System and method for generating Selinux strategy based on natural language processing

Abstract

The invention relates to the technical field of operating systems, in particular to a system and method for generating a Selinux strategy based on natural language processing, and the system comprises a log extraction and recognition module, a data annotation and model training module, a strategy prediction and generation module, and a security verification and deployment module. The method has the beneficial effects that the model can continuously optimize the strategy generation logic by continuously learning the compiling error and the correction process, and the quality and the stability of the generated strategy are improved. The method not only reduces the difficulty of strategy implementation and deployment, but also reduces the cost, and has a wide application prospect.

Description

Technical Field

[0001] The present invention relates to the technical field of operating systems, and in particular, to a system and method for generating SELinux policies based on natural language processing. Background Art

[0002] In the current era of highly developed informatization, as the core software of computing devices, the operating system undertakes the key responsibilities of managing hardware resources and providing an application running environment. The security of the operating system is directly related to the stability of the entire computing environment, the integrity of data, and the protection of user privacy. With the popularization of the Internet and the complexity of application systems, network attack methods have become increasingly diverse and intelligent, and traditional security protection mechanisms have become difficult to cope with complex and changing threats. Security incidents such as malware, unauthorized access, and data leakage occur frequently, threatening not only the privacy and security of individual users but also the critical business systems of enterprises and organizations. Therefore, improving the security protection ability of the operating system and building a solid security defense line have become the primary tasks for ensuring the overall security of information systems.

[0003] SELinux (Security-Enhanced Linux), as a security architecture based on mandatory access control (MAC), significantly enhances the security of the Linux operating system. Different from the traditional discretionary access control (DAC) mechanism, SELinux strictly controls the access rights of various resources in the system through fine-grained policy management, ensuring that only authorized processes and users can perform specific operations. This mandatory policy implementation effectively isolates the interaction between different processes and users, preventing the spread of malware and the leakage of sensitive data. SELinux not only improves the integrity of the system, ensuring that key system components are not tampered with in the face of attacks, but also enhances the confidentiality of the system, protecting the security of data during storage and transmission. However, the high security of SELinux also brings complexity in policy writing and management, requiring system administrators to have in-depth security policy knowledge and a comprehensive understanding of system behavior.

[0004] Although SELinux has significant advantages in enhancing the security of operating systems, the process of writing and maintaining its policies is complex and cumbersome, which has become the main obstacle to its promotion and application. Existing policy generation tools, such as audit2allow, can generate policies based on AVC logs, but they have obvious limitations in flexibility and applicability. Firstly, these tools often lack a deep understanding of the application context and system environment, making it difficult to generate optimal policy rules, resulting in problems such as over-authorization or insufficient permissions. Secondly, there may be a large number of false alarms or irrelevant AVC logs in the system, and existing methods are difficult to effectively filter out the noise, and the generated policy rules may be redundant and unnecessary. In addition, syntax errors or logical errors may occur during the compilation of the generated policies. The current methods for generating policies lack intelligent processing for feedback and correction of compilation errors, and cannot automatically identify the cause of the errors and provide correction suggestions. Manual intervention is often required to correct these errors, increasing the workload and the risk of errors. Summary of the Invention

[0005] An object of the present invention is to provide a system and method for generating SELinux policies based on natural language processing to solve the problems raised in the above background technology.

[0006] To achieve the above object, the present invention provides the following technical solutions: A system for generating SELinux policies based on natural language processing, comprising:

[0007] Log extraction and recognition module: configured to extract time-related event logs from system audit logs, security logs, and message logs, and use regular expressions and named entity recognition models to double-extract key information such as source context, target context, target class, execution command, and executable program path;

[0008] Data annotation and model training module: perform sequence annotation on the extracted logs through the Doccano tool to generate training data in JSONL format, and respectively construct a policy log entity recognition model and a policy generation model based on the pre-trained models BERT-base-cased and T5;

[0009] Policy prediction and generation module: use the trained model to predict policy elements, and dynamically generate standardized SELinux policy codes in combination with a predefined template engine, supporting multi-format policy template management and automated variable binding;

[0010] Security verification and deployment module: integrate a rule engine to verify the compliance of the policy, perform lexical and syntactic analysis through Lex / Yacc, automatically repair compilation dependency problems, and compile and deploy the verified policy to the target system.

