy parsing result corresponding to each security device, searching the established knowledge base for a security rule matching the policy parsing result, and analyzing the security risk of the security policy configuration information of the security device according to the search result, including: For each security device, the policy analysis result is matched with each security rule included in the knowledge base according to the matching mode configured for each security rule included in the knowledge base. If the match is successful, the security rule is used as the search result corresponding to the policy parsing result; The potential safety hazard corresponding to each security rule included in the search result is determined, and the potential safety hazard corresponding to each security rule included in the search result is determined as the security risk of the security policy configuration information of the security device.

[0009] Optionally, the matching mode includes exact matching, range matching and fuzzy matching; the policy parsing result corresponding to each security device, according to the matching mode configured for each security rule included in the knowledge base, matches the policy parsing result with each security rule included in the knowledge base, including: In the case where the matching mode configured for any security rule is an exact match, the attribute value corresponding to each attribute in the policy parsing result is compared with the attribute value of the corresponding attribute in the security rule. If the attribute value corresponding to each attribute in the policy parsing result is the same as the attribute value of the corresponding attribute in the security rule, the security rule is determined to be a security rule that matches the policy parsing result; In the case where the matching mode configured for any security rule is range matching, the attribute value corresponding to each attribute in the policy parsing result is compared with the attribute value range configured for the corresponding attribute in the security rule. If the attribute value corresponding to each attribute in the policy parsing result belongs to the attribute value range configured for the corresponding attribute in the security rule, the security rule is determined to be a security rule that matches the policy parsing result; In the case where any security rule is configured with a fuzzy match as the matching method, the attribute value corresponding to each attribute in the policy parsing result is compared with the fuzzy matching condition configured for the corresponding attribute in the security rule. If the attribute value corresponding to each attribute in the policy parsing result satisfies the fuzzy matching condition configured for the corresponding attribute in the security rule, the security rule is determined to be a security rule that matches the policy parsing result.

[0010] Optionally, each security rule included in the knowledge base is also configured with a corresponding decision suggestion, and the decision suggestion is used to eliminate the security risk corresponding to the security rule; after analyzing the security risk of the security policy configuration information of the security device according to the search result, the method further includes: According to the search result, a decision suggestion for configuring each security rule included in the search result is determined, so as to adjust the security policy configuration information of the security device based on the decision suggestion for configuring each security rule included in the search result.

[0011] According to an embodiment of the second aspect of the present application, a security policy centralized intelligent analysis device is provided, the device is applied to a network device in a network, and the method includes: A collection unit, used to call a collector matched with each security device to collect security policy configuration information of each security device; the security policy configuration information of any security device is used to indicate the behavior rules configured for the security device; The parsing unit is used to call the parser matched with each security device to parse the collected security policy configuration information of each security device to obtain the policy parsing result corresponding to each security device; The analysis unit is used to search for security rules matching the policy analysis results corresponding to each security device in an established knowledge base, and analyze the security risks of the security policy configuration information of the security device according to the search results.

[0012] Optionally, the acquisition unit is specifically used for: For each security device, determine the collector that matches the security device; Calling a collector matching the security device to collect security policy configuration information of the security device according to a preset collection trigger event; And / or, the acquisition triggering event includes: Satisfy the preset collection period; or, Receiving a security policy configuration information update notification sent by a security device; And / or, the parsing unit is specifically used for: For each security device, determine a parser that matches the security device; Preprocessing the security policy configuration information of each security device through a parser matched with each security device, so that the security policy configuration information of each security device after preprocessing has the same format; Decomposing the security policy configuration information preprocessed by each security device into multiple grammatical units according to a preset grammatical structure; Parsing the multiple grammatical units to obtain policy parsing results corresponding to each security device; And / or, each security rule included in the knowledge base corresponds to a security risk, and each security rule is also configured with a corresponding matching method; the analysis unit is specifically used for: For each security device, the policy analysis result is matched with each security rule included in the knowledge base according to the matching mode configured for each security rule included in the knowledge base. If the match is successful, the security rule is used as the search result corresponding to the policy parsing result; Determine the potential safety hazard corresponding to each security rule included in the search result, and determine the potential safety hazard corresponding to each security rule included in the search result as the security risk of the security policy configuration information of the security device; And / or, the matching mode includes exact matching, range matching and fuzzy matching; the analysis unit is specifically used for: In the case where the matching mode configured for any security rule is an exact match, the attribute value corresponding to each attribute in the policy parsing result is compared with the attribute value of the corresponding attribute in the security rule. If the attribute value corresponding to each attribute in the policy parsing result is the same as the attribute value of the corresponding attribute in the security rule, the security rule is determined to be a security rule that matches the policy parsing result; In the case where the matching mode configured for any security rule is range matching, the attribute value corresponding to each attribute in the policy parsing result is compared with the attribute value range configured for the corresponding attribute in the security rule. If the attribute value corresponding to each attribute in the policy parsing result belongs to the attribute value range configured for the corresponding attribute in the security rule, the security rule is determined to be a security rule that matches the policy parsing result; In the case where the matching mode configured for any security rule is fuzzy matching, the attribute value corresponding to each attribute in the policy parsing result is compared with the fuzzy matching condition configured for the corresponding attribute in the security rule. If the attribute value corresponding to each attribute in the policy parsing result satisfies the fuzzy matching condition configured for the corresponding attribute in the security rule, the security rule is determined to be a security rule that matches the policy parsing result; And / or, each security rule included in the knowledge base is also configured with a corresponding decision suggestion, and the decision suggestion is used to eliminate the security risk corresponding to the security rule; the analysis unit is also used to: According to the search result, a decision suggestion for configuring each security rule included in the search result is determined, so as to adjust the security policy configuration information of the security device based on the decision suggestion for configuring each security rule included in the search result.

