Dynamic micro-isolation strategy processing system and method based on machine learning

Abstract

The invention relates to the technical field of intelligent factory network security, in particular to a dynamic micro-isolation strategy processing system and method based on machine learning, and the system comprises a data processing module, a model training module, a strategy decision module and a strategy execution module. Extracting a flow characteristic, a time sequence characteristic and an access mode characteristic; the model training module is used for training a strategy prediction model based on the bidirectional gating recurrent neural network; the strategy decision module inputs real-time feature data, and triggers full-table scanning when the confidence coefficient is low; and the strategy execution module implements an isolation strategy and feeds back effect data to optimize the model. The method comprises the steps of data processing, model training, strategy decision making and strategy execution, a historical access mode is automatically learned through machine learning, and a micro-isolation strategy is dynamically generated. According to the method, the problems of low efficiency and poor flexibility of a traditional static strategy are solved, and the processing efficiency and the safety protection capability are remarkably improved.

Description

Technical Field

[0001] The present invention belongs to the technical field of smart factory network security, and specifically relates to a dynamic micro-isolation policy processing system and method based on machine learning. Background Art

[0002] With the rapid development of intelligent manufacturing, smart factories have become a key area of ​​transformation and upgrading for the manufacturing industry. By integrating information technology, automation, and data analysis, smart factories achieve intelligent, autonomous, and efficient production processes. However, within the complex network environments of smart factories, ensuring secure isolation between devices and systems to prevent malicious attacks and data leaks has become a pressing issue.

[0003] Microsegmentation is an effective network security measure. It implements fine-grained access control at the network level, restricting communication between different devices and systems to protect critical resources and data. However, in the dynamically changing network environment of smart factories, traditional static microsegmentation policy configuration methods suffer from inefficiency and lack of flexibility. Therefore, a dynamic microsegmentation policy processing system and method is needed that can automatically adapt to network changes and quickly respond to security requirements.

[0004] The dynamic micro-segmentation policy processing system and method based on machine learning mainly involves two technologies: machine learning algorithms and micro-segmentation technology. The following is an introduction to these two technologies: Machine learning, a key branch of artificial intelligence, enables computers to learn from data and automatically improve their algorithms without explicit programming. In the field of cybersecurity, machine learning technology has been widely used in anomaly detection, intrusion detection, and threat prediction. By training machine learning models, anomalous network behavior can be automatically identified and predicted, triggering appropriate security response measures.

[0005] Microsegmentation is a network security measure based on software-defined networking (SDN) and virtualization technologies. It implements fine-grained access control policies between virtual machines, containers, or microservices, restricting communication between different components and thus preventing malicious attacks and data leaks. Microsegmentation offers advantages such as flexibility, ease of deployment, and management, making it widely used in cloud computing and virtualization environments.

[0006] Existing patent document 1 (Announcement No.: CN116319115A) discloses a matching method and system for dynamic rule management, including a dynamic rule maintenance mechanism, a historical rule cache, and an incremental compilation strategy; updating the operation counter when a rule is added / deleted, triggering rule recompilation when the set threshold is reached; temporarily storing the rules before deletion or modification in a recycling list to retain a traceable security policy; and only partially compiling the changed rules to avoid reconstruction of the full rule set. Although a dynamic compilation mechanism is adopted, rule changes still rely on manually predefined thresholds, where the operation count threshold is 5 and the time interval threshold is 60s. In the dynamic networking scenario of smart factory equipment, such as the real-time topology changes of digital twin systems, it is difficult to adapt to the frequency requirements of rapid device access and exit, resulting in high rule maintenance costs.

[0007] Existing patent document 2 (Announcement No.: CN118138314A) discloses a security policy system based on domain name mapping, including a multi-dimensional matching mechanism, policy priority determination, and cache acceleration technology. Security policy associations are established through dual mapping of target IP addresses and domain names. A multi-level policy arbitration module is used to prioritize domain name policies and traditional policies. A dynamic mapping relationship table is maintained to enable fast matching of high-frequency access policies. While this mapping table mechanism improves matching speed, measured data shows that when the number of policy entries exceeds 100,000, the traditional hash table query latency increases to 15-20ms, which cannot meet the real-time execution requirements of industrial control systems for micro-segmentation policies of less than 5ms. This also limits policy matching efficiency.

[0008] Furthermore, neither Patent Document 1 nor Patent Document 2 addresses the issue of dynamic trust assessment in a zero-trust environment. Experiments have shown that in industrial IoT scenarios, static policies can lead to over 45% of legitimate inter-process communications being mistakenly isolated, severely impacting the collaborative efficiency between the MES system and edge computing nodes.

[0009] In view of this, the present invention is proposed. Summary of the Invention

[0010] To address the aforementioned technical issues in the prior art, the present invention provides a dynamic micro-segmentation policy processing system and method based on machine learning, improving the efficiency and flexibility of micro-segmentation policy processing. By incorporating machine learning algorithms, the system automatically learns historical access patterns and traffic characteristics within the network, predicting and prioritizing the most likely micro-segmentation policy, thereby reducing unnecessary full table scans and resource consumption.