[0011] Preferably, the log extraction and recognition module specifically includes: synchronizing multi-source heterogeneous logs using a timestamp alignment algorithm, merging related events in audit logs, security logs, and message logs using Pandas to generate structured log data containing complete context; when the NER model is not established, extracting keyword fields by matching log patterns using regular expressions, and after establishing the NER model, enhancing the entity recognition granularity by combining the output of a deep learning model.

[0012] Preferably, the data annotation and model training module specifically includes:

[0013] Designing a sequence-to-sequence annotation pattern, using the Doccano tool to perform entity-level annotation on log texts to generate an annotation dataset containing tags such as USER, COMMAND, PERMISSION, and FILE_PATH; adopting a transfer learning framework, initializing the log NER model with the BERT-base-cased strategy, and improving the entity recognition accuracy by optimizing the hidden layer width, multi-head attention mechanism, and AdamW optimizer of the Transformer architecture; constructing a T5 generation model, dynamically adjusting the input / output sequence length, and realizing end-to-end prediction of policy elements by combining conditional generation tasks.

[0014] Preferably, the policy prediction and generation module specifically includes: defining a structured representation specification for policy elements, including fields such as policy_type, source_context, target_context, target_class, and permissions, supporting filtering, deduplication, and format standardization of policy elements; implementing a templated policy generation engine, supporting modular splicing of policy files, and dynamically generating policy code that conforms to the SELinux syntax specification through the Jinja2 template variable replacement mechanism; providing a policy template version management function, supporting switching of policy templates for multiple scenarios.

[0015] Preferably, the security verification and deployment module specifically includes: predefined multi-level security rule libraries, including command whitelists for users such as sysadm, auditadm, and secadm and a confidentiality level access matrix, realizing compliance pre-check before policy generation; integrating a Lex lexical analyzer to define the SELinux markup pattern, and a Yacc parser to construct an abstract syntax tree, automatically detecting syntax errors and dependency conflicts in policy code; designing a closed-loop feedback mechanism, converting the lexical / syntactic analysis results into actionable repair suggestions, and outputting a detailed error report through the log system, supporting policy iteration and optimization.

[0016] A method for a system for generating SELinux policies based on natural language processing, including:

[0017] Multi-source log synchronization extraction: Integrate audit logs, security logs, and message logs through a timestamp alignment algorithm, and use regular expressions and a named entity recognition model to double-extract key fields such as source context, target class, execution command, and executable program path;

[0018] Hybrid annotation training: Use the Doccano tool to perform sequence annotation on the logs, generate a JSONL-format dataset containing USER, COMMAND, and PERMISSION tags, and build a policy log entity recognition model based on optimizing the Transformer architecture with the BERT pre-trained model;

[0019] End-to-end policy generation: Dynamically predict policy elements through the T5 pre-trained model, and combine with the Jinja2 template engine to generate standardized SELinux policy code, supporting modular template management and automated variable binding;

[0020] Security closed-loop verification: Integrate Lex / Yacc for lexical and syntactic analysis, pre-define a multi-level security rule library, automatically repair compilation dependencies and output error reports to ensure policy compliance.

[0021] Preferably, the log extraction method specifically includes:

[0022] Heterogeneous log alignment: Use Pandas to merge multi-source logs, and achieve timestamp tolerance alignment within 1 second through the pd.merge_asof function to generate structured log data;

[0023] Hybrid extraction mechanism: When the NER model is not established, use regular expressions to extract textline-format logs; after the model is established, fuse the output of NER deep learning to improve the entity recognition granularity.

[0024] Preferably, the model training method specifically includes:

[0025] Transfer learning framework: Initialize the NER model with BERT-base-cased, and fine-tune the Transformer architecture through the AdamW optimizer to improve the accuracy of log entity recognition;

[0026] Conditional generation task: Build a T5 generation model, dynamically adjust the input / output sequence length, achieve end-to-end prediction of policy elements, and support automated filling of multi-format policy templates.