[0013] According to an embodiment of the third aspect of the present application, a network device is provided. The network to which the network device belongs also includes at least one security device. The network device is used to execute the method described in the first aspect.

[0014] It can be seen from the above technical scheme that the present application collects the security policy configuration information of each security device by calling the collector matching each security device, and parses the security policy configuration information by calling the parser matching each security device to obtain the policy parsing result, and further searches for security rules matching the policy parsing result in the established knowledge base for each policy parsing result, and analyzes the security risk of the security policy configuration information of the security device based on the search result, thereby realizing automatic overall assessment of the security risk of the security policy configuration information of each security device in the network, and improving the efficiency and accuracy of the security policy configuration information analysis. BRIEF DESCRIPTION OF THE DRAWINGS

[0015] The accompanying drawings, which are incorporated in and constitute a part of the specification, illustrate embodiments consistent with the present application and, together with the description, serve to explain the principles of the present application.

[0016] Figure 1 A flowchart of a centralized intelligent analysis method for security policies provided in an embodiment of the present application; Figure 2 A schematic diagram of the specific steps of the security policy centralized intelligent analysis method provided in the embodiment of the present application; Figure 3 A schematic diagram of the overall steps of the security policy centralized intelligent analysis method provided in the embodiment of the present application; Figure 4 A schematic diagram of a centralized intelligent security policy analysis system provided in an embodiment of the present application; Figure 5This is a structural diagram of the security policy centralized intelligent analysis device provided in an embodiment of the present application. DETAILED DESCRIPTION

[0017] In order to enable those skilled in the art to better understand the technical solutions provided by the embodiments of the present application and to make the above-mentioned purposes, features and advantages of the embodiments of the present application more obvious and understandable, the technical solutions in the embodiments of the present application are further described in detail below in conjunction with the accompanying drawings.

[0018] Currently, the method for detecting security policies in security devices is usually that the administrator manually checks the security policy information configured on the security device and evaluates the security risks that each policy may bring based on his or her own security knowledge and experience.

[0019] However, as the scale of networks continues to expand and the number of security policies increases, manual analysis requires a lot of time and effort. For example, for large enterprises, the number of network devices and security policies is extremely large, and the speed of manual analysis is far from meeting the needs of rapid response to security incidents. At the same time, different security administrators may have different understandings and evaluation criteria of security policies, resulting in a lack of consistency in analysis results, which may affect the overall effectiveness and reliability of enterprise security policies.

[0020] Based on this, the present application proposes a centralized intelligent analysis method for security policies to automatically perform centralized analysis on security policies in the network.

[0021] Please refer to Figure 1 , Figure 1 A flowchart of the centralized intelligent analysis method for security policies provided in an embodiment of the present application.

[0022] In this embodiment, the method can be applied to network devices in the network, such as servers, etc., and can also be applied to a security management platform that manages security policies, and this application does not impose any restrictions on this.

[0023] like Figure 1 As shown, the method may include the following steps: Step 101: Calling a collector matched with each security device to collect security policy configuration information of each security device.

[0024] The security policy configuration information of any security device is used to indicate the behavior rules configured for the security device.

[0025] In this embodiment, taking into account that there may be multiple security devices of different types from different manufacturers in the network at the same time, different collectors can be written in advance for different security device types from different manufacturers, and the collectors can be stored in a collector library. At the same time, the collector library also stores the correspondence between each collector and the security device (such as the correspondence between the collector identifier and the security device identifier, which is not limited in this application), so that when performing security policy analysis on any security device, the collector corresponding to the security device can be obtained from the collector library according to the identifier of the security device, and the collector can be called to collect security policy configuration information from the security device.

[0026] Since the security devices included in the network may change, when a new security device exists in the network, if it is detected that the security device is not configured with a corresponding collector, a corresponding collector can be written for the security device and the collector library can be updated.

[0027] In this embodiment, the security device may be a firewall, an intrusion detection system, etc., and the security policy configuration information collected by the collector may be a packet filtering policy, an intrusion prevention system (IPS: Intrusion Prevention System) rule, a routing policy, a network address translation (NAT: Network Address Translation) policy, etc., and this application does not impose any restrictions on this.

[0028] As an embodiment, a specific method of calling a collector matched with each security device to collect security policy configuration information of each security device may include: For each security device, determine the collector that matches the security device; The collector matched with the security device is called to collect the security policy configuration information of the security device according to the preset collection trigger event.

