Network isolation system supporting multi-dimensional auditing

Abstract

The invention relates to the technical field of network security, and discloses a network isolation system supporting multi-dimensional auditing, which comprises an access control module, a security isolation module, an auditing analysis module and a management platform module, the access control module is used for carrying out identity verification and protocol legality verification on the access request; the security isolation module is connected with the access control module and is used for performing protocol stripping and content cleaning on the verified data stream; and the auditing analysis module is in bidirectional communication with the security isolation module and the management platform module, and is used for collecting multi-dimensional auditing data pieces of the network layer, the application layer and the user behavior layer. According to the method, the abnormal access behavior is detected in real time, when high-frequency unconventional port access is detected, a risk early warning mechanism is triggered, an alarm event is generated, and the management platform is linked to dynamically adjust an access strategy, so that quick response and active defense to potential attack behaviors are realized, and the recognition and blocking capabilities of the system to complex threats are improved.

Description

Technical Field

[0001] The present invention relates to the field of network security technology, and in particular to a network isolation system supporting multi-dimensional auditing. Background Art

[0002] The network isolation system is a core technical means to ensure the security of critical information infrastructure. It limits data interaction between different security domains through physical or logical isolation mechanisms to prevent unauthorized access and attack penetration. Traditional network isolation technology mainly relies on protocol filtering, one-way transmission equipment and basic access control strategies to achieve network boundary protection, such as one-way data transmission based on optical gates, protocol proxy gateways and other solutions. Such systems usually focus on network layer traffic control and lack the ability to collaboratively analyze multi-dimensional security factors such as application layer protocol content and user operation behavior.

[0003] Existing network isolation systems have significant deficiencies in auditing and dynamic protection. Auditing functions are mostly limited to network-layer traffic statistics and blacklist and whitelist matching, without performing correlation analysis on high-risk dimensions such as application-layer protocol parsing and user operation sequences. This results in the inability to identify advanced persistent threats disguised in legitimate protocols. Summary of the Invention

[0004] In order to make up for the above shortcomings, the present invention provides a network isolation system that supports multi-dimensional auditing, aiming to improve the problem of relying on network layer traffic auditing and static policies, lacking the ability to deeply analyze application layer protocols and user behavior correlation analysis, and having difficulty in identifying advanced threats of APT attacks.

[0005] In a first aspect, the present invention provides the following technical solution: a network isolation system supporting multi-dimensional auditing, comprising:

[0006] Access control module, security isolation module, audit analysis module and management platform module;

[0007] The access control module is used to perform identity authentication and protocol legitimacy verification on access requests and generate dynamic access policies;

[0008] The security isolation module is connected to the access control module and is used to perform protocol stripping and content cleaning on the data stream that passes the verification, and to achieve cross-segment transmission through an encrypted channel;

[0009] The audit analysis module communicates bidirectionally with the security isolation module and the management platform module to collect multi-dimensional audit data of the network layer, application layer and user behavior layer, generate audit reports and trigger alarm events;

[0010] The management platform module is used to configure security policies, store audit logs and visually display system operation status.

[0011] By adopting the above technical solution, four modules are collaboratively constructed to form a full-process protection system of access control, data isolation, behavior auditing and policy management, solving the problems of single audit dimension and lagging policy updates in traditional isolation systems.

[0012] Preferably, the access control module includes:

[0013] Identity authentication unit, which dynamically verifies user identity based on multi-factor authentication technology;

[0014] The protocol identification unit uses deep packet inspection technology to extract data flow protocol features and match them with the whitelist rule base;

[0015] The access control unit generates a dynamic access policy table based on the verification results and protocol matching degree, and sends a policy effectiveness instruction to the security isolation module.

[0016] By adopting the above technical solutions, the identity authentication unit reduces the risk of identity fraud through a dynamic multi-factor combination (such as biometrics and hardware certificates); the protocol identification unit filters unconventional protocol traffic based on the protocol feature whitelist and blocks masquerade attacks; the access control unit and the dynamic policy table implement fine-grained access authorization based on the time window.

[0017] Preferably, the safety isolation module includes:

[0018] The protocol conversion unit disassembles the original protocol into structured metadata and generates intermediate format data packets;

[0019] Data cleaning unit, which scans intermediate format data packets for malicious code and desensitizes sensitive information;

[0020] The encryption channel unit uses the national secret SM4 algorithm to perform end-to-end encryption on the cleaned data packets, and realizes physical isolation transmission through a one-way optical gate device.

