A network security situation awareness method based on multi-layer defense architecture

Abstract

The application provides a network security situation awareness method based on a multi-layer defense architecture, comprising: obtaining all device connection information from a campus network access point, generating a risk level classification result of potential risk devices; according to a complete network topology structure under the multi-layer defense architecture, segmenting and managing network traffic within an isolation boundary to obtain an isolation boundary configuration parameter after load balancing; in view of a dynamically adjusted permission allocation table, combining isolation boundary running state monitoring data to optimize the network isolation boundary to obtain an optimized multi-layer isolation boundary architecture; according to the optimized multi-layer isolation boundary architecture, obtaining subsequent campus network behavior logs and trust score data of all devices to generate a real-time security state report; and generating a security protection configuration according to the real-time security state report.

Description

Technical Field

[0001] This invention relates to the field of information technology, and in particular to a network security situation awareness method based on a multi-layered defense architecture. Background Technology

[0002] Campus network security management is a crucial research area, directly related to the information security and protection of core resources of educational institutions. Especially in the digital age, the network has become a vital platform for academic exchange and resource sharing. With the increasing openness of campus networks, how to meet diverse access needs while ensuring security has become a critical issue that urgently needs to be addressed. Currently, although many campus networks have deployed basic security measures, these methods often fall short in dealing with dynamic changes in special scenarios. Particularly during events such as academic conferences or campus open days, the large influx of external visitors places higher demands on network management. Existing solutions often focus on static protection in routine scenarios, lacking the ability to quickly respond to sudden, high-density access demands, particularly in terms of flexibility in trust assessment and resource isolation, easily leading to a disconnect between security strategies and actual needs. In this context, when large academic conferences, campus open days, or recruitment events are held, mobile devices from external attendees, visitors, and potential students will collectively request network access within a short period, resulting in a surge of authentication requests from unknown devices. The concentrated occurrence of these requests within a short time makes it difficult for traditional authentication mechanisms to quickly distinguish between legitimate users and potential threats, increasing security risks. This issue further necessitates the dynamic expansion of visitor network isolation boundaries. Failure to adjust isolation strategies in a timely manner could lead to the abuse of network resources or exposure of core areas to risks. These two factors are closely related; the former directly exacerbates the latter's demand for flexibility in network security architecture, together constituting the current key challenges. Therefore, how to build a mechanism capable of rapidly responding to and dynamically adjusting trust assessment and resource protection in response to the surge of authentication requests from unknown devices and the dynamic expansion of visitor network isolation boundaries during large-scale events has become a critical issue in campus network security management. Summary of the Invention

[0003] This invention provides a network security situation awareness method based on a multi-layered defense architecture, mainly including:

[0004] Obtain all device connection information from campus network access points and generate risk level classification results for potentially risky devices;

[0005] Based on the risk level classification results, information on the connection targets and data flow of potential risky devices is obtained to determine whether they attempt to access core resource areas. If the access target involves core resources, a temporary isolation command is triggered, and the isolation priority ranking is obtained.

[0006] The visitor network isolation boundary is dynamically adjusted according to the isolation priority ranking to restrict risky devices to the visitor area, resulting in the network topology after the first layer of isolation boundary is set.

[0007] Based on the campus network topology set by the first layer of isolation boundary, a firewall is established between the core area and the isolation area to form the second layer of isolation boundary, resulting in a network topology under a multi-layer defense architecture.

[0008] Based on the complete network topology under the multi-layered defense architecture, the network traffic within the isolation boundary is segmented and managed to obtain the isolation boundary configuration parameters after load balancing.

[0009] Based on the configuration parameters of the isolation boundary after load balancing, the initially trusted devices are verified. If the verification results show a decrease in trust level, the access permissions of the devices in the isolation boundary are adjusted to obtain a dynamically adjusted permission allocation table.

[0010] Based on the dynamically adjusted permission allocation table and combined with the monitoring data of the isolation boundary's operational status, the network isolation boundary is optimized to obtain an optimized multi-layer isolation boundary architecture.

[0011] Based on the optimized multi-layer isolation boundary architecture, obtain the subsequent campus network behavior logs and trust score data of all devices, and generate a real-time security status report.

[0012] Security protection configurations are generated based on real-time security status reports.

[0013] Furthermore, the step of obtaining all device connection information from campus network access points and generating risk level classification results for potentially risky devices includes:

[0014] Obtain the device's MAC address and IP address, read the hardware identifier and protocol stack features from the device feature database, compare the MAC address and protocol stack features, mark matching devices as preliminarily trusted devices, and generate a device classification list; for devices not marked in the device classification list, extract the source port and timestamp of the data packets, calculate the request frequency per unit time, mark devices with excessive frequency as high risk, and generate risk level classification results.

[0015] Furthermore, based on the risk level classification results, information on the connection targets and data flow of potentially risky devices is obtained to determine whether they attempt to access core resource areas. If the access target involves core resources, a temporary isolation command is triggered, and an isolation priority ranking is obtained, including:

[0016] Extract the source IP address and target port of potentially risky devices, parse the packet 5-tuple and protocol characteristics, and generate a device access record table; based on the device access record table, compare the target address with the core resource area configuration file, mark the devices accessing the core resources, and generate a device access status table; based on the device access status table, count the number of times the core resources are accessed, calculate the product of risk weight and access count, and generate an isolation priority sequence by sorting the scores.

[0017] Furthermore, the step of dynamically adjusting the visitor network isolation boundary according to the isolation priority to restrict risky devices to the visitor area, resulting in the network topology after the first layer of isolation boundary is set, includes:

[0018] Extract a list of high-priority risk devices, obtain network segment addresses and virtual LAN identifiers from the area division configuration file, and generate a device migration mapping table. Based on the device migration mapping table, generate port reconfiguration instructions, modify the virtual LAN identifier of the device port to a guest zone identifier, add MAC address-based access restriction rules, and generate a network isolation execution instruction set. Based on the network isolation execution instruction set, execute port reconfiguration and access control updates to generate the network topology after the first layer of isolation boundary is set. Further, based on the campus network topology after the first layer of isolation boundary is set, establish a firewall between the core area and the isolation area to form a second layer of isolation boundary, resulting in a network topology under a multi-layered defense architecture, including:

[0019] Scanning servers in the core business area to obtain IP address ranges and port lists generates a core resource distribution table. Based on this table, firewall rules are configured, including source IP address and port matching conditions, forming a boundary protection rule set. Based on this rule set, application-layer detection is configured to identify malicious parameter patterns, establish an IP whitelist, and generate a complete network topology under a multi-layered defense architecture. Further, based on the complete network topology under the multi-layered defense architecture, network traffic within the isolation boundary is segmented for management, resulting in load-balanced isolation boundary configuration parameters, including:

[0020] Read the network interface bandwidth utilization and concurrent connection count to generate a network load status table; based on the network load status table, extract the core business data flow tags, classify the data flows into high, medium, and low priorities, and generate a traffic classification configuration table; based on the traffic classification configuration table, set the scheduling weight of high-priority queues and generate isolation boundary configuration parameters after load balancing.