[0029] The collection triggering event may include: satisfying a preset collection period; or receiving a security policy configuration information update notification sent by a security device.

[0030] In this embodiment, a periodic collection task can be set, that is, the collector is called at a preset time interval (collection period) to obtain the latest policy information of the security device; the event notification mechanism in the security device can also be used, for example, when a notification indicating a change in security policy configuration information is received, the collector is called to obtain the latest policy information of the device.

[0031] As an embodiment, the method of obtaining the security policy configuration information of the device through the collector may include: collecting through the secure shell protocol (SSH: Secure Shell) command line or application programming interface (API: Application Programming Interface) collection, etc., and this application does not limit this.

[0032] In this embodiment, the security policy configuration information collected by each security device through the collector may include multiple pieces or one piece, and this application does not limit this.

[0033] At this point, the description of step 101 ends, and step 102 is executed next.

[0034] Step 102: Invoke the parser matched with each security device to parse the collected security policy configuration information of each security device to obtain the policy parsing result corresponding to each security device.

[0035] In this embodiment, different parsers can also be written in advance for different security device types from different manufacturers, and the parsers can be stored in a parser library. At the same time, the collector library also stores the correspondence between each parser and the security device (such as the correspondence between the parser identifier and the security device identifier, which is not limited in this application), so that when performing security policy analysis on any security device, the parser corresponding to the security device can be obtained from the parser library according to the identifier of the security device, and the parser can be called to parse the security policy configuration information collected from the security device.

[0036] Similar to the above collector, since the security devices included in the network will change, when there is a new security device in the network, if it is detected that the security device is not configured with a corresponding parser, a corresponding parser can be written for the security device and the parser library can be updated.

[0037] After the security policy configuration information corresponding to each security device is determined according to step 101, the security policy configuration information corresponding to each security device may be parsed by a parser corresponding to each security device to obtain a policy parsing result corresponding to each security device.

[0038] As an embodiment, taking the security policy configuration information corresponding to the security device as packet filtering information as an example, the policy parsing result obtained by parsing the packet filtering information through the parser may be the corresponding five-tuple information.

[0039] Specifically, the method of calling the parser matched with each security device to parse the collected security policy configuration information of each security device to obtain the policy parsing result corresponding to each security device may include: For each security device, determine a parser that matches the security device; Preprocessing the security policy configuration information of each security device through a parser matched with each security device, so that the security policy configuration information of each security device after preprocessing has the same format; Decomposing the security policy configuration information preprocessed by each security device into multiple grammatical units according to a preset grammatical structure; The multiple grammatical units are parsed to obtain policy parsing results corresponding to each security device.

[0040] In this embodiment, the parser first preprocesses the security policy configuration information. The preprocessing process may include deduplication processing, format normalization, and missing value processing.

[0041] In this embodiment, the format of the policy parsing results obtained after calling the parser corresponding to each security device to parse the security policy configuration information of each security device is exactly the same, which is equivalent to completing the format standardization of the security policy configuration information of heterogeneous devices.

[0042] Among them, the security policy configuration information after preprocessing has the same format means that the data types of the security policy configuration information after preprocessing are the same, and the same attributes (such as rules, conditions, operations, etc.) in the security policy configuration information have the same field name, follow the same logical order and expression method.

[0043] For example, security policy configuration information from different sources may use different data formats (such as JSON, YAML, XML, etc.). After preprocessing, the data formats can be uniformly converted into the same standard format.

[0044] For another example, the expression method or field name used to describe the same attribute in security policy configuration information from different sources may be different. For example, the "source IP" may be called the "source address", "sender IP", etc. in different security policy configuration information. This situation is not conducive to centralized analysis of the security policy configuration information. For such situations where the descriptions of the same attribute are different, a standard format can be preset so that the descriptions of the same attribute in the pre-processed security policy configuration information are uniformly converted into the same standard format.

[0045] In this embodiment, after the security policy configuration information is preprocessed, security policy configuration information having the same format is obtained.

[0046] Furthermore, the preprocessed security policy configuration information is decomposed according to a preset grammatical structure to obtain a plurality of grammatical units, each grammatical unit is used to represent an attribute of the security policy configuration information, and the plurality of grammatical units are parsed to obtain policy parsing results corresponding to each security device.

[0047] Specifically, the attribute value of the attribute indicated by each grammatical unit may be determined, and a set of attribute values ​​of the attributes indicated by multiple grammatical units obtained by decomposing the security policy configuration information is used as the policy key information corresponding to the security device.

[0048] Still taking the security policy configuration information corresponding to the security device as packet filtering information as an example, the policy parsing result obtained by parsing the packet filtering information through the parser can specifically be the specific value of the corresponding five-tuple information, such as source address, destination address, port number, protocol type, action (allow or deny), etc.

[0049] In this embodiment, the parser may be a finite state automaton, which is not limited in this application.

[0050] As an embodiment, after determining the policy parsing result corresponding to the security policy configuration information of each security device, the policy parsing result may be further stored as structured data, such as JSON data, for subsequent query and call.

[0051] At this point, the description of step 102 ends, and step 103 is executed next.