[0021] By adopting the above technical solutions, the protocol conversion unit and structured metadata eliminate compatibility issues caused by protocol version differences. The data cleaning unit and malicious code scanning engine support real-time updates of the YARA rule base to improve the threat detection rate. The encryption channel unit and SM4 algorithm CBC mode are combined with the hardware security chip to prevent the leakage of encryption keys.

[0022] Preferably, the audit analysis module includes:

[0023] The data collection unit is deployed at the input and output ports of the security isolation module through probes to capture network traffic and user operation logs in real time;

[0024] The correlation analysis unit builds a three-dimensional correlation model for the collected data based on timestamp, IP quintuple and user ID;

[0025] The risk warning unit detects abnormal behavior patterns through a preset rule engine and triggers an alarm signal to the management platform module when the risk score exceeds the threshold.

[0026] By adopting the above technical solutions, the data collection unit and mirror port deployment avoid network delays caused by audit probes. The correlation analysis unit and three-dimensional model locate the spatiotemporal distribution characteristics of abnormal behaviors and reduce false positives. The risk warning unit and rule engine support regular expression matching and identify variant attack characteristics.

[0027] Preferably, the association analysis unit includes:

[0028] The session reassembly subunit reassembles and restores fragmented data packets based on TCP sequence numbers;

[0029] The behavior modeling subunit uses an LSTM neural network to perform baseline modeling of user operation sequences;

[0030] The threat scoring subunit calculates the risk coefficient of network access behavior deviating from the baseline through a weighted algorithm.

[0031] By adopting the above technical solutions, the session reassembly subunit and the sliding window mechanism ensure the integrity of the TCP stream and prevent fragmentation attacks. The behavior modeling subunit and the LSTM baseline model adaptively learn user operation habits and reduce the model misjudgment rate. The threat scoring subunit and the dynamic weight adjustment mechanism optimize the risk assessment model according to the attack trend.

[0032] Preferably, the management platform module includes:

[0033] Policy configuration unit, which provides a graphical interface for defining access control rules, audit cycles, and alarm threshold parameters;

[0034] Log storage unit, which uses blockchain technology to hash and store audit logs on the chain;

[0035] The visualization unit uses a Sankey diagram to display the data flow across network segments and a heat map to mark high-risk access nodes.

[0036] By adopting the above technical solutions, the policy configuration unit and XML format policy files support batch import and export, improving operation and maintenance efficiency. The log storage unit and alliance chain architecture realize multi-party evidence storage of audit logs to meet compliance audit requirements. The visualization unit and heat map color gradient map risk level to assist in quickly locating the source of the attack.

[0037] In a second aspect, the present invention provides the following technical solution: a network isolation method supporting multi-dimensional auditing, the method comprising the following steps:

[0038] S1. Receive an access request from a user terminal, verify the digital certificate and dynamic token through the identity authentication unit, and if the verification is successful, the protocol identification unit extracts HTTP or HTTPS protocol features and compares them with the whitelist to generate a list of IP addresses allowed to access;

[0039] S2, the security isolation module receives the authorized data stream output by S1, strips the application layer protocol header through the protocol conversion unit, removes potential malicious payloads through the data cleaning unit, and then encapsulates it into a ciphertext data packet by the encryption channel unit and transmits it to the target network;

[0040] S3, the data collection unit captures data packets before and after S2 processing in real time, and the correlation analysis unit establishes a mapping relationship between session flows and user behaviors. When the risk warning unit detects that the same user initiates more than 50 unconventional port accesses within 5 minutes, it sends a high-risk alarm to the management platform module;

[0041] S4. The management platform module receives the audit report from S3, dynamically updates the protocol whitelist rule base through the policy configuration unit, and synchronizes the update instructions to the access control module and the security isolation module.

[0042] By adopting the above technical solutions, protocol feature whitelist comparison can effectively identify illegal services in HTTPS encrypted channels, protocol header stripping retains the Host field, balancing security and network connectivity requirements, user-session binding mechanism traces the person responsible for abnormal operations, MQTT protocol guarantees policy synchronization timeliness, avoids policy effectiveness delays, method flow realizes data linkage between modules, forms double protection in dynamic token timeliness control S1 and encryption policy upgrade S3, and solves the defect that traditional static policies are easily bypassed.