[0021] Furthermore, based on the isolation boundary configuration parameters after load balancing, the preliminarily trusted devices are verified. If the verification result shows a decrease in trust level, the access permissions of the devices in the isolation boundary are adjusted to obtain a dynamically adjusted permission allocation table, including:

[0022] Read the access logs of initially trusted devices, extract timestamps and resource categories, and generate a device behavior characteristic record table; based on the device behavior characteristic record table, compare the access time and resource category with the trust assessment parameters, calculate the trust score, and generate a device trust assessment result table; based on the device trust assessment result table, reduce the permissions of low-trust devices, modify the access control list, and generate a dynamically adjusted permission allocation table.

[0023] Furthermore, based on the dynamically adjusted permission allocation table and combined with the isolation boundary operation status monitoring data, the network isolation boundary is optimized to obtain an optimized multi-layer isolation boundary architecture, including:

[0024] Read the traffic statistics results of the isolation boundary, calculate the blocking rate and the proportion of suspicious traffic, and generate a boundary protection status monitoring table; based on the boundary protection status monitoring table, compare the blocking rate with the standard value, identify isolation vulnerabilities, and generate an isolation vulnerability analysis table; based on the isolation vulnerability analysis table, narrow down the range of source IP addresses, add deep detection conditions, and generate an optimized multi-layer isolation boundary architecture.

[0025] Furthermore, based on the optimized multi-layered isolation boundary architecture, subsequent campus network behavior logs and trust score data of all devices are obtained to generate a real-time security status report, including:

[0026] Collect device access logs and trust scores to generate a device behavior feature table; calculate the behavior value deviation based on the device behavior feature table, mark abnormal devices, lower the trust score, configure traffic limit parameters, and generate an abnormal device management table; configure continuous monitoring rules based on the abnormal device management table, summarize device status information, and generate a real-time security status report.

[0027] Furthermore, the step of generating security protection configurations based on real-time security status reports includes:

[0028] Read system logs and threat signature rule base, collect load fluctuation data, and generate a comprehensive network status dataset; based on the comprehensive network status dataset, expand the number of virtual interfaces, add new threat signatures, and generate security protection configuration.

[0029] The technical solutions provided by the embodiments of the present invention may include the following beneficial effects:

[0030] This invention discloses a network security situational awareness method based on a multi-layered defense architecture. Addressing the core issues of unclear device identities and difficulty in real-time identification and control of potential threats in high-density access scenarios, it proposes a comprehensive solution integrating device feature comparison, behavior analysis, dynamic isolation, and trust assessment. This invention performs preliminary identity verification of access devices through a pre-established device feature database and quickly distinguishes between trusted and risky devices by combining real-time network request frequency and packet feature monitoring. For potentially risky devices, this invention identifies their access intentions through traffic analysis, dynamically triggers isolation commands, adjusts visitor network boundaries, and constructs a multi-layered defense architecture using virtual LAN technology and firewall policies to ensure the security of core resources. Simultaneously, this invention optimizes network performance through load balancing and QoS policies, combines secondary trust verification and behavior pattern matching, dynamically adjusts device permissions, and continuously updates the threat feature database to achieve real-time security status monitoring and rapid response. This invention significantly improves the security protection capabilities and operational stability of campus networks in complex access scenarios. Attached Figure Description

[0031] Figure 1 This is a flowchart of a network security situation awareness method based on a multi-layered defense architecture according to the present invention. Detailed Implementation

[0032] To make the objectives, technical solutions, and advantages of this invention clearer, the invention will be described in detail below with reference to the accompanying drawings and specific embodiments.

[0033] like Figure 1 This embodiment of a network security situation awareness method based on a multi-layered defense architecture may specifically include:

[0034] S101. Obtain all device connection information from the campus network access point and generate risk level classification results for potentially risky devices.

[0035] The system acquires the MAC addresses and IP addresses of devices at campus network access points. It then reads legitimate device hardware identifiers, operating system version numbers, and network protocol stack characteristic parameters stored in a pre-established device characteristic database. The acquired device connection information is compared item by item with the database records. If all three parameters—MAC address, operating system fingerprint, and protocol stack characteristic—match, the device is marked as a preliminarily trusted device in the device list, resulting in a device classification list containing device identifiers and trusted labels. For devices not marked as trusted in the device classification list, the source port, destination port, packet length, and timestamp information of their network data packets are extracted. The request sending frequency of each device within a unit time window is calculated. If this frequency exceeds a preset request frequency threshold, the device is marked as a high-risk device in the device classification list; otherwise, it is marked as a medium-risk device, resulting in a device risk classification list containing preliminarily trusted, high-risk, and medium-risk labels. Based on the device risk classification list, deep packet inspection is performed on the network traffic of high-risk devices to parse their application layer protocol content and extract the User-Agent field, request URL path, and request method type from the HTTP request header. For medium-risk devices, the distribution of their connection target IP addresses and port usage patterns are extracted. The application layer characteristics of high-risk devices and the connection characteristics of medium-risk devices are matched with a preset malicious behavior feature database. Based on the matching similarity, the devices are subdivided into four levels: extremely high risk, high risk, medium risk, and low risk, resulting in the risk level classification results for potential risk devices at four risk levels.

[0036] Specifically, in campus network security management, device access authentication is the first line of defense for ensuring network security. When a device attempts to connect to the campus network, the network access point automatically captures the device's MAC address and IP address information. The MAC address, as the device's physical address, is unique and difficult to forge, making it a crucial basis for device identification.

[0037] In one possible implementation, a pre-established device characteristic database stores detailed information on all legitimate devices on campus. These characteristic parameters include hardware identifiers, operating system version numbers, and network protocol stack characteristics. Hardware identifiers include not only MAC addresses but also hardware fingerprints such as network interface card (NIC) manufacturer information and device model. The operating system version number is obtained by analyzing the implementation differences of the TCP / IP protocol stack, as different operating systems exhibit unique behavior patterns when processing network packets. Network protocol stack characteristics are determined by analyzing parameters such as the packet's TTL value, window size, and TCP options.

[0038] Specifically, when comparing device connection information with database records, the system employs a multi-dimensional matching strategy. First, it verifies whether the MAC address is in the whitelist. Then, it analyzes the initial data packets sent by the device to extract the operating system fingerprint information. By comparing features such as the TCP initial sequence number generation algorithm, IP fragmentation processing method, and ICMP error message handling, the system can accurately identify the device's operating system type and version. Only when all three parameters match will the device be initially marked as a trusted device.

[0039] It should be noted that for devices not marked as trusted, the system will activate a behavior monitoring mechanism. Network packet analysis involves information extraction at multiple levels. Source and destination port information reflects the device's communication pattern. Normal user devices typically use a high-order random port as the source port, while malicious devices may use a fixed low-order port for scanning or attacks. Packet length distribution characteristics are also important criteria. Normal network communication exhibits diverse packet length distributions, while certain malicious behaviors, such as DDoS attacks, often generate a large number of packets of the same length.

[0040] In one embodiment, the request frequency is calculated using a sliding time window method. The system maintains a time window and records the number of requests made by each device within that window. When a new request arrives, the system updates the counter and checks whether it exceeds a preset threshold. This method can effectively identify abnormal behavior such as a large number of requests generated in a short period of time, including malicious activities such as port scanning and brute-force attacks.