[0052] Step 103 , for each security device corresponding to the policy analysis result, search for a security rule matching the policy analysis result in the established knowledge base, and analyze the security risk of the security policy configuration information of the security device according to the search result.

[0053] In this embodiment, a knowledge base corresponding to various security rules may be pre-established. The knowledge base is classified and organized according to different security standards, industry specifications and common vulnerabilities, and stores a large number of security rules.

[0054] As an example, the security rules stored in the knowledge base may include: Object security type rules are used to detect duplicate objects, unused objects, isolated objects, and objects with abnormal permissions in the system to ensure that object configuration complies with the principle of minimizing permissions; Compliance baseline security type rules are used to evaluate whether the system configuration complies with industry security standards and regulatory requirements, and identify high-risk ports, configuration risks, compliance risks, and statistical risks; Policy security type rules are used to optimize the effectiveness of security policies in the system and detect redundant policies, hidden policies, expired policies, and mergeable policies.

[0055] The following is a brief introduction to the detection content that may be included in each of the above rules: Duplicate objects: The same configuration is defined repeatedly (such as duplicate firewall rules, redundant user accounts).

[0056] Unapplied object: The configuration is not actually called (for example, unbound security policy, unenabled access control rule).

[0057] Orphaned objects: Objects that have become invalid due to the removal of dependencies (such as a policy that references a deleted resource).

[0058] Objects with abnormal permissions: Permission settings exceed the principle of minimization (such as over-authorized IAM roles).

[0059] High-risk ports: Detects the opening of known risk ports (such as 22 / SSH exposed to the public network).

[0060] Configuration risk: Violation of security configuration specifications (such as weak password policies, unencrypted storage).

[0061] Compliance risks: Failure to meet regulatory requirements (e.g. insufficient log retention period, privacy data not being anonymized).

[0062] Statistical risk: Assess risk levels based on historical data (e.g., how often a certain type of vulnerability occurs in an industry).

[0063] Redundant policies: policies with overlapping coverage (for example, two ACL rules allow the same IP address).

[0064] Hidden policies: default policies that are not in effect or rules with conflicting priorities.

[0065] Expired policy: a policy that has expired and has not been updated (for example, temporary access rights are not reclaimed in a timely manner).

[0066] Merge policies: Multiple entry policies can be simplified (for example, multiple rules can be merged into one rule).

[0067] In this embodiment, each security rule included in the knowledge base corresponds to a security risk, and each security rule is also configured with a corresponding matching method.

[0068] Specifically, for each policy analysis result corresponding to each security device, searching for a security rule matching the policy analysis result in an established knowledge base, and analyzing the security risk of the security policy configuration information of the security device according to the search result may include: For each security device, the policy analysis result is matched with each security rule included in the knowledge base according to the matching mode configured for each security rule included in the knowledge base. If the match is successful, the security rule is used as the search result corresponding to the policy parsing result; The potential safety hazard corresponding to each security rule included in the search result is determined, and the potential safety hazard corresponding to each security rule included in the search result is determined as the security risk of the security policy configuration information of the security device.

[0069] In this embodiment, the matching methods include exact matching, range matching, and fuzzy matching.

[0070] In the case where the matching mode configured for any security rule is an exact match, the attribute value corresponding to each attribute in the policy parsing result is compared with the attribute value of the corresponding attribute in the security rule. If the attribute value corresponding to each attribute in the policy parsing result is the same as the attribute value of the corresponding attribute in the security rule, the security rule is determined to be a security rule that matches the policy parsing result; In the case where the matching mode configured for any security rule is range matching, the attribute value corresponding to each attribute in the policy parsing result is compared with the attribute value range configured for the corresponding attribute in the security rule. If the attribute value corresponding to each attribute in the policy parsing result belongs to the attribute value range configured for the corresponding attribute in the security rule, the security rule is determined to be a security rule that matches the policy parsing result; In the case where any security rule is configured with a fuzzy match as the matching method, the attribute value corresponding to each attribute in the policy parsing result is compared with the fuzzy matching condition configured for the corresponding attribute in the security rule. If the attribute value corresponding to each attribute in the policy parsing result satisfies the fuzzy matching condition configured for the corresponding attribute in the security rule, the security rule is determined to be a security rule that matches the policy parsing result.

[0071] Exact matching refers to directly comparing the key information of the policy and the corresponding attributes of the rule to see if they are completely consistent. For example, comparing whether the source IP address, port number, etc. are equal.

[0072] Range matching refers to judging whether the key information of a policy is within the range defined by the rule for an IP address segment, port range, etc. This can be achieved using methods such as subnet mask and interval judgment.

[0073] Fuzzy matching refers to the use of regular expressions or string matching algorithms to match when wildcards or fuzzy conditions exist in the rules.

[0074] For example, the high-risk port rule can limit the port numbers of high-risk ports under different protocols. The corresponding security risks are that they are easy to become the target of network attacks, easy to be abused, or easy to cause system vulnerabilities, and the corresponding matching method is accurate matching. When matching any policy parsing result with the high-risk port rule, the port number included in the policy parsing result can be compared with the port number of the high-risk port specified in the high-risk port rule. If the port number included in the policy parsing result is the same as the port number of the high-risk port specified in the high-risk port rule, it is determined that the policy parsing result matches the high-risk port rule, and the security policy configuration information corresponding to the policy parsing result has security risks that are easy to become the target of network attacks, easy to be abused, or easy to cause system vulnerabilities.