[0043] Preferably, in step S3, when the risk warning unit detects that the same user initiates more than 50 unconventional port accesses within 5 minutes, the encryption policy dynamic upgrade operation is triggered, which specifically includes the following steps:

[0044] Based on the risk factor output by the threat scoring subunit, an algorithm upgrade instruction is sent to the encryption channel unit of the security isolation module to switch the end-to-end encryption algorithm from SM4 to SM9;

[0045] Abnormal data flows are intercepted through one-way optical gate devices to generate forensic images containing original data packets, protocol metadata, and user behavior logs, which are then stored in the blockchain audit chain of the management platform module.

[0046] By adopting the above technical solutions, SM9 algorithm switching and identity-based encryption mechanism realize dual binding of users and devices, enhance key management security, generate forensic images, CRC32 check to ensure the integrity of forensic data, meet judicial evidence requirements, blockchain storage, timestamp signature and multi-party consensus to prevent subsequent tampering of audit records.

[0047] In the third aspect, the invention provides the following technical solution: a computer device comprising a memory, a processor, and a computer program stored on the memory and executable on the processor, wherein the processor implements the above-mentioned network isolation method supporting multi-dimensional auditing when executing the computer program.

[0048] In a fourth aspect, the present invention provides the following technical solution: a readable storage medium having a computer program stored thereon, and when the computer program is executed by a processor, the network isolation method supporting multi-dimensional auditing is implemented.

[0049] The present invention has the following beneficial effects:

[0050] 1. In the present invention, by integrating multi-dimensional audit data of the network layer, application layer and user behavior layer, and combining it with a three-dimensional association model based on timestamp, IP quintuple and user ID, a mapping relationship between session flow and user behavior is established, and abnormal access behavior is detected in real time. When high-frequency unconventional port access is detected, a risk warning mechanism is triggered and an alarm event is generated. The linkage management platform dynamically adjusts the access policy, thereby achieving rapid response and active defense to potential attack behaviors, and improving the system's ability to identify and block complex threats.

[0051] 2. In the present invention, the original protocol is disassembled into structured metadata through the protocol conversion unit, the application layer protocol header is stripped and sensitive information is cleaned, and the end-to-end encryption channel dynamically switched by the SM4 and SM9 algorithms is combined to form a three-layer protection mechanism. The one-way optical gate device is used to achieve physical isolation transmission and block the covert channel attack path. While ensuring the efficiency of data transmission across network segments, it effectively prevents data leakage, man-in-the-middle attacks and protocol vulnerability exploitation, and enhances the security of data flow in heterogeneous network environments.

[0052] 3. In the present invention, by collecting full traffic data before and after transmission through the encrypted channel and combining it with the LSTM neural network to establish a user behavior baseline model, a weighted risk assessment is performed on operations that deviate from the baseline. The protocol whitelist rule library is automatically updated based on the audit results, and the policy parameters of the access control and security isolation modules are synchronously adjusted. At the same time, the forensic image is stored in the blockchain audit chain, thereby forming a closed-loop management process, improving the system's continuous adaptability to new attack modes and the legal effectiveness of audit evidence. BRIEF DESCRIPTION OF THE DRAWINGS

[0053] Figure 1 This is a system framework diagram of a network isolation system supporting multi-dimensional auditing proposed by the present invention;

[0054] Figure 2 This is a schematic diagram of an access control module of a network isolation system supporting multi-dimensional auditing proposed by the present invention;

[0055] Figure 3 This is a schematic diagram of a security isolation module of a network isolation system supporting multi-dimensional auditing proposed by the present invention;

[0056] Figure 4 This is a schematic diagram of an audit analysis module of a network isolation system supporting multi-dimensional auditing proposed by the present invention;

[0057] Figure 5 This is a schematic diagram of a management platform module of a network isolation system supporting multi-dimensional auditing proposed by the present invention;

[0058] Figure 6 This is a schematic diagram of a correlation analysis unit of a network isolation system supporting multi-dimensional auditing proposed by the present invention;

[0059] Figure 7 A flowchart of a network isolation method supporting multi-dimensional auditing proposed by the present invention;

[0060] Figure 8 This is a flowchart of the dynamic upgrade operation of the encryption strategy of the network isolation method supporting multi-dimensional auditing proposed by the present invention. DETAILED DESCRIPTION

[0061] The following will clearly and completely describe the technical solutions in the embodiments of the present invention with reference to the accompanying drawings. Obviously, the described embodiments are only some embodiments of the present invention, not all embodiments. All other embodiments obtained by ordinary technicians in this field based on the embodiments of the present invention without making any creative efforts shall fall within the scope of protection of the present invention.