[0041] Preferably, the application of deep packet inspection technology enables the system to deeply analyze application layer protocol content. The User-Agent field in the HTTP request header can reveal the type and version of the client software; malicious software often uses forged or abnormal User-Agent strings. Analysis of the request URL path can detect attack attempts targeting known vulnerabilities, such as SQL injection and directory traversal. Statistics on request method types help identify abnormal access patterns; normal users mainly use GET and POST methods, while extensive use of DELETE, PUT, and other methods may indicate potential security threats. By matching the extracted features with a pre-set malicious behavior feature library, the system can calculate the risk similarity score for each device. This process employs pattern matching and similarity calculation techniques, categorizing devices into different risk levels based on the degree of matching.

[0042] S102. Based on the risk level classification results, obtain the connection target and data flow information of potential risk devices, determine whether they attempt to access the core resource area, and if the access target involves core resources, trigger a temporary isolation command and obtain the isolation priority ranking.

[0043] Based on the risk level classification results, real-time network connection information of potentially risky devices is extracted. The source IP address, destination IP address, destination port number, transmission protocol type, and packet size of each device are obtained. Network traffic analysis tools are used to parse the five-tuple information and application layer protocol characteristics of the packets to identify the specific service type and data transmission direction being accessed by the device, resulting in a device access record table containing device identifier, destination address, service type, and traffic characteristics. For each record in the device access record table, a predefined core resource area configuration file is read. This configuration file contains the IP address range and port range of the database server, the service address of the authentication server, the storage area address of the file server, and the access entry address of the management backend. By comparing the destination address and port accessed by the device with the address range in the core resource area configuration file, if a match is found, a core resource access flag and resource type identifier are added to the device access record table, resulting in a device access status table containing core resource access information. Based on the device access status table, the number of times each potentially risky device accesses core resources and the distribution of resource types within the monitoring time window are statistically analyzed. The risk level of the device is converted into a corresponding risk weight value, where extremely high risk corresponds to a weight of 4, high risk to a weight of 3, medium risk to a weight of 2, and low risk to a weight of 1. The threat score of each device is calculated as the product of the risk weight value and the number of times the core resource is accessed. Devices are sorted from high to low according to their threat scores to generate a device isolation priority sequence. Temporary isolation commands are triggered for devices whose threat scores exceed a preset threshold, thus obtaining the isolation priority ranking.

[0044] Specifically, network traffic analysis tools play a crucial role in identifying the access behavior of potentially risky devices. The five-tuple information includes the source IP address, source port, destination IP address, destination port, and transport protocol; these five elements together constitute a unique identifier for a network connection. By deeply analyzing this information, the communication behavior patterns of devices can be accurately reconstructed.

[0045] In one possible implementation, traffic analysis tools capture data packets in real time when a potentially risky device initiates a network connection. The source IP address identifies the device initiating the connection, while the destination IP address reveals the location of the resource the device is attempting to access. Port number analysis is particularly important, as different ports correspond to different network services. Port 3306 typically corresponds to the MySQL database service, port 1433 to the SQL Server database, port 389 to the LDAP authentication service, and ports 8080 or 8443 are commonly used for web management backends.

[0046] Specifically, identifying application layer protocol characteristics requires deep parsing of data packet content. HTTP requests contain explicit request methods, URL paths, and request header information. When a device is detected frequently sending connection requests to a database port, and these requests contain characteristics of SQL query statements, this behavior pattern warrants close attention. Determining the direction of data transmission is based on the TCP session establishment process and a comparison of data traffic volume. If the device primarily downloads large amounts of data from core resources rather than uploading them, this may indicate data theft.

[0047] It's important to note that the core resource area configuration files are designed using a hierarchical and categorized approach. Database servers are typically deployed within specific network segments, such as the 192.168.100.0 / 24 segment, which is dedicated to database clusters. Authentication servers, due to their special nature, often use independent IP addresses and only open the necessary authentication ports. The file server's storage area not only includes IP address ranges but also labels different directories with their corresponding sensitivity levels. The access point to the management backend typically uses non-standard ports and is restricted to a specific management network segment.

[0048] For example, when the system detects a medium-risk device continuously accessing port 3306 of multiple database servers within a short period, with each connection accompanied by a large amount of data transmission, this behavior pattern is marked as core resource access. Detailed information such as the specific database address accessed by the device, access time, and data transmission volume is recorded. The threat score calculation mechanism reflects a comprehensive assessment of risk level and actual behavior. The risk weight value is set based on the device's initial risk assessment results; extremely high-risk devices inherently possess high threat potential and are therefore assigned the highest weight value of 4. This weight value, multiplied by the actual number of times core resources are accessed, accurately reflects the actual threat level posed by the device to network security. If a high-risk device accesses a database server 10 times within the monitoring window, its threat score is 30. The isolation priority ranking process fully considers the limited resources and the urgency of the threat. Devices with the highest threat scores are isolated first, ensuring that the most dangerous threats are addressed promptly. Triggering isolation commands is not a simple on / off operation but involves precise control parameters, allowing network administrators to flexibly adjust isolation policies according to the actual situation, ensuring network security while minimizing the impact on normal business operations.

[0049] S103. Dynamically adjust the visitor network isolation boundary according to the isolation priority to restrict risky devices to the visitor area, and obtain the network topology after the first layer of isolation boundary is set.

[0050] Based on the isolation priority ranking results, a list of high-priority risk devices with threat scores exceeding a preset threshold is extracted. The current area division configuration file of the campus network is obtained. This configuration file contains the network address ranges for teaching, office, research, and visitor areas, the corresponding VLAN identifiers for each area, IP address pool allocation information, and access control rules between areas. The physical port number and VLAN affiliation of the risk device are queried, resulting in a device migration mapping table containing the device identifier, current area affiliation, and target isolation area. For each high-priority risk device in the device migration mapping table, its currently connected physical port configuration information is read, and a port VLAN reconfiguration instruction is generated. This reconfigures the VLAN identifier of the device's port from the original area identifier to the visitor area identifier. Simultaneously, an access control list update instruction is generated, adding a one-way access restriction rule based on the device's MAC address between the visitor area and the teaching, office, and research areas to prevent the risk device from accessing resources in other areas. This results in a network isolation execution instruction set containing the port reconfiguration instruction and the access control update instruction. Based on the network isolation execution instruction set, virtual LAN reallocation and access control list update operations are performed on the network switching device. The original network location and the relocated guest area location of each isolated device are recorded. The changes in the number of devices in each network area and the changes in connectivity between areas are statistically analyzed. A network layout diagram is generated, which marks the new location of the isolated devices, the boundary range of the guest area, and the access restriction relationship between areas, thus obtaining the network topology structure after the first layer of isolation boundary is set.

[0051] Specifically, Virtual LAN (VLAN) technology is the core mechanism for achieving network isolation. By logically dividing the network at the data link layer, devices within the same physical network can be assigned to different logical networks. Each VLAN has a unique identifier, typically a number between 1 and 4094, which is added to the header of the Ethernet frame to identify the virtual network to which the data packet belongs.

[0052] In one possible implementation, the campus network is divided into zones using a function-based classification method. The teaching area is assigned VLAN 100, using the 10.1.0.0 / 16 network segment; the office area uses VLAN 200, corresponding to the 10.2.0.0 / 16 network segment; the research area is configured with VLAN 300, occupying the 10.3.0.0 / 16 network segment; and the visitor area is isolated in VLAN 400, allocated only the limited address space of 10.4.0.0 / 16. This division method not only achieves logical isolation but also facilitates management and monitoring through different IP address ranges.