[0075] Similarly, security rules with range matching can limit IP address segments, port ranges, etc., for example, through subnet masks, interval judgments, etc.

[0076] The security rules with fuzzy matching mode can preset fuzzy matching conditions for different attributes, such as using regular expressions or string matching algorithms to match the policy parsing results.

[0077] After the security rules matching the policy parsing result are determined, the potential security risks corresponding to each security rule may be determined as the security risks of the security policy configuration information of the security device.

[0078] This concludes the description of step 103.

[0079] As an embodiment, each security rule included in the knowledge base is also configured with a corresponding decision suggestion, and the decision suggestion is used to eliminate the security risk corresponding to the security rule; after analyzing the security risk of the security policy configuration information of the security device according to the search result, the method may also include: According to the search result, a decision suggestion for configuring each security rule included in the search result is determined, so as to adjust the security policy configuration information of the security device based on the decision suggestion for configuring each security rule included in the search result.

[0080] In this embodiment, a corresponding decision suggestion may be configured for each security rule, and the suggestion is used to instruct the user to make a specified adjustment to the security policy configuration information to eliminate the potential security risk corresponding to the security rule.

[0081] It should be noted that, in addition to the above-mentioned matching methods, decision suggestions and detailed descriptions of the rules, each security rule may also be configured with a rule ID, a rule type, a rule name and a rule level.

[0082] Before executing the method proposed in this embodiment through the network device, the user may configure the corresponding analysis task for this security policy analysis in advance. The analysis task may include: The security devices that require security policy analysis, the types of rules that require analysis, etc.

[0083] In this embodiment, the security devices that need to be collected and analyzed (selected based on the identification of the security devices) and the security rules in the knowledge base that need to be matched (selected based on the rule ID, rule type, rule name, rule level, etc. of the security rules) can be determined in advance to avoid security policies that do not need to be analyzed or security rules that do not need to be paid attention to from participating in this security policy analysis.

[0084] After performing security policy analysis on the security devices included in the above analysis tasks according to the security policy centralized intelligent analysis method proposed in this embodiment, the security risks and decision recommendations corresponding to each security policy configuration information in each security device can be displayed in an intuitive manner through a display device for user viewing.

[0085] Similarly, the security risks and decision suggestions corresponding to each security policy configuration information in the security device selected for this analysis task can be counted and summarized to obtain the overall security situation corresponding to this task, such as displaying key indicators of security policies, such as the total number of rules, the number of conflicting rules, the number of redundant rules, the number of vulnerability risks, etc. All problematic security policy configurations can also be listed, including detailed information of the rules (source address, destination address, port number, protocol type, action, etc.), to analyze the impact scope and potential risks of problematic policies, and provide solution suggestions.

[0086] This concludes Figure 1 Description of the flowchart of the centralized intelligent analysis method for security policies.

[0087] The present application collects the security policy configuration information of each security device by calling a collector matched with each security device, and parses the security policy configuration information by calling a parser matched with each security device to obtain a policy parsing result. Further, for each policy parsing result, a security rule matching the policy parsing result is searched in an established knowledge base, and based on the search result, the security risk of the security policy configuration information of the security device is analyzed, thereby realizing automatic overall assessment of the security risk of the security policy configuration information of each security device in the network, and improving the efficiency and accuracy of the security policy configuration information analysis.

[0088] Furthermore, this embodiment unifies the policy key information format corresponding to the heterogeneous security devices included in the network, and can centrally analyze the security policy information included in the entire network, obtain security risk analysis results for the entire network and corresponding decision-making recommendations, avoiding ignoring security risks and policy conflicts across devices.

[0089] According to the following Figure 2 An overall description of the intelligent analysis method proposed in this application is given.

[0090] Please refer to Figure 2 , Figure 2 A schematic diagram of the overall steps of the security policy centralized intelligent analysis method provided in an embodiment of the present application.

[0091] like Figure 2 As shown, the method comprises the following steps: Policy collection, automatically identify and call different collectors to collect security policy information from various security devices (such as firewalls, intrusion detection systems, etc.), such as packet filtering policies, IPS rules, routing policies, NAT policies, etc.

[0092] After completing the collection of security policy information, the collected policies can be further automatically identified and called by different parsers to convert policies of different manufacturers and models into a unified format.

[0093] The security policy information converted into a unified format is matched with the rules in the knowledge base, and it is determined whether the security policy information contains potential security risks according to the corresponding security rules.

[0094] If so, the assessment results such as security risks are displayed on a display device in the form of charts or the like; If not, continue monitoring and return to the step of matching the security policy information converted into a unified format with the rules in the knowledge base.

[0095] This concludes Figure 2 Description.

[0096] Please refer to Figure 3 , Figure 3 A schematic diagram of the overall steps of the security policy centralized intelligent analysis method provided in an embodiment of the present application.