[0062] Example 1

[0063] Reference Figures 1-6 In a first embodiment of the present invention, the present invention provides a network isolation system supporting multi-dimensional auditing, comprising:

[0064] Access control module, security isolation module, audit analysis module and management platform module;

[0065] The access control module is used to authenticate access requests and verify protocol legitimacy, generating dynamic access policies;

[0066] The security isolation module is connected to the access control module to perform protocol stripping and content cleaning on the verified data streams, and to achieve cross-segment transmission through encrypted channels;

[0067] The audit analysis module communicates bidirectionally with the security isolation module and the management platform module to collect multi-dimensional audit data at the network layer, application layer, and user behavior layer, generate audit reports, and trigger alarm events;

[0068] The management platform module is used to configure security policies, store audit logs, and visualize the system operation status.

[0069] The access control module's protocol validity check includes checking whether the protocol identifier in the packet header complies with RFC specifications. The security isolation module's protocol stripping operation strips protocol headers other than the application layer in the TCP / IP protocol stack. The audit analysis module's network layer audit data includes IP fragment reassembly status and TTL value anomaly records. The management platform module's visual display supports replaying historical data flow paths along a timeline. The protection effectiveness of the entire system is evaluated using the following formula:

[0070] E=α·A c +β·I s +γ·A a ;

[0071] Among them, A c is the access control module policy hit rate, I s is the data cleaning rate of the security isolation module, A a is the abnormality detection rate of the audit analysis module, and α, β, and γ are weight coefficients.

[0072] The access control module includes:

[0073] Identity authentication unit, which dynamically verifies user identity based on multi-factor authentication technology;

[0074] The protocol identification unit uses deep packet inspection technology to extract data flow protocol features and match them with the whitelist rule base;

[0075] The access control unit generates a dynamic access policy table based on the verification results and protocol matching degree, and sends a policy effectiveness instruction to the security isolation module.

[0076] The identity authentication unit's multi-factor authentication technology combination includes a USB-shield digital certificate and iris biometrics. The protocol identification unit's whitelist rule base is divided by protocol type, and HTTP protocol matching is accurate to the request method. The dynamic access policy table generated by the access control unit contains a triplet of source IP, destination port, and valid time window. The confidence level of multi-factor authentication is determined by the following formula:

[0077]

[0078] Among them, S b is the biometric matching degree, S d is the digital certificate verification strength, ω1 and ω2 are dynamic weights

[0079] In the protocol identification unit, the protocol feature matching degree is calculated using the following formula:

[0080]

[0081] fi is the data packet feature vector, F DB is the whitelist rule base, δ is the feature similarity calculation function;

[0082] In the access control unit, dynamic policy generation is done using the following formula:

[0083]

[0084] θ C is the authentication confidence threshold, θ p is the protocol matching threshold.

[0085] The safety isolation module includes:

[0086] The protocol conversion unit disassembles the original protocol into structured metadata and generates intermediate format data packets;

[0087] Data cleaning unit, which scans intermediate format data packets for malicious code and desensitizes sensitive information;

[0088] The encryption channel unit uses the national secret SM4 algorithm to perform end-to-end encryption on the cleaned data packets, and realizes physical isolation transmission through a one-way optical gate device.

[0089] The structured metadata generated by the protocol conversion unit includes the protocol version number, payload length, and service type fields. The sensitive information desensitization processing of the data cleaning unit encrypts the ID card number and bank card number with AES and replaces them with hash values. The SM4 algorithm of the encryption channel unit adopts CBC mode, and the initialization vector is generated by the security chip hardware.