[0053] Specifically, when the system identifies a high-risk device that needs to be isolated, the device migration mapping table records the device's migration process in detail. Suppose a device originally connected to port 24 on the 3rd floor of Building A in the teaching building is identified as high-risk; this port is currently configured with VLAN 100. The mapping table records: device MAC address is AA:BB:CC:DD:EE:FF, current port is GigabitEthernet0 / 24, current VLAN is 100, and target VLAN is 400. This detailed recording ensures the traceability of the isolation operation.

[0054] It's important to note that generating a port VLAN reconfiguration command involves setting multiple parameters. The command includes not only simple VLAN ID changes but also adjustments to the port mode. A port might originally be configured in trunk mode, allowing data from multiple VLANs to pass through. However, in an isolated scenario, it needs to be changed to access mode, allowing only visitor VLAN traffic. Simultaneously, other port security features also need adjustment, such as enabling port security functions to restrict the port to only recognize recorded MAC addresses.

[0055] For example, access control list updates use an exact match approach. For the isolated device's MAC address AA:BB:CC:DD:EE:FF, the following rule is configured at the boundary between the visitor area and other areas: all traffic originating from this device is denied entry into the VLANs of the teaching, office, and research areas. However, the device is allowed access to the internet egress and basic authentication services. This achieves isolation while ensuring the device's basic network functionality. The application process of the network isolation execution command set demonstrates the advantages of automated network management. Each command includes the identifier of the executing device, the specific configuration command, and the execution order. The command set is executed in the order of configuring the access control list first, followed by modifying the port VLAN. This order avoids security vulnerabilities during handover. After execution, the system verifies whether the configuration has taken effect by sending test data packets to confirm whether the isolation boundary is working properly. The generated network topology clearly demonstrates the effect of the first layer of isolation. In this new topology, although the isolated device is still connected to its original physical location, it has been logically moved to the visitor area. The topology map uses different colors to label each area, with dashed lines representing isolation boundaries between areas and solid lines representing connectivity within areas.

[0056] S104. Based on the campus network topology set by the first layer of isolation boundary, establish a firewall between the core area and the isolation area to form the second layer of isolation boundary, and obtain the network topology under the multi-layer defense architecture.

[0057] Based on the network topology established after the first layer of isolation boundary is set, the server deployment within the core business area is scanned to obtain the IP address range of the database server group, the service port list of the application servers, the shared directory path of the file storage server, and the access interface address of the authentication server. The access frequency and data traffic characteristics of various core resources are statistically analyzed to generate a core resource distribution table containing resource identifiers, network locations, service types, and access patterns. Based on the network locations and service types recorded in the core resource distribution table, firewall access control rules are constructed. Each rule includes the allowed source IP address range, the IP address and port number of the target resource, the network protocol type used, and the packet forwarding action. These rules are configured at the network boundary between the core business area and the visitor isolation area to form an access filtering mechanism based on five-tuple matching, resulting in a boundary protection rule set that includes source address restrictions, port mapping, and protocol constraints. Based on the boundary protection rule set, an application layer detection function is added on the basis of the configured access control. The detection engine is configured to identify malicious parameter patterns in HTTP requests, dangerous operation instructions in database query statements, and abnormal behavior characteristics in file transfer protocols. An IP address whitelist for authorized management terminals is established and associated with the protection rule set. The source address, destination address, access time, and processing result of all cross-regional access attempts are recorded. A complete network topology under the multi-layer defense architecture is generated, which marks the location of the two-layer defense boundary, the distribution of protection rules, and the access paths between regions.

[0058] Specifically, the construction of the core resource distribution table is based on a comprehensive scan of critical business systems within the campus network. This scan is not a simple port probe, but rather identifies the specific service types provided by each system through service discovery protocols. Database server clusters are typically deployed in dedicated server rooms, using contiguous IP address ranges for ease of management; for example, 10.2.100.1 to 10.2.100.20 might all be allocated to a MySQL database cluster.

[0059] In one possible implementation, application server identification requires more detailed analysis. By examining the Server field in the HTTP response header, the type and version of the web server can be determined. Simultaneously, by analyzing the returned content type and API interface characteristics, it's possible to identify whether it's an academic affairs management system, a library system, or a research management platform. Each application has its specific access patterns; the academic affairs system experiences a large number of concurrent accesses during course selection periods, while the research system's access is relatively stable but involves a larger volume of data transmission.

[0060] Specifically, the five-tuple matching mechanism of firewall rules is the foundation of network security. A five-tuple includes the source IP address, source port, destination IP address, destination port, and protocol type. When a data packet arrives at the firewall, the system extracts these five elements and compares them with the rule base. Only packets that match exactly are allowed to pass. This precise matching ensures that only authorized access reaches core resources.

[0061] It should be noted that the design of the boundary protection rule set takes into account the access characteristics of different resources. For database servers, the rules typically only allow access from the application server network segment, and only open database service ports such as 3306 or 1433. For file servers, it may be necessary to open port 445 of the SMB protocol or port 2049 of the NFS protocol, but strictly restrict the access source to the internal office network segment.

[0062] For example, the working principle of the application-layer detection engine involves in-depth analysis of packet payloads. When an HTTP POST request is detected, the engine parses the parameters in the request body. If the parameter values ​​contain characteristic character sequences of SQL statements, such as "unionselect" or "droptable," the system immediately identifies this as a potential SQL injection attack. Similarly, if script tags or JavaScript code snippets are found in URL parameters, this is flagged as a cross-site scripting attack attempt. The detection engine can also identify abnormal database operation patterns. When a normal application accesses the database, the query statements have a relatively fixed pattern; parameter values ​​may change, but the statement structure remains stable. When a large number of query statements with varying structures are detected, especially those containing system table queries or privilege escalation operations, this abnormal behavior will trigger an alert. The implementation of a whitelist mechanism provides additional security for authorization management. Administrators' office computers are assigned fixed IP addresses, and only these addresses can access the server's management port. This mechanism, combined with firewall rules, forms a two-factor authentication. Even if an attacker knows the management port, they cannot establish a connection without a source IP address in the whitelist. The final form of this multi-layered defense architecture is a comprehensive network security system. The first layer achieves logical segmentation through VLAN isolation, restricting risky devices to specific areas. The second layer establishes strict access control at the area boundaries through firewall rules and application-layer inspection.

[0063] S105. Based on the complete network topology under the multi-layer defense architecture, segment the network traffic within the isolation boundary to obtain the isolation boundary configuration parameters after load balancing.

[0064] Based on the complete network topology under the multi-layered defense architecture, port traffic statistics are read from network nodes between the core business area and the isolation area. Real-time bandwidth utilization, packet forwarding rate, and concurrent connection count of each network interface are collected. The traffic proportion and time distribution characteristics of different business types are statistically analyzed, and the traffic ratios of teaching applications, office systems, and visitor access are recorded, resulting in a network load status table annotated with traffic characteristics, bandwidth usage status, and business type distribution for each area. For the various business traffic characteristics recorded in the network load status table, identification markers for core business data flows are extracted, including specific port ranges used by the academic affairs system, fixed message lengths for database access, and periodic heartbeat packets from authentication services. Based on these identification markers, data flows passing through the isolation boundary are classified in real time, labeled as high-priority business flows, medium-priority access flows, and low-priority background flows. An independent forwarding queue is created for each type of data flow, resulting in a traffic classification configuration table containing traffic identification rules, priority markers, and queue allocation schemes. Based on the queue allocation scheme in the traffic classification configuration table, a bandwidth guarantee mechanism is configured on the network forwarding device at the isolation boundary. Transmission resources exceeding the preset bandwidth guarantee threshold are reserved for high-priority service flows, secondary bandwidth quotas are allocated to medium-priority access flows, and the remaining bandwidth resources are allocated to low-priority background flows. Weighted round-robin scheduling parameters are set to give high-priority queues more sending opportunities. The bandwidth reservation value, scheduling weight, and buffer size of each queue are recorded to obtain the isolation boundary configuration parameters after load balancing.