[0027] Preferably, the policy generation method specifically includes:

[0028] Structured element definition: Standardize policy element fields, support filtering, deduplication, and format standardization;

[0029] Dynamic Template Engine: Realizes modular policy splicing through Jinja2, supports multi-scenario template switching, and renders complete policy code based on the structured data of policy_elements.

[0030] Preferably, the security verification method includes:

[0031] Multi-level Rule Pre-check: Pre-defines the white list of sysadm and auditadm user commands and the MLS confidentiality access matrix to prevent the generation of unauthorized policies;

[0032] Automated Error Repair: Utilizes Lex to define token patterns and Yacc to construct an abstract syntax tree, detects syntax errors and dependency conflicts in the policy code, and generates an error report with repair suggestions;

[0033] Closed-loop Feedback Mechanism: Converts the results of lexical / syntactic analysis into actionable suggestions, outputs a detailed report through the logging system, and supports policy iteration and optimization.

[0034] Compared with the prior art, the beneficial effects of the present invention are:

[0035] The system and method for generating selinux policies based on natural language processing proposed by the present invention, compared with the traditional method of generating selinux policies, supports intelligent error recognition of multiple logs. The provided policy NER model can analyze event error logs, automatically identify error types and causes, provide accurate correction suggestions, and reduce manual intervention; supports correlation event analysis of multiple logs of event occurrences, reduces the situation of over-authorization or under-authorization, and improves the refinement and adaptability of the policy; at the same time, uses a pre-defined rule security verification module to expand the selinux policy on the premise of ensuring the original confidentiality and integrity of the system; in addition, the provided policy generation model can support feedback learning. Through continuous learning of the compilation error and correction process, the model can continuously optimize the policy generation logic and improve the quality and stability of the generated policy. This method not only reduces the difficulty of policy implementation and deployment, but also reduces costs, and has broad application prospects. Brief Description of the Drawings

[0036] Figure 1 It is a block diagram of the system of the present invention. Detailed Embodiment

[0037] In order to clearly and completely describe the objectives, technical solutions of the present invention, and make the advantages more clearly understood, the embodiments of the present invention will be further described in detail below with reference to the accompanying drawings. It should be understood that the specific embodiments described herein are part of the embodiments of the present invention, rather than all of the embodiments, and are only used to explain the embodiments of the present invention, not to limit the embodiments of the present invention. All other embodiments obtained by those of ordinary skill in the art without creative efforts fall within the scope of protection of the present invention.

[0038] Example 1. Please refer to Figure 1 , the present invention provides a technical solution: a system for generating selinux policies based on natural language processing, including:

[0039] Log extraction and recognition module: Extract key information of event logs at the same time from the / var / log / audit / audit.log, / var / log / secure, var / log / message logs, such as source context, target context, target class, executed command, path of the executable program, etc. Before the NER model is established, use regular expressions to extract logs at the same time and convert them into textline format as the model training data for NER. After the NER model is established, both the NER model and regular expressions are used for extraction, and the outputs of both methods are passed to the data annotation module as the original dataset for annotation.

[0040] The data annotation module uses the doccano tool to manually annotate the extracted textline format logs and export them in jsonl format.

[0041] The model training module converts the jsonl format data exported by the data annotation module into the training format of the spacy tool, configures the training parameters, and uses the pre-trained model bert-base-cased to train and generate a policy log NER model, and uses the pre-trained model T5 to train and generate a policy generation model. The policy log generation NER model is used to extract and recognize security policy-related information in the logs, such as source context, target context, target class, executed command, path of the executable program, etc. The policy generation model is used to generate selinux security policies using the extracted and recognized logs.

[0042] The policy prediction module uses a policy model to predict the policy elements to be generated. It can predict the security policy elements to be generated based on structured log data and generate a structured representation of the policy elements. The policy prediction module receives structured log data from the log extraction and recognition module. The log data undergoes cleaning and normalization data processing to generate data with a consistent format. It uses a policy log NER model to identify key entities and generates policy elements using a policy generation model based on the extracted valid key entities. After filtering, deduplication, and format adjustment, the predicted policy elements are passed to the policy generation module.