[0090] In the data cleaning unit, malicious code detection is performed using the following formula:

[0091]

[0092] R j is the jth feature of the YARA rule base, B j is the binary feature of the data packet;

[0093] In the encryption channel unit, the SM4 encryption process formula is:

[0094]

[0095] K is the key, P is the plaintext data block, and IV is the initialization vector.

[0096] The audit analysis module includes:

[0097] The data collection unit is deployed at the input and output ports of the security isolation module through probes to capture network traffic and user operation logs in real time;

[0098] The correlation analysis unit builds a three-dimensional correlation model for the collected data based on timestamp, IP quintuple and user ID;

[0099] The risk warning unit detects abnormal behavior patterns through a preset rule engine and triggers an alarm signal to the management platform module when the risk score exceeds the threshold.

[0100] The data collection unit's probes are deployed in mirrored port mode, capturing traffic without incurring additional network latency. The correlation analysis unit's three-dimensional correlation model constructs a cube matrix with timestamp as the horizontal axis, IP quintuple as the vertical axis, and user ID as the depth axis. The risk warning unit's rule engine has a built-in fuzzy matching algorithm to identify unconventional port access patterns containing wildcards.

[0101] In the correlation analysis sheet, the three-dimensional correlation degree is calculated using the following formula:

[0102]

[0103] W tuf is the timestamp-user ID-IP five-tuple weight matrix, E tuf is the event correlation matrix.

[0104] The association analysis unit includes:

[0105] The session reassembly subunit reassembles and restores fragmented data packets based on TCP sequence numbers;

[0106] The behavior modeling subunit uses an LSTM neural network to perform baseline modeling of user operation sequences;

[0107] The threat scoring subunit calculates the risk coefficient of network access behavior deviating from the baseline through a weighted algorithm.

[0108] The TCP sequence number check in the session reassembly subunit includes a sliding window mechanism to automatically discard duplicate or out-of-order packets. The LSTM neural network input layer in the behavior modeling subunit incorporates operation type, access frequency, and session duration characteristics. The threat scoring subunit's weighted algorithm weights unconventional port accesses 60% and high-frequency operations 40%.

[0109] In the threat score subunit, the risk factor is calculated using the following formula:

[0110]

[0111] N ab is the number of unconventional port accesses, D op is the deviation of the operation sequence, μ op is the baseline model standard deviation.

[0112] The management platform modules include:

[0113] Policy configuration unit, which provides a graphical interface for defining access control rules, audit cycles, and alarm threshold parameters;

[0114] Log storage unit, which uses blockchain technology to hash and store audit logs on the chain;

[0115] The visualization unit uses a Sankey diagram to display the data flow across network segments and a heat map to mark high-risk access nodes.

[0116] The policy configuration unit's graphical interface supports drag-and-drop rule configuration and automatically generates XML-formatted policy files. The log storage unit's blockchain adopts a consortium chain architecture, with audit nodes jointly maintained by regulators and system administrators. The visualization unit generates a heat map based on access counts and risk levels, with red areas indicating more than 100 abnormal requests per second.

[0117] In the log storage unit, the blockchain hash chain is calculated using the following formula:

[0118] H i =H(H i-1 ||L i ||TS i );

[0119] L i is the i-th log, TS i is the timestamp, H is the SM3 hash function;

[0120] In the visualization unit, the heat map risk value formula is:

[0121]

[0122] R k is the K-th visit risk value, t k is the time decay factor.

[0123] Example 2:

[0124] Reference Figure 7-Figure 8 In a second embodiment of the present invention, the present invention provides a network isolation method supporting multi-dimensional auditing, the method comprising the following steps:

[0125] S1. Receive an access request from a user terminal, verify the digital certificate and dynamic token through the identity authentication unit, and if the verification is successful, the protocol identification unit extracts HTTP or HTTPS protocol features and compares them with the whitelist to generate a list of IP addresses allowed to access;

[0126] S2, the security isolation module receives the authorized data stream output by S1, strips the application layer protocol header through the protocol conversion unit, removes potential malicious payloads through the data cleaning unit, and then encapsulates it into a ciphertext data packet by the encryption channel unit and transmits it to the target network;

[0127] S3, the data collection unit captures data packets before and after S2 processing in real time, and the correlation analysis unit establishes a mapping relationship between session flows and user behaviors. When the risk warning unit detects that the same user initiates more than 50 unconventional port accesses within 5 minutes, it sends a high-risk alarm to the management platform module;

[0128] S4. The management platform module receives the audit report from S3, dynamically updates the protocol whitelist rule base through the policy configuration unit, and synchronizes the update instructions to the access control module and the security isolation module.