[0065] Specifically, accurate monitoring of network load is fundamental to effective traffic management. Port traffic statistics are collected using built-in counters on network devices, which record the number of bytes, packets, and error packets passing through each network interface. Bandwidth utilization is calculated by dividing the number of bytes transmitted per unit time by the interface's physical bandwidth; this ratio directly reflects the network link's activity level.

[0066] In one possible implementation, business type identification requires combining features from multiple dimensions. Educational applications typically generate concentrated traffic peaks during class periods, with their data packets exhibiting clear periodicity. Query operations in academic affairs systems generate numerous small packet requests, while video teaching platforms produce continuous large data streams. Office systems have relatively stable traffic patterns, primarily concentrated during working hours, mainly consisting of document transfers and email sending / receiving. Visitor traffic, on the other hand, is random and lacks a fixed time pattern.

[0067] Specifically, the process of extracting traffic identification tags involves in-depth analysis of data packet characteristics. Academic affairs systems typically use ports 8080 or 8443 to provide web services, and their HTTP requests contain specific URL path patterns, such as " / jwxt / " or " / education / ". Database access messages have relatively fixed lengths; query requests are usually in the range of a few hundred bytes, while the return packets of query results can reach several thousand bytes. The heartbeat packets of the authentication service are highly regular, sent every 30 or 60 seconds, with fixed packet lengths and uniform content formats.

[0068] It's important to note that the traffic classification system employs a multi-level matching mechanism. Initial classification is performed based on port number, quickly grouping traffic from known service ports. For applications using dynamic ports, further examination of the application layer content of the data packets is required. By using deep packet inspection to identify the Host field and User-Agent information in the HTTP header, the application type of the traffic can be accurately determined. This layered identification method ensures both processing efficiency and improved classification accuracy.

[0069] For example, the weighted round-robin scheduling mechanism works by assigning different weight values ​​to each queue. Assuming a high-priority queue has a weight of 4, a medium-priority queue has a weight of 2, and a low-priority queue has a weight of 1, then within a scheduling cycle, the system will retrieve data packets from each queue in a 4:2:1 ratio for forwarding. This means that for every 7 data packets sent, 4 come from the high-priority queue, 2 from the medium-priority queue, and 1 from the low-priority queue. The implementation of bandwidth guarantee mechanisms ensures the quality of service for critical services. When network congestion occurs, low-priority traffic is restricted first, while high-priority traffic still receives its reserved bandwidth resources. This mechanism is similar to dedicated lanes on highways, allowing ambulances and police cars to pass quickly even during peak traffic hours. Buffer size settings are also crucial parameters for optimizing network performance. Larger buffers can absorb bursts of traffic and prevent packet loss, but excessively large buffers increase transmission latency. Therefore, appropriate buffer sizes need to be set according to the characteristics of different priority queues. High-priority queues typically have smaller buffers to reduce latency, while low-priority queues can use larger buffers to improve throughput.

[0070] S106. Based on the isolation boundary configuration parameters after load balancing, verify the initially trusted devices that have been marked. If the verification results show a decrease in trust level, adjust the access permissions of the devices in the isolation boundary to obtain a dynamically adjusted permission allocation table.

[0071] Based on the isolation boundary configuration parameters after load balancing, the list of devices marked as trusted and their currently assigned network access permission levels are read. The behavioral data of these devices within the monitoring period is extracted from the network access logs, including the timestamp of each access, the network location identifier of the access, the target resource category requested, and the number of bytes transmitted. The collected behavioral data is aggregated by device identifier, and the access time distribution range, the number of location changes, and the number of resource access categories for each device are calculated to obtain a device behavior feature record table containing device identifier, time distribution characteristics, location change frequency, and resource access diversity indicators. For each indicator in the device behavior characteristic record table, the preset trust assessment parameter configuration is read. This configuration defines the normal access time window, the upper limit of reasonable location change frequency, and the list of authorized resource categories. The actual behavior indicators of the device are compared with the assessment parameters. If the access time exceeds the normal window, the trust score is reduced by the first level of deduction. If the location change frequency exceeds the upper limit, the second level of deduction is reduced. If unauthorized resource categories are accessed, the third level of deduction is reduced. The current trust score of the device is obtained by subtracting the accumulated deduction from the preset trust benchmark score, resulting in a device trust assessment result table containing the device identifier, details of each deduction, and the trust score. Based on the device trust assessment result table, devices with trust scores lower than the preset trust threshold are identified. The network access permissions of these devices are reduced from the original level to the restricted level, their access control lists are modified, access permissions to core business resources are removed, basic access permissions to public service resources are retained, and a shorter session timeout parameter is set. The level changes before and after the permission adjustment, the adjustment execution time, and the new access control rules are recorded, generating a dynamically adjusted permission allocation table containing the current permission level, access scope restrictions, and session duration settings for all devices.

[0072] Specifically, the collection and analysis of device behavior characteristics is a core component of dynamic trust assessment. Network access logs, as the most direct data source, record the complete trajectory of each device's interaction with network resources. Timestamp information, accurate to the millisecond level, can accurately reflect the device's access patterns. A normal office device typically maintains a stable access pattern during working hours, while abnormal devices may exhibit frequent access behavior late at night or in the early morning.

[0073] In one possible implementation, calculating the frequency of location changes requires combining both physical and logical dimensions. Physical location is mapped to a specific office or classroom via IP address, while logical location reflects the device's switching between different network areas. A laptop moving from an office to a meeting room and then to a library within a day is a reasonable location change that won't trigger system alerts. However, if a device is detected frequently switching between multiple unrelated network areas within a short period, this abnormal pattern warrants close attention.

[0074] Specifically, the resource access diversity indicator was designed with actual business needs in mind. Teacher accounts typically need to access the teaching management system, grade entry platform, and teaching resource library, all of which fall within their authorized resource categories. However, if a teacher account suddenly starts accessing the financial system or human resources management module, this behavior of crossing permission boundaries will be recorded as abnormal access. By statistically analyzing the number of different resource categories accessed by a device and comparing it with the standard access patterns of that device role, potential unauthorized behavior can be identified.

[0075] It should be noted that the trust assessment parameter configuration is based on statistical analysis of a large amount of historical data. The normal access time window is typically set from 7:00 AM to 10:00 PM, covering the vast majority of normal teaching and office activities. The upper limit for the reasonable frequency of location changes varies depending on the device type, with mobile devices having a higher upper limit than fixed workstations. The list of authorized resource categories is strictly generated according to the role-based access control matrix, ensuring that each user can only access the minimum set of resources required for their work.