[0043] The policy generation module uses a policy template to generate standardized policy code, improving the generation efficiency and consistency. The policy generation module uses the policy elements provided by the policy prediction module and generates standardized security policy code using a predefined template. The policy generation module supports the management and maintenance of policy templates and supports multiple policy formats. The policy generation module selects an appropriate policy template according to the policy type and context, then binds the policy elements to the template variables. Finally, it uses a template engine (Jinja2) to render the template and generate the complete policy code. The generated policy code is passed to the security verification module.

[0044] The security verification module performs security checks through a rule engine to ensure the security of the policy. The predefined rules define the commands that sysadm, auditadm, and secadm users can execute and the access permissions for each mls confidentiality level. The rules are as follows: Programs not in the predefined names are not allowed to generate policies; Processes or users with a low confidentiality level can write high-level files, and processes or users with a high confidentiality level can read low-level files.

[0045] The policy verification module uses a lexical and syntax analysis module to check the syntax, solve compilation problems, and compilation dependency problems. The policy verification module uses a lexical and syntax analysis module to check the syntactic correctness of the policy code, solve compilation problems and dependency problems, and provide detailed error messages and suggestions to help quickly locate and fix problems in the policy. Among them, the Lex (Flex) lexical analyzer defines the token patterns in the log; the Yacc (Bison) syntax analyzer defines the syntax rules of the policy and parses the information required by the policy. It checks the correctness of the policy through lexical and syntax analysis, identifies compilation errors and dependency problems, supports the generation of error reports, and feeds them back to the policy generation or development team for correction.

[0046] The policy compilation and policy deployment module is responsible for compiling the policy, compiling the verified policy code into a format recognizable by the system, and loading the compiled policy into the target system to ensure that the policy takes effect.

[0047] Sample code and processing flow:

[0048] Log extraction and recognition module:

[0049]

[0050]

[0051]

[0052]

[0053]

[0054]

[0055]

[0056]

[0057]

[0058] Before the NER model is established, the model uses regular expressions to extract valid logs. After the NER model is established, both the NER model and regular expressions are used to extract logs.

[0059] The format of regular expression extraction is

[0060]

[0061]

[0062] The policy prediction module uses the log data extracted by the policy NER model and regular expressions as the input of the model, and outputs selinux policy elements. The output result format of the policy prediction module is:

[0063]

[0064] The data annotation module uses the doccano tool to import the extracted data as a dataset, and then manually adds sequence to sequence type annotations. After the annotation is completed, the data in jsonl format is exported. The data format is:

[0065]

[0066] Model training module:

[0067] The training of the policy NER model is carried out through a configuration file, using the spacy command to train the policy NER model. On the basis of the pre-trained model bert-base-cased, the model training module uses the labeled dataset and continuously optimizes the model through the loss function and optimizer to obtain a policy NER model that meets the requirements.

[0068] The training command is:

[0069] python -m spacy train configs\config.cfg --output. / output --gpu-id 0

[0070] The policy generation model uses code to train the model. The policy NER model uses bert-base-cased as the pre-trained model. The policy generation model uses the T5 model as the pre-trained model.

[0071] The model configuration file of the NER model is:

[0072]

[0073]

[0074]

[0075]

[0076]

[0077]

[0078]

[0079]

[0080]

[0081] Policy generation module:

[0082] The policy generation module uses the elements predicted and output by the policy to render and generate the corresponding policy using the policy template. The template format is:

[0083]

[0084]

[0085] Example 2, on the basis of Example 1, a method for a system using natural language processing to generate selinux policies is proposed, including:

[0086] Multi-source Log Synchronous Extraction: Integrate audit logs, security logs, and message logs through a timestamp alignment algorithm, and use regular expressions and named entity recognition models to double-extract source context, target class, execution commands, and executable program path keyword fields. The log extraction method specifically includes: Heterogeneous Log Alignment: Use Pandas to merge multi-source logs, and achieve timestamp tolerance alignment within 1 second through the pd.merge_asof function to generate structured log data; Hybrid Extraction Mechanism: When the NER model is not established, use regular expressions to extract textline format logs; after the model is established, fuse the NER deep learning output to improve the entity recognition granularity.