[0129] The validity period of the dynamic token in the S1 stage is set to 120 seconds. After the timeout, the authentication request needs to be re-initiated. The protocol header stripping operation in the S2 stage retains the HTTP header Host field for target network routing forwarding. The mapping relationship between the session flow and user behavior in the S3 stage is achieved by binding the session ID to the user operation log. The protocol whitelist update instructions in the S4 stage are pushed to each module in real time through the MQTT protocol.

[0130] In step S3, when the risk warning unit detects that the same user initiates more than 50 unconventional port accesses within 5 minutes, the encryption policy dynamic upgrade operation is triggered, which specifically includes the following steps:

[0131] Based on the risk factor output by the threat scoring subunit, an algorithm upgrade instruction is sent to the encryption channel unit of the security isolation module to switch the end-to-end encryption algorithm from SM4 to SM9;

[0132] Abnormal data flows are intercepted through one-way optical gate devices to generate forensic images containing original data packets, protocol metadata, and user behavior logs, which are then stored in the blockchain audit chain of the management platform module.

[0133] When the encryption algorithm is switched, the public key of the SM9 algorithm is preset by the certificate authority in the secure storage area of ​​the encryption channel unit. During the generation of the forensic image, the one-way optical gate device performs a CRC32 check on abnormal data streams to ensure integrity. The storage operation of the blockchain audit chain includes a timestamp signature, which is verified by multi-party consensus by the supervisory node.

[0134] The switching condition of the SM9 algorithm is determined by the following formula:

[0135]

[0136] R is the real-time risk coefficient, is the risk change rate.

[0137] Example 3

[0138] The third embodiment of the present invention is based on the same inventive concept. The present invention proposes a computer-readable storage medium, which stores a computer program. When the computer program is executed by a processor, it implements the steps of a network isolation method supporting multi-dimensional auditing in the above embodiment.

[0139] Example 4

[0140] The fourth embodiment of the present invention is based on the same inventive concept. The present invention proposes a terminal, which includes: a processor and a memory; the processor and the memory communicate with each other; the memory is used to store instructions; the processor is used to execute the instructions in the memory, and execute a network isolation method that supports multi-dimensional auditing of the above embodiment.

[0141] It should be understood that various parts of the present invention can be implemented using hardware, software, firmware, or a combination thereof. In the above-described embodiments, multiple steps or methods can be implemented using software or firmware stored in a memory and executed by a suitable instruction execution system. For example, if implemented using hardware, as in another embodiment, any one of the following technologies known in the art or a combination thereof can be used: a discrete logic circuit having a logic gate circuit for implementing a logic function on a data signal, an application-specific integrated circuit having a suitable combination of logic gate circuits, a programmable gate array (PGA), a field programmable gate array (FPGA), etc.

[0142] Finally, it should be noted that the above is only a preferred embodiment of the present invention and is not intended to limit the present invention. Although the present invention has been described in detail with reference to the aforementioned embodiments, those skilled in the art can still modify the technical solutions described in the aforementioned embodiments or make equivalent substitutions for some of the technical features therein. Any modifications, equivalent substitutions, improvements, etc. made within the spirit and principles of the present invention should be included in the scope of protection of the present invention.

Claims

1. A network isolation system supporting multi-dimensional auditing, characterized in that: include: Access control module, security isolation module, audit analysis module and management platform module; The access control module is used to perform identity authentication and protocol legitimacy verification on access requests and generate dynamic access policies; The security isolation module is connected to the access control module and is used to perform protocol stripping and content cleaning on the data stream that passes the verification, and to achieve cross-segment transmission through an encrypted channel; The audit analysis module communicates bidirectionally with the security isolation module and the management platform module to collect multi-dimensional audit data of the network layer, application layer and user behavior layer, generate audit reports and trigger alarm events; The management platform module is used to configure security policies, store audit logs and visually display system operation status.