[0076] For example, the trust score deduction mechanism adopts a tiered, progressive approach. The first level deduction targets time anomalies, such as accessing the system at 2 AM potentially deducting 10 points. The second level deduction targets location anomalies, with frequent cross-regional switching potentially deducting 20 points. The third level deduction is the most severe, with unauthorized resource access resulting in a direct deduction of 30 points. This tiered design reflects the risk level of different abnormal behaviors; time anomalies might simply be occasional overtime work, while unauthorized access clearly indicates a potential security threat. The implementation process of dynamic permission adjustment embodies the zero-trust security concept. When a device's trust score falls below the threshold, the system does not immediately and completely block its access but instead employs a gradual permission contraction strategy. Restricted-level permissions still allow the device to access public resources, such as campus news and announcements, but access to core business systems is strictly limited. Simultaneously, the session timeout is shortened from 8 hours to 30 minutes, forcing suspicious devices to frequently authenticate. The advantage of this dynamic trust assessment mechanism lies in its adaptability. By continuously adjusting the trust level based on the device's real-time behavior, it ensures security without causing excessive inconvenience to legitimate users.

[0077] S107. Based on the dynamically adjusted permission allocation table and combined with the monitoring data of the isolation boundary operation status, the network isolation boundary is optimized to obtain an optimized multi-layer isolation boundary architecture.

[0078] Based on the device permission status recorded in the dynamically adjusted permission allocation table, traffic statistics are read from the network devices at the isolation boundary. This includes the number of connection requests blocked by access control rules per unit time, the size of data traffic that successfully passed the boundary but was marked as suspicious, the cumulative number of times protection rules matched and blocked, and the number of packets dropped by each forwarding queue due to exceeding buffer capacity. The blocking rate, suspicious traffic ratio, and queue overflow rate are calculated to obtain a boundary protection status monitoring table containing quantitative indicators of isolation effectiveness. For the quantitative indicators in the boundary protection status monitoring table, the blocking rate, suspicious traffic ratio, and queue overflow rate are compared with preset standard values. If the blocking rate is below the lower limit of the standard, it indicates that the isolation rules are too lenient and a low score is assigned. If the suspicious traffic ratio exceeds the upper limit of the standard, it indicates a protection blind spot and a low score is assigned. If the queue overflow rate is too high, it indicates improper resource configuration and a low score is assigned. The three scores are weighted and summed to obtain a comprehensive score. If the comprehensive score is below the passing line, the corresponding problem type is identified, resulting in an isolation vulnerability analysis table that marks the specific problem location and severity. Based on the problem types and locations identified in the isolation vulnerability analysis table, the allowed range of source IP addresses and the number of open ports were narrowed for cases where the rules were too lenient. Deep detection conditions based on packet characteristics were added to protect blind spots. The buffer size and scheduling weight of each queue were adjusted to address improper resource configuration. A content filtering mechanism for specific application protocols was added to the existing protection layers. The specific parameter changes for each adjustment were recorded to obtain an optimized multi-layer isolation boundary architecture that includes stricter access restrictions, more accurate detection rules, and more reasonable resource allocation.

[0079] Specifically, the construction of the boundary protection status monitoring table relies on the built-in statistical functions of network devices. Modern network devices are equipped with detailed traffic statistics modules that can record various network events in real time. The blocking rate is calculated based on the enforcement of access control lists; a counter increments whenever a packet is rejected for not conforming to the rules. This metric directly reflects the strictness of the isolation policy.

[0080] In one possible implementation, identifying suspicious traffic requires more sophisticated analysis mechanisms. While some data flows may pass basic access control rules, their behavior patterns may be anomalous. For example, a device may have permission to access a file server, but if it downloads an unusually large amount of data in a short period or accesses numerous different file directories, this behavior would be flagged as suspicious. By statistically analyzing the proportion of such suspicious traffic to total traffic, vulnerabilities in existing rules can be assessed.

[0081] Specifically, monitoring queue overflow rates reveals the rationality of network resource allocation. When high-priority service traffic suddenly increases, if the allocated queue buffer is too small, data packets will be dropped. This packet loss not only affects user experience but may also mask real security threats. By monitoring the overflow status of each queue, imbalances in resource allocation can be detected in a timely manner.

[0082] It should be noted that the overall score is calculated using a weighted summation method. The weights of different indicators reflect their importance in the overall security assessment. The blocking rate is usually given a high weight because it directly relates to the effectiveness of preventing unauthorized access. The suspicious traffic ratio has a lower weight, reflecting the ability to detect potential threats. The queue overflow rate has a relatively low weight, but this indicator becomes more important under high network load conditions.

[0083] For example, when the blocking rate is only 20%, far below the expected 60%, it indicates that most access requests are allowed through, and the isolation effect is poor. Further analysis may reveal that the existing rules only restrict a few specific IP addresses, while attackers can easily bypass the restrictions by changing their IP addresses. In this case, a stricter strategy is needed, such as restricting allowed source addresses to a specific network segment. The value of the isolation vulnerability analysis table lies in its ability to accurately locate problems. It not only points out the problems but also clarifies their type and location. Protection blind spots often appear in new application protocols or encrypted traffic, and traditional port and IP address filtering cannot effectively identify the true intent of this traffic. Therefore, it is necessary to introduce a detection mechanism based on application layer characteristics. The optimized multi-layer isolation boundary architecture embodies the concept of defense in depth. The first layer achieves basic isolation through network layer access control, the second layer strengthens protection through transport layer port restrictions, and the third layer delves into the application layer for content inspection. Each layer has its specific protection focus, complementing each other to form a complete protection system. This progressive optimization process ensures continuous improvement of network security strategies. By continuously monitoring, evaluating, and adjusting, we adapt to ever-changing security threats and maintain a high level of protection.

[0084] S108. Based on the optimized multi-layer isolation boundary architecture, obtain the subsequent campus network behavior logs and trust score data of all devices, and generate a real-time security status report.

[0085] Based on the monitoring point locations defined in the optimized multi-layer isolation boundary architecture, access logs of all network devices are collected from each boundary device, including access timestamps, target resource IP addresses, number of bytes transmitted, and network protocols used. Simultaneously, the current trust score of each device is read, and the number of accesses, the number of different target resources, and the total amount of data transmitted for each device are statistically analyzed according to time windows. These statistical values ​​are combined to form a device behavior numerical sequence, resulting in a device behavior feature table containing device identifiers, behavior numerical sequences, and current trust scores. For the behavior numerical sequences recorded in the device behavior feature table, the deviation from the device's historical average behavior value is calculated. If any deviation in access counts, resource quantity, or data volume exceeds a preset anomaly threshold, the device is marked as an abnormal device. The trust score of the abnormal device is reduced according to preset deduction rules. Simultaneously, flow control parameters are configured on the network boundary device, limiting its maximum transmission rate to a preset percentage of the original quota and shortening the allowed access period to a preset time range, resulting in an abnormal device management table containing abnormal device identifiers, adjusted trust scores, and restriction parameter settings. Based on the abnormal device management table, determine whether the adjusted trust score of each abnormal device is lower than the preset mandatory monitoring threshold. If it is lower than the threshold, add the device to the continuous monitoring list, configure log collection rules to capture all network request details, summarize the current status information of all devices, count the number of normally operating devices, the distribution of various abnormal devices, the effectiveness status of restriction measures, and the list of devices below the monitoring threshold, and generate a real-time security status report that includes device classification statistics, abnormal type distribution, and a list of key monitoring objects.