[0097] like Figure 3 As shown, the method comprises the following steps: The corresponding analysis task is configured in advance for this security policy analysis. The analysis task may include: security devices that need to be analyzed for security policies, and rule types that need to be analyzed.

[0098] In this embodiment, the security device that needs to be analyzed for security policy can be selected based on the identification of the security device, or specific security policy configuration information that needs to be analyzed for security policy can be selected. At the same time, the security rules in the knowledge base that need to be matched can be selected based on the rule ID, rule type, rule name, rule level, etc. of the security rules stored in the knowledge base to ensure that the security policy analysis is performed on the scope selected by the user.

[0099] After completing the analysis task settings, you can Figure 1 The security policy centralized intelligent analysis method shown in the figure analyzes the security policies in the security devices indicated by the analysis task, and determines the security risks corresponding to the security policy configuration information in each security device, as well as decision suggestions.

[0100] Furthermore, the security risks and decision suggestions corresponding to each security policy configuration information in each security device can be displayed in an intuitive manner, such as in the form of charts, etc., through a display device for easy viewing by users.

[0101] The security risks and decision suggestions corresponding to each security policy configuration information in the security device selected for this analysis task can be counted and summarized to obtain the overall security situation corresponding to this task, such as displaying key indicators of security policies, such as the total number of rules, the number of conflicting rules, the number of redundant rules, the number of vulnerability risks, etc. All problematic security policy configurations can also be listed, including detailed information of the rules (source address, destination address, port number, protocol type, action, etc.), to analyze the impact scope and potential risks of problematic policies, and provide solution suggestions.

[0102] This concludes Figure 3 Description.

[0103] In addition, the application also proposes a network device.

[0104] Specifically, this embodiment provides a network device, the network to which the network device belongs also includes at least one security device, and the network device is used to execute Figure 1 The method shown.

[0105] As an embodiment, the network included in the above network devices and security devices can be recorded as a security policy centralized intelligent analysis system.

[0106] Specifically, please refer to Figure 4 , Figure 4 Schematic diagram of a centralized intelligent analysis system for security policies provided in an embodiment of the present application.

[0107] like Figure 4 As shown, the system includes: Network equipment used to perform Figure 1 Methods in At least one security device (referred to as security device 1 to security device n) is communicatively connected to the network device and is used to perform security protection on the security policy centralized intelligent analysis system according to the configured security policy configuration information.

[0108] As an embodiment, the system may further include: A display device is used to display the security assessment results corresponding to the security policy centralized intelligent analysis system.

[0109] In this embodiment, the display device may be a display screen, a touch screen device, etc., and this application does not limit this.

[0110] The method implemented for network devices has been Figure 1 The details are described in detail in the text and will not be repeated here.

[0111] This concludes Figure 4 Description of the centralized intelligent analysis system for security policies.

[0112] based on Figure 4 The security policy centralized intelligent analysis system can collect security policy information from security devices of different types from different manufacturers (such as firewalls, intrusion detection systems, etc.), automatically analyze and evaluate the security policy information, and present the analysis results to users in an intuitive manner, such as reports, charts, risk warnings, and corresponding decision-making recommendations.

[0113] Please refer to Figure 5 , Figure 5 1 is a structural diagram of a security policy centralized intelligent analysis device proposed in an embodiment of the present application. The device is applied to network devices in a network. Figure 5 As shown, the device may include a collection unit 501, a parsing unit 502 and an analysis unit 503. Specifically, the device includes: The collection unit 501 is used to call the collector matched with each security device to collect the security policy configuration information of each security device; the security policy configuration information of any security device is used to indicate the behavior rules configured for the security device; The parsing unit 502 is used to call the parser matched with each security device to parse the collected security policy configuration information of each security device to obtain the policy parsing result corresponding to each security device; The analyzing unit 503 is used to search for security rules matching the policy analysis results corresponding to each security device in an established knowledge base, and analyze the security risk of the security policy configuration information of the security device according to the search results.