2. A network isolation system supporting multi-dimensional auditing according to claim 1, characterized in that: The access control module includes: Identity authentication unit, which dynamically verifies user identity based on multi-factor authentication technology; The protocol identification unit uses deep packet inspection technology to extract data flow protocol features and match them with the whitelist rule base; The access control unit generates a dynamic access policy table based on the verification results and protocol matching degree, and sends a policy effectiveness instruction to the security isolation module.

3. A network isolation system supporting multi-dimensional auditing according to claim 1, characterized in that: The safety isolation module includes: The protocol conversion unit disassembles the original protocol into structured metadata and generates intermediate format data packets; Data cleaning unit, which scans intermediate format data packets for malicious code and desensitizes sensitive information; The encryption channel unit uses the national secret SM4 algorithm to perform end-to-end encryption on the cleaned data packets, and realizes physical isolation transmission through a one-way optical gate device.

4. A network isolation system supporting multi-dimensional auditing according to claim 1, characterized in that: The audit analysis module includes: The data collection unit is deployed at the input and output ports of the security isolation module through probes to capture network traffic and user operation logs in real time; The correlation analysis unit builds a three-dimensional correlation model for the collected data based on timestamp, IP quintuple and user ID; The risk warning unit detects abnormal behavior patterns through a preset rule engine and triggers an alarm signal to the management platform module when the risk score exceeds the threshold.

5. A network isolation system supporting multi-dimensional auditing according to claim 4, characterized in that: The association analysis unit includes: The session reassembly subunit reassembles and restores fragmented data packets based on TCP sequence numbers; The behavior modeling subunit uses an LSTM neural network to perform baseline modeling of user operation sequences; The threat scoring subunit calculates the risk coefficient of network access behavior deviating from the baseline through a weighted algorithm.

6. A network isolation system supporting multi-dimensional auditing according to claim 1, characterized in that: The management platform module includes: Policy configuration unit, which provides a graphical interface for defining access control rules, audit cycles, and alarm threshold parameters; Log storage unit, which uses blockchain technology to hash and store audit logs on the chain; The visualization unit uses a Sankey diagram to display the data flow across network segments and a heat map to mark high-risk access nodes.

7. A network isolation method supporting multi-dimensional auditing, characterized in that: A network isolation system supporting multi-dimensional auditing according to any one of claims 1 to 6, wherein the method comprises the following steps: S1. Receive an access request from a user terminal, verify the digital certificate and dynamic token through the identity authentication unit, and if the verification is successful, the protocol identification unit extracts HTTP or HTTPS protocol features and compares them with the whitelist to generate a list of IP addresses allowed to access; S2, the security isolation module receives the authorized data stream output by S1, strips the application layer protocol header through the protocol conversion unit, removes potential malicious payloads through the data cleaning unit, and then encapsulates it into a ciphertext data packet by the encryption channel unit and transmits it to the target network; S3, the data collection unit captures data packets before and after S2 processing in real time, and the correlation analysis unit establishes a mapping relationship between session flows and user behaviors. When the risk warning unit detects that the same user initiates more than 50 unconventional port accesses within 5 minutes, it sends a high-risk alarm to the management platform module; S4. The management platform module receives the audit report from S3, dynamically updates the protocol whitelist rule base through the policy configuration unit, and synchronizes the update instructions to the access control module and the security isolation module.

8. A network isolation method supporting multi-dimensional auditing according to claim 7, characterized in that: In step S3, when the risk warning unit detects that the same user initiates more than 50 unconventional port accesses within 5 minutes, the encryption policy dynamic upgrade operation is triggered, which specifically includes the following steps: Based on the risk factor output by the threat scoring subunit, an algorithm upgrade instruction is sent to the encryption channel unit of the security isolation module to switch the end-to-end encryption algorithm from SM4 to SM9; Abnormal data flows are intercepted through one-way optical gate devices to generate forensic images containing original data packets, protocol metadata, and user behavior logs, which are then stored in the blockchain audit chain of the management platform module.

9. A computer device comprising a memory, a processor, and a computer program stored in the memory and executable on the processor, wherein: When the processor executes the computer program, the network isolation method supporting multi-dimensional auditing as described in any one of claims 7 to 8 is implemented.

10. A readable storage medium, characterized in that: The readable storage medium stores a computer program, and when the computer program is executed by a processor, it implements a network isolation method supporting multi-dimensional auditing as described in any one of claims 7 to 8.

Images