[0087] Hybrid Annotation Training: Use the Doccano tool to perform sequence annotation on the logs, generate a JSONL format dataset containing USER, COMMAND, and PERMISSION tags, and construct a policy log entity recognition model based on the BERT pre-trained model to optimize the Transformer architecture. The model training method specifically includes: Transfer Learning Framework: Initialize the NER model with BERT-base-cased, and fine-tune the Transformer architecture through the AdamW optimizer to improve the accuracy of log entity recognition; Conditional Generation Task: Construct a T5 generation model, dynamically adjust the input / output sequence length, and achieve end-to-end prediction of policy elements to support automatic filling of multi-format policy templates.

[0088] End-to-End Policy Generation: Dynamically predict policy elements through the T5 pre-trained model, and combine with the Jinja2 template engine to generate standardized SELinux policy code, supporting modular template management and automatic variable binding. The policy generation method specifically includes: Structured Element Definition: Standardize policy element fields, support filtering, deduplication, and format standardization; Dynamic Template Engine: Achieve modular policy splicing through Jinja2, support multi-scenario template switching, and render complete policy code based on the structured data of policy_elements.

[0089] Security Closed-Loop Verification: Integrate Lex / Yacc for lexical and syntactic analysis, pre-define a multi-level security rule library, automatically repair compilation dependencies, and output error reports to ensure policy compliance. The security verification method includes: Multi-level Rule Pre-check: Pre-define sysadm and auditadm user command whitelists and MLS confidentiality access matrices to prevent unauthorized policy generation; Automatic Error Repair: Use Lex to define token patterns, and Yacc to construct an abstract syntax tree to detect syntax errors and dependency conflicts in the policy code, and generate an error report with repair suggestions; Closed-Loop Feedback Mechanism: Convert the lexical / syntactic analysis results into actionable suggestions, output a detailed report through the log system, and support policy iteration optimization.

[0090] Although embodiments of the present invention have been shown and described, it will be understood by those of ordinary skill in the art that various changes, modifications, substitutions and variations can be made to these embodiments without departing from the principles and spirit of the present invention, and the scope of the present invention is defined by the appended claims and their equivalents.

Claims

1. A system for generating SELinux policies based on natural language processing, characterized in that: Including: Log extraction and recognition module: Configured to extract time-related event logs from system audit logs, security logs, and message logs, and use regular expressions and named entity recognition models to extract key information such as source context, target context, target class, execution command, and executable program path; Data annotation and model training module: Perform sequence annotation on the extracted logs through the Doccano tool to generate training data in JSONL format, and build a policy log entity recognition model and a policy generation model based on the pre-trained models BERT-base-cased and T5 respectively; Policy prediction and generation module: Use the trained model to predict policy elements, and dynamically generate standardized SELinux policy codes in combination with a predefined template engine, supporting multi-format policy template management and automated variable binding; Security verification and deployment module: Integrate a rule engine to verify policy compliance, perform lexical and syntactic analysis through Lex / Yacc, automatically repair compilation dependency problems, and compile and deploy the verified policies to the target system.

2. The system for generating selinux policies based on natural language processing according to claim 1, wherein: The log extraction and recognition module specifically includes: Synchronize multi-source heterogeneous logs using a timestamp alignment algorithm, use Pandas to merge related events in audit logs, security logs, and message logs to generate structured log data containing complete context; When the NER model is not established, extract keyword fields by matching log patterns with regular expressions. After the NER model is established, combine the output of the deep learning model to enhance the entity recognition granularity.

3. The system for generating selinux policies based on natural language processing according to claim 2, characterized in that: The data annotation and model training module specifically includes: Design a sequence-to-sequence annotation mode, use the Doccano tool to perform entity-level annotation on log texts to generate an annotation dataset containing tags such as USER, COMMAND, PERMISSION, and FILE_PATH; Adopt a transfer learning framework, initialize the policy log NER model with BERT-base-cased, and improve the entity recognition accuracy by optimizing the hidden layer width, multi-head attention mechanism, and AdamW optimizer of the Transformer architecture; Build a T5 generation model, dynamically adjust the input / output sequence length, and combine conditional generation tasks to achieve end-to-end prediction of policy elements.