[0114] Optionally, the collection unit 501 is specifically used for: For each security device, determine the collector that matches the security device; Calling a collector matching the security device to collect security policy configuration information of the security device according to a preset collection trigger event; And / or, the acquisition triggering event includes: Satisfy the preset collection period; or, Receiving a security policy configuration information update notification sent by a security device; And / or, the parsing unit 502 is specifically used for: For each security device, determine a parser that matches the security device; Preprocessing the security policy configuration information of each security device through a parser matched with each security device, so that the security policy configuration information of each security device after preprocessing has the same format; Decomposing the security policy configuration information preprocessed by each security device into multiple grammatical units according to a preset grammatical structure; Parsing the multiple grammatical units to obtain policy parsing results corresponding to each security device; And / or, each security rule included in the knowledge base corresponds to a security risk, and each security rule is also configured with a corresponding matching method; the analysis unit 503 is specifically used for: For each security device, the policy analysis result is matched with each security rule included in the knowledge base according to the matching mode configured for each security rule included in the knowledge base. If the match is successful, the security rule is used as the search result corresponding to the policy parsing result; Determine the potential safety hazard corresponding to each security rule included in the search result, and determine the potential safety hazard corresponding to each security rule included in the search result as the security risk of the security policy configuration information of the security device; And / or, the matching mode includes exact matching, range matching and fuzzy matching; the analysis unit 503 is specifically used for: In the case where the matching mode configured for any security rule is an exact match, the attribute value corresponding to each attribute in the policy parsing result is compared with the attribute value of the corresponding attribute in the security rule. If the attribute value corresponding to each attribute in the policy parsing result is the same as the attribute value of the corresponding attribute in the security rule, the security rule is determined to be a security rule that matches the policy parsing result; In the case where the matching mode configured for any security rule is range matching, the attribute value corresponding to each attribute in the policy parsing result is compared with the attribute value range configured for the corresponding attribute in the security rule. If the attribute value corresponding to each attribute in the policy parsing result belongs to the attribute value range configured for the corresponding attribute in the security rule, the security rule is determined to be a security rule that matches the policy parsing result; In the case where the matching mode configured for any security rule is fuzzy matching, the attribute value corresponding to each attribute in the policy parsing result is compared with the fuzzy matching condition configured for the corresponding attribute in the security rule. If the attribute value corresponding to each attribute in the policy parsing result satisfies the fuzzy matching condition configured for the corresponding attribute in the security rule, the security rule is determined to be a security rule that matches the policy parsing result; And / or, each security rule included in the knowledge base is also configured with a corresponding decision suggestion, and the decision suggestion is used to eliminate the security risk corresponding to the security rule; the analysis unit 503 is also used to: According to the search result, a decision suggestion for configuring each security rule included in the search result is determined, so as to adjust the security policy configuration information of the security device based on the decision suggestion for configuring each security rule included in the search result.

[0115] So far, completed Figure 5 Description of the security policy centralized intelligent analysis device.

[0116] Correspondingly, an embodiment of the present application further provides a computer-readable storage medium, on which a number of computer instructions are stored. When the computer instructions are executed, the method disclosed in the above example of the present application can be implemented.

[0117] Exemplarily, the computer-readable storage medium may be any electronic, magnetic, optical or other physical storage device that may contain or store information, such as executable instructions, data, etc. For example, the computer-readable storage medium may be: RAM (Radom Access Memory), volatile memory, non-volatile memory, flash memory, storage drive (such as hard disk drive), solid state drive, any type of storage disk (such as optical disk, DVD, etc.), or similar storage medium, or a combination thereof.

[0118] The above are only preferred embodiments of the present application and are not intended to limit the present application. For those skilled in the art, the present application may have various modifications and variations. Any modification, equivalent replacement, improvement, etc. made within the spirit and principle of the present application shall be included in the scope of protection of the present application.

Claims

1. A security policy centralized intelligent analysis method, characterized in that: The method is applied to a network device in a network, and the method comprises: Calling the collector matched with each security device to collect the security policy configuration information of each security device; the security policy configuration information of any security device is used to indicate the behavior rules configured for the security device; Calling the parser matching each security device to parse the collected security policy configuration information of each security device to obtain the policy parsing result corresponding to each security device; For each policy analysis result corresponding to a security device, a security rule matching the policy analysis result is searched in an established knowledge base, and based on the search result, the security risk of the security policy configuration information of the security device is analyzed.

2. The method according to claim 1, characterized in that The calling of the collector matched with each security device to collect the security policy configuration information of each security device includes: For each security device, determine the collector that matches the security device; The collector matched with the security device is called to collect the security policy configuration information of the security device according to the preset collection trigger event.

3. The method according to claim 2, characterized in that The acquisition triggering event includes: Satisfy the preset collection period; or, Receive a security policy configuration information update notification sent by a security device.

4. The method according to claim 1, characterized in that The calling of the parser matched with each security device to parse the collected security policy configuration information of each security device to obtain the policy parsing result corresponding to each security device includes: For each security device, determine a parser that matches the security device; Preprocessing the security policy configuration information of each security device through a parser matched with each security device, so that the security policy configuration information of each security device after preprocessing has the same format; Decomposing the security policy configuration information preprocessed by each security device into multiple grammatical units according to a preset grammatical structure; The multiple grammatical units are parsed to obtain policy parsing results corresponding to each security device.

5. The method according to claim 1, characterized in that Each security rule included in the knowledge base corresponds to a security risk, and each security rule is also configured with a corresponding matching method; for the policy analysis result corresponding to each security device, searching the established knowledge base for a security rule matching the policy analysis result, and analyzing the security risk of the security policy configuration information of the security device according to the search result, including: For each security device, the policy analysis result is matched with each security rule included in the knowledge base according to the matching mode configured for each security rule included in the knowledge base. If the match is successful, the security rule is used as the search result corresponding to the policy parsing result; The potential safety hazard corresponding to each security rule included in the search result is determined, and the potential safety hazard corresponding to each security rule included in the search result is determined as the security risk of the security policy configuration information of the security device.