[0086] Specifically, the construction of the device behavior characteristic table is based on the statistical analysis principles of time series data. By setting fixed time windows, such as hourly or daily, the system can capture the periodic patterns of device behavior. The number of accesses reflects the activity level of the device; a normal office computer may generate hundreds of network requests per hour during working hours, while this number will drop significantly during non-working hours. The number of different target resources reveals the breadth of device access; teacher devices typically access teaching platforms, mail servers, and document sharing systems, while student devices have a relatively concentrated range of accesses.

[0087] In one possible implementation, the formation of the behavioral numerical sequence requires standardization of the raw data. Because different indicators have vastly different dimensions and numerical ranges, direct combination can mask the influence of some indicators. The number of accesses may vary between 0 and 1000, while the amount of data transmitted can reach several gigabytes, differing by several orders of magnitude. Through normalization, all indicators are mapped to the same numerical range, ensuring a relatively balanced contribution of each dimension to the final result.

[0088] Specifically, the historical average behavior value is calculated using a moving average method. The system stores the behavior data of each device over the past 30 days and calculates its average performance over the same period. This method can adapt to slow changes in device behavior; for example, a researcher might gradually increase access to certain resources as a project requires, and the moving average can track this trend without falsely reporting it as an anomaly. The calculation of the degree of deviation takes into account the standard deviation; if the current behavior exceeds the range of plus or minus two standard deviations from the historical average, it is considered a significant deviation.

[0089] It's important to note that setting anomaly detection thresholds requires a balance between security and availability. Overly strict thresholds can lead to numerous false alarms, impacting normal operations; conversely, overly lenient thresholds may miss genuine threats. In practice, dynamic thresholds are typically used, adjusted based on the overall network security posture and historical attack patterns. During exam weeks, student access to the academic affairs system increases dramatically, at which point the system will correspondingly raise the access thresholds for relevant resources.

[0090] For example, the trust scoring deduction rules reflect the concept of risk-based hierarchical management. Minor behavioral deviations, such as a slightly higher-than-average number of visits, may only result in a 5-point deduction; moderate anomalies, such as a sudden access to a large number of new resources, deduct 15 points; while severe anomalies, such as downloading a large amount of sensitive data late at night, result in a direct 30-point deduction. This hierarchical mechanism allows the system to respond appropriately to different levels of risk. The configuration of traffic control parameters directly affects the network user experience of abnormal devices. Limiting the transmission rate to 20% of the original quota means that a device that originally had 100Mbps of bandwidth can now only use 20Mbps. This speed is still sufficient for basic web browsing and email, but it will significantly impact high-bandwidth applications such as large file downloads or video streaming. Time-based restrictions may only allow devices to access the network during working hours, preventing malicious activities during periods of weak oversight. The value of real-time security status reports lies in their global perspective. By aggregating the status information of various devices, administrators can quickly understand the security posture of the entire network. The report's equipment classification statistics show the proportion of normal, abnormal, and high-risk equipment; the distribution of abnormal types reveals the main types of threats currently faced, such as data breaches, malicious scanning, or resource abuse; and the list of key monitoring targets provides security teams with the targets that need to be focused on, ensuring that limited human resources are used where they are most critical.

[0091] S109. Generate security protection configuration based on real-time security status report.

[0092] Based on the list of abnormal devices and threat type distribution marked in the real-time security status report, system operation logs and recorded security alarm events are read from network devices at each layer to obtain the content of the currently deployed threat feature identification rule base. Simultaneously, the number of concurrent connections during peak network access periods, bandwidth utilization in different time periods, and packet processing queue length are collected to calculate the ratio of peak to average load, resulting in a comprehensive network status dataset containing load fluctuation characteristics. For the load fluctuation characteristics in the comprehensive network status dataset, when the peak load exceeds a preset multiple of the average load, the number of virtual network interfaces is increased and the data buffer size is expanded. The allocation target is determined by calculating the remainder when the source address hash value of a new connection request is divided by the total number of available interfaces, achieving a uniform distribution of connection requests. At the same time, abnormal behavior patterns not identified by existing rules are extracted from the alarm event list, and newly discovered attack feature parameters are added to the threat feature identification rule base, resulting in a resource optimization configuration table containing the newly added threat features. Based on the newly added threat characteristics in the resource optimization configuration table, corresponding protection rule entries are generated. Each rule includes matching conditions, detection methods, and response actions. The generated rules are merged with existing rules and deployed to network boundary protection points. At the same time, the current number of connections, queue occupancy rate, and rule matching statistics of each network node are recorded and summarized to form the latest security protection configuration and the current network operating status.

[0093] Specifically, the construction of the comprehensive network status dataset highlights the importance of multi-dimensional monitoring. System operation logs record detailed information for each network event, including timestamp, event type, source address, and processing result. These seemingly trivial records can reveal hidden behavioral patterns during large-scale analysis. Security alerts are anomalies that have undergone initial screening; each alert represents a potential security threat, requiring further analysis to determine its root cause.

[0094] In one possible implementation, the calculation of load fluctuation characteristics needs to consider the impact of the time dimension. Campus network load exhibits significant periodicity, with network usage patterns differing during class time, breaks, and mealtimes. By statistically analyzing the average and peak load for each time period, the pattern of load fluctuation can be obtained. When the actual load for a given time period exceeds 1.5 times the historical average, the system needs to activate a resource expansion mechanism.

[0095] Specifically, dynamically increasing the number of virtual network interfaces is an effective way to handle sudden traffic surges. When physical network interface card (NIC) resources are limited, virtualization technology can create multiple logical interfaces, each capable of independently handling network traffic. Expanding the data buffer requires balancing memory usage and processing latency; an excessively small buffer can lead to packet loss, while an excessively large buffer increases processing latency. In practice, it is typically adjusted dynamically based on the current queue length; when queue occupancy exceeds 80%, the buffer size is increased by 50%.

[0096] It's important to note that the combined use of hash calculation and modulo operation ensures even load distribution. Hash calculation of the source address converts the IP address into a fixed-length numerical value. This process has good hashing properties; similar IP addresses will produce significantly different hash values. By performing a modulo operation on the hash value, values ​​of any range can be mapped to a finite number of interface numbers. Assuming there are 8 virtual interfaces, the modulo operation can evenly distribute connection requests across these 8 interfaces.

[0097] For example, the process of extracting new threat characteristics requires comparing and analyzing the differences between normal and abnormal behavior. When a device is found to suddenly send a large number of ICMP packets to multiple different network segments at 3:00 AM, this behavior clearly deviates from the normal pattern. The system will extract the characteristic parameters of this behavior: time characteristic is non-working time, protocol characteristic is ICMP, and target characteristic is cross-network segment scanning. These characteristics combine to form a new threat identification rule. The generation of protection rules follows the principle of combining exact matching and fuzzy matching. The matching conditions can be exact combinations of IP addresses and port numbers, or fuzzy conditions based on behavioral patterns. Detection methods include simple numerical comparison, complex pattern matching, and statistical anomaly detection. Response actions are set according to the severity of the threat; minor anomalies may only be logged, while severe threats require immediate connection blocking and alarm issuance. Real-time performance indicator monitoring ensures that security measures do not excessively affect normal business operations. When a rule is found to cause a large number of false alarms, the rule parameters are automatically adjusted or the rule is temporarily disabled, finding the optimal balance between security and availability.