4. The system for generating selinux policies based on natural language processing according to claim 3, characterized in that: The policy prediction and generation module specifically includes: Define a structured representation specification for policy elements, including fields such as policy_type, source_context, target_context, target_class, and permissions, to support filtering, deduplication, and format standardization of policy elements; Implement a templated policy generation engine that supports modular policy file splicing and dynamically generates policy codes that conform to the SELinux syntax specification through the Jinja2 template variable replacement mechanism; Provide a policy template version management function to support switching between multi-scenario policy templates.

5. The system for generating selinux policies based on natural language processing according to claim 4, characterized in that: The security verification and deployment module specifically includes: a predefined multi-level security rule library, which contains the command whitelists of sysadm, auditadm, and secadm users and the confidentiality level access matrix, to achieve pre-compliance inspection before policy generation; integrating the Lex lexical analyzer to define the SELinux tagging mode, and the Yacc parser to construct the abstract syntax tree, automatically detecting syntax errors and dependency conflicts in the policy code; designing a closed-loop feedback mechanism to convert the lexical / syntactic analysis results into actionable repair suggestions, outputting detailed error reports through the logging system, and supporting policy iteration and optimization.

6. A method for a system for generating selinux policies based on natural language processing according to claim 5, characterized in that: Including: Multi-source log synchronization and extraction: Integrate audit logs, security logs, and message logs through the timestamp alignment algorithm, and use regular expressions and the named entity recognition model to double-extract the source context, target class, executed command, and executable program path keyword fields. Hybrid annotation training: Use the Doccano tool to perform sequence annotation on the logs, generate a JSONL format dataset containing USER, COMMAND, and PERMISSION tags, and build a policy log entity recognition model based on optimizing the Transformer architecture with the BERT pre-trained model. End-to-end policy generation: Dynamically predict policy elements through the T5 pre-trained model, and combine with the Jinja2 template engine to generate standardized SELinux policy code, supporting modular template management and automated variable binding. Security closed-loop verification: Integrate Lex / Yacc for lexical and syntactic analysis, predefined multi-level security rule libraries, automatically repair compilation dependencies and output error reports to ensure policy compliance.

7. A method according to claim 6, wherein: The log extraction method specifically includes: Heterogeneous log alignment: Use Pandas to merge multi-source logs, and achieve timestamp tolerance alignment within 1 second through the pd.merge_asof function to generate structured log data. Hybrid extraction mechanism: When the NER model is not established, use regular expressions to extract textline format logs; after the model is established, fuse the NER deep learning output to improve the entity recognition granularity.

8. A method according to claim 6, wherein: The model training method specifically includes: Transfer learning framework: Initialize the NER model with BERT-base-cased, and fine-tune the Transformer architecture through the AdamW optimizer to improve the accuracy of log entity recognition. Conditional generation task: Construct a T5 generation model, dynamically adjust the input / output sequence length, achieve end-to-end prediction of policy elements, and support automated filling of multi-format policy templates.

9. A method according to claim 6, characterized in that: The policy generation method specifically includes: Structured element definition: Standardize policy element fields, support filtering, deduplication, and format standardization. Dynamic template engine: Implement modular policy splicing through Jinja2, support multi-scenario template switching, and render the complete policy code based on the policy_elements structured data.

10. A method according to claim 6, wherein: The security verification method includes: Multi-level rule pre-inspection: Predefine the command whitelists of sysadm and auditadm users and the MLS confidentiality access matrix to prevent unauthorized policy generation. Automated error repair: Use Lex to define token patterns, Yacc to construct an abstract syntax tree, detect syntax errors and dependency conflicts in the policy code, and generate an error report with repair suggestions; Closed-loop feedback mechanism: Convert the lexical / syntactic analysis results into actionable suggestions, output a detailed report through the logging system, and support iterative optimization of the policy.

Images