6. The method according to claim 5, characterized in that The matching method includes exact matching, range matching and fuzzy matching; the policy parsing result corresponding to each security device is matched with each security rule included in the knowledge base according to the matching method configured for each security rule included in the knowledge base, including: In the case where the matching mode configured for any security rule is an exact match, the attribute value corresponding to each attribute in the policy parsing result is compared with the attribute value of the corresponding attribute in the security rule. If the attribute value corresponding to each attribute in the policy parsing result is the same as the attribute value of the corresponding attribute in the security rule, the security rule is determined to be a security rule that matches the policy parsing result; In the case where the matching mode configured for any security rule is range matching, the attribute value corresponding to each attribute in the policy parsing result is compared with the attribute value range configured for the corresponding attribute in the security rule. If the attribute value corresponding to each attribute in the policy parsing result belongs to the attribute value range configured for the corresponding attribute in the security rule, the security rule is determined to be a security rule that matches the policy parsing result; In the case where any security rule is configured with a fuzzy match as the matching method, the attribute value corresponding to each attribute in the policy parsing result is compared with the fuzzy matching condition configured for the corresponding attribute in the security rule. If the attribute value corresponding to each attribute in the policy parsing result satisfies the fuzzy matching condition configured for the corresponding attribute in the security rule, the security rule is determined to be a security rule that matches the policy parsing result.

7. The method according to claim 5, characterized in that Each security rule included in the knowledge base is also configured with a corresponding decision suggestion, and the decision suggestion is used to eliminate the security risk corresponding to the security rule; After analyzing the security risk of the security policy configuration information of the security device according to the search result, the method further includes: According to the search result, a decision suggestion for configuring each security rule included in the search result is determined, so as to adjust the security policy configuration information of the security device based on the decision suggestion for configuring each security rule included in the search result.

8. A security policy centralized intelligent analysis device, characterized in that: The device is applied to a network device in a network, and the method comprises: A collection unit, used to call a collector matched with each security device to collect security policy configuration information of each security device; the security policy configuration information of any security device is used to indicate the behavior rules configured for the security device; The parsing unit is used to call the parser matched with each security device to parse the collected security policy configuration information of each security device to obtain the policy parsing result corresponding to each security device; The analysis unit is used to search for security rules matching the policy analysis results corresponding to each security device in an established knowledge base, and analyze the security risks of the security policy configuration information of the security device according to the search results.

9. The device according to claim 8, characterized in that The acquisition unit is specifically used for: For each security device, determine the collector that matches the security device; Calling a collector matching the security device to collect security policy configuration information of the security device according to a preset collection trigger event; And / or, the acquisition triggering event includes: Satisfy the preset collection period; or, Receiving a security policy configuration information update notification sent by a security device; And / or, the parsing unit is specifically used for: For each security device, determine a parser that matches the security device; Preprocessing the security policy configuration information of each security device through a parser matched with each security device, so that the security policy configuration information of each security device after preprocessing has the same format; Decomposing the security policy configuration information preprocessed by each security device into multiple grammatical units according to a preset grammatical structure; Parsing the multiple grammatical units to obtain policy parsing results corresponding to each security device; And / or, each security rule included in the knowledge base corresponds to a security risk, and each security rule is also configured with a corresponding matching method; the analysis unit is specifically used for: For each security device, the policy analysis result is matched with each security rule included in the knowledge base according to the matching mode configured for each security rule included in the knowledge base. If the match is successful, the security rule is used as the search result corresponding to the policy parsing result; Determine the potential safety hazard corresponding to each security rule included in the search result, and determine the potential safety hazard corresponding to each security rule included in the search result as the security risk of the security policy configuration information of the security device; And / or, the matching mode includes exact matching, range matching and fuzzy matching; the analysis unit is specifically used for: In the case where the matching mode configured for any security rule is an exact match, the attribute value corresponding to each attribute in the policy parsing result is compared with the attribute value of the corresponding attribute in the security rule. If the attribute value corresponding to each attribute in the policy parsing result is the same as the attribute value of the corresponding attribute in the security rule, the security rule is determined to be a security rule that matches the policy parsing result; In the case where the matching mode configured for any security rule is range matching, the attribute value corresponding to each attribute in the policy parsing result is compared with the attribute value range configured for the corresponding attribute in the security rule. If the attribute value corresponding to each attribute in the policy parsing result belongs to the attribute value range configured for the corresponding attribute in the security rule, the security rule is determined to be a security rule that matches the policy parsing result; In the case where the matching mode configured for any security rule is fuzzy matching, the attribute value corresponding to each attribute in the policy parsing result is compared with the fuzzy matching condition configured for the corresponding attribute in the security rule. If the attribute value corresponding to each attribute in the policy parsing result satisfies the fuzzy matching condition configured for the corresponding attribute in the security rule, the security rule is determined to be a security rule that matches the policy parsing result; And / or, each security rule included in the knowledge base is also configured with a corresponding decision suggestion, and the decision suggestion is used to eliminate the security risk corresponding to the security rule; the analysis unit is also used to: According to the search result, a decision suggestion for configuring each security rule included in the search result is determined, so as to adjust the security policy configuration information of the security device based on the decision suggestion for configuring each security rule included in the search result.

10. A network device, characterized in that: The network to which the network device belongs also includes at least one security device, and the network device is used to execute the method as claimed in any one of claims 1 to 7.

Images