[0098] Although embodiments of the present invention have been shown and described above, it is understood that the above embodiments are exemplary and should not be construed as limiting the present invention. Those skilled in the art can make changes, modifications, substitutions and variations to the above embodiments within the scope of the present invention.

Claims

1. A network security situation awareness method based on a multi-layered defense architecture, characterized in that, The method includes: The system acquires connection information from all devices access points on the campus network and generates risk level classification results for potentially risky devices. Specifically, it reads legitimate device hardware identifiers, operating system version numbers, and network protocol stack characteristic parameters stored in a pre-established device feature database. The acquired device connection information is compared item by item with the database records. If all three parameters—MAC address, operating system fingerprint, and protocol stack characteristic—match, the device is marked as a preliminarily trusted device in the device list. Based on the risk level classification results, the system obtains the connection targets and data flow information of potentially risky devices to determine if they attempt to access core resource areas. If the access target involves core resources, a temporary isolation command is triggered, resulting in an isolation priority ranking. The system dynamically adjusts the visitor network isolation boundary according to the isolation priority ranking, restricting risky devices to the visitor area, resulting in the network topology after setting the first layer of isolation boundaries. The campus network topology is structured by establishing firewalls between the core area and isolated areas, forming a second layer of isolation boundary, resulting in a multi-layered defense architecture. Based on this complete topology, network traffic within the isolation boundary is segmented for management, yielding load-balanced isolation boundary configuration parameters. Using these parameters, pre-labeled trusted devices are verified; if trust levels decrease, access permissions are adjusted, resulting in a dynamically adjusted permission allocation table. This dynamically adjusted table, combined with isolation boundary operational status monitoring data, optimizes the network isolation boundary, resulting in an optimized multi-layered isolation boundary architecture. Based on this architecture, subsequent campus network behavior logs and trust score data for all devices are obtained, generating a real-time security status report. Finally, security protection configurations are generated based on this report.

2. The network security situation awareness method based on a multi-layered defense architecture according to claim 1, characterized in that, The process of obtaining all device connection information from campus network access points and generating risk level classification results for potentially risky devices includes: Obtain the device's MAC address and IP address, read the hardware identifier and protocol stack features from the device feature database, compare the MAC address and protocol stack features, mark matching devices as preliminarily trusted devices, and generate a device classification list; for devices not marked in the device classification list, extract the source port and timestamp of the data packets, calculate the request frequency per unit time, mark devices with excessive frequency as high risk, and generate risk level classification results.

3. The network security situation awareness method based on a multi-layered defense architecture according to claim 1, characterized in that, The process involves obtaining information on the connection targets and data flow of potentially risky devices based on risk level classification results, determining whether they attempt to access core resource areas, and triggering temporary isolation commands if the access target involves core resources, thereby obtaining an isolation priority ranking, including: Extract the source IP address and target port of potentially risky devices, parse the packet 5-tuple and protocol characteristics, and generate a device access record table; based on the device access record table, compare the target address with the core resource area configuration file, mark the devices accessing the core resources, and generate a device access status table; based on the device access status table, count the number of times the core resources are accessed, calculate the product of risk weight and access count, and generate an isolation priority sequence by sorting the scores.

4. The network security situation awareness method based on a multi-layered defense architecture according to claim 1, characterized in that, The step of dynamically adjusting the visitor network isolation boundary according to isolation priority to restrict risky devices to the visitor area, resulting in the network topology after the first layer of isolation boundary is set, includes: Extract the list of high-priority risk devices, obtain the network segment addresses and virtual LAN identifiers from the area division configuration file, and generate a device migration mapping table; based on the device migration mapping table, generate port reconfiguration instructions, modify the virtual LAN identifier of the device port to the guest area identifier, add access restriction rules based on MAC addresses, and generate a network isolation execution instruction set; based on the network isolation execution instruction set, execute port reconfiguration and access control updates to generate the network topology after the first layer of isolation boundary is set.

5. A network security situation awareness method based on a multi-layered defense architecture according to claim 1, characterized in that, Based on the campus network topology set at the first-layer isolation boundary, a firewall is established between the core area and the isolation area to form a second-layer isolation boundary, resulting in a network topology under a multi-layer defense architecture, including: Scan the servers in the core business area to obtain the IP address range and port list, and generate a core resource distribution table; based on the core resource distribution table, configure firewall rules, including source IP address and port matching conditions, to form a boundary protection rule set; based on the boundary protection rule set, configure application layer detection, identify malicious parameter patterns, establish an IP whitelist, and generate a complete network topology under a multi-layer defense architecture.

6. The network security situation awareness method based on a multi-layered defense architecture according to claim 1, characterized in that, Based on the complete network topology under the multi-layered defense architecture, the network traffic within the isolation boundary is segmented and managed to obtain the load-balanced isolation boundary configuration parameters, including: Read the network interface bandwidth utilization and concurrent connection count to generate a network load status table; based on the network load status table, extract the core business data flow tags, classify the data flows into high, medium, and low priorities, and generate a traffic classification configuration table; based on the traffic classification configuration table, set the scheduling weight of high-priority queues and generate isolation boundary configuration parameters after load balancing.

7. A network security situation awareness method based on a multi-layered defense architecture according to claim 1, characterized in that, The process involves verifying initially trusted devices based on the isolation boundary configuration parameters after load balancing. If the verification results show a decrease in trust level, the access permissions of the devices within the isolation boundary are adjusted to obtain a dynamically adjusted permission allocation table, including: Read the access logs of initially trusted devices, extract timestamps and resource categories, and generate a device behavior characteristic record table; based on the device behavior characteristic record table, compare the access time and resource category with the trust assessment parameters, calculate the trust score, and generate a device trust assessment result table; based on the device trust assessment result table, reduce the permissions of low-trust devices, modify the access control list, and generate a dynamically adjusted permission allocation table.

8. A network security situation awareness method based on a multi-layered defense architecture according to claim 1, characterized in that, The aforementioned optimization of the network isolation boundary, based on the dynamically adjusted permission allocation table and monitoring data of the isolation boundary's operational status, results in an optimized multi-layered isolation boundary architecture, including: Read the traffic statistics results of the isolation boundary, calculate the blocking rate and the proportion of suspicious traffic, and generate a boundary protection status monitoring table; based on the boundary protection status monitoring table, compare the blocking rate with the standard value, identify isolation vulnerabilities, and generate an isolation vulnerability analysis table; based on the isolation vulnerability analysis table, narrow down the range of source IP addresses, add deep detection conditions, and generate an optimized multi-layer isolation boundary architecture.

9. A network security situation awareness method based on a multi-layered defense architecture according to claim 1, characterized in that, Based on the optimized multi-layered isolation boundary architecture, the system acquires subsequent campus network behavior logs and trust score data for all devices, and generates a real-time security status report, including: Collect device access logs and trust scores to generate a device behavior feature table; calculate the behavior value deviation based on the device behavior feature table, mark abnormal devices, lower the trust score, configure traffic limit parameters, and generate an abnormal device management table; configure continuous monitoring rules based on the abnormal device management table, summarize device status information, and generate a real-time security status report.

10. A network security situation awareness method based on a multi-layered defense architecture according to claim 1, characterized in that, The generation of security protection configuration based on real-time security status reports includes: Read system logs and threat signature rule base, collect load fluctuation data, and generate a comprehensive network status dataset; based on the comprehensive network status dataset, expand the number of virtual interfaces, add new threat signatures, and generate security protection configuration.

Images