[0011] To achieve the above object, the technical solution of the present invention is as follows: In a first aspect, a dynamic micro-isolation policy processing system based on machine learning includes: Data processing module: used to integrate data sources and collect traffic data, extract traffic features from the traffic data after processing to obtain a feature data set, and output the feature data set to the model training module and the strategy decision module; Model training module: used to receive the feature data set of the data processing module, and obtain a strategy prediction model based on the feature data set through bidirectional gated recurrent neural network architecture training; Policy decision module: used to receive the feature data set of the data processing module and input the feature data set into the policy prediction model to obtain the micro-isolation policy; Policy execution module: used to generate access control rules based on the micro-isolation policy and implement traffic isolation, collect effect data of the execution of the micro-isolation policy, and feed the effect data back to the model training module.

[0012] Furthermore, the data processing module includes: Data source integration unit: used to integrate data sources and collect traffic data; Data cleaning unit: used to clean the traffic data collected by the data source integration unit. The data cleaning includes: duplicate data detection and deletion, error data correction and irrelevant data filtering; Feature extraction unit: used to extract traffic features from processed traffic data to obtain a feature data set.

[0013] Furthermore, the feature data set includes traffic features, time series features and access pattern features.

[0014] Furthermore, the model training module includes: Model selection unit: The bidirectional gated recurrent neural network architecture adopts a bidirectional LSTM architecture, and the bidirectional LSTM architecture includes a triple gating mechanism of a forget gate, an input gate, and an output gate; Data processing unit: used to divide the feature data set into training set and test set, and perform data standardization; Model training unit: This unit is used to initialize the weights and biases of the bidirectional LSTM architecture and define the loss function. It uses the Adam optimizer combined with the backpropagation algorithm to update the model parameters according to the gradient of the loss function, thereby automatically adjusting the learning rate. The number of training rounds and batch size are set, and parameter updates are repeated to obtain the policy prediction model.

[0015] Furthermore, the expression of the forget gate is:

[0016] in, is the weight matrix of the forget gate, which is used to convert the hidden state of the previous moment and the current input The concatenated vector is linearly transformed into the forget gate signal, is the bias term of the forget gate, is the Sigmoid activation function; The expression of the input gate is: ,

[0017] in, and is the weight matrix of the input gate, which is used to generate the input gate signal and candidate memory states , and are the bias items of the input gate and candidate memory state, respectively, used to adjust the linear transformation results, and Passing history information and current input, is the Sigmoid activation function, is the hyperbolic tangent function; The expression of the output gate is: ,

[0018] in, is the weight matrix of the output gate, used to generate the output gate signal , is the bias term of the output gate, and Passing history information and current input, is the Sigmoid activation function, The cell state Compress to [-1,1] to ensure the stability of the output value.

[0019] Furthermore, the policy decision module includes: Traffic analysis unit: used for extracting and processing features of the feature data set; Policy prediction unit: This unit is used to input the feature dataset processed by the traffic analysis unit into the policy prediction model for policy prediction, prioritize the output micro-segmentation policies, and give priority to executing policies with high confidence. Policy matching unit: Dynamically prioritizes matching based on confidence, and triggers a full table scan when confidence is low.

[0020] Furthermore, the calculation formula for the priority ranking is:

[0021] in, is the confidence level, is the historical success rate, and is the weight.

[0022] Furthermore, the policy execution module includes: Policy execution unit: used to configure access control lists or firewall rules for network devices according to micro-segmentation policies, and implement traffic isolation by dynamically isolating network traffic; Evaluation and optimization unit: used to monitor indicators and generate reports, update the model through incremental learning, and feed back to the model training module.

[0023] The second aspect is a dynamic micro-isolation policy processing method based on machine learning, including: S1. Data processing: collecting and preprocessing the smart factory network traffic data to generate a feature data set; outputting the feature data set to the model training step and the strategy decision step; S2, model training, receiving the feature data set, training a strategy prediction model based on a bidirectional gated recurrent neural network architecture, and iteratively updating the strategy prediction model parameters using a weighted loss function and an adaptive optimization algorithm; S3, policy decision, receiving the feature data set, inputting the policy prediction model to generate a prediction result, calculating a dynamic priority based on the prediction result, and matching the micro-segmentation policy according to the priority; S4. Policy execution: convert the micro-isolation policy into access control rules and implement traffic isolation, collect policy execution effect data and feed it back to the model training module.

[0024] Furthermore, the micro-isolation policy matching by priority in step S3 specifically includes: When the confidence level of the prediction result is greater than or equal to a preset threshold, the corresponding micro-isolation strategy is preferentially executed; When the confidence level of the prediction result is less than the preset threshold, a full table scan is triggered to verify the matching result, and the verification result is fed back to the strategy prediction model for optimization.

[0025] Compared with the prior art, the above-mentioned dynamic micro-isolation policy processing system and method based on machine learning provided by the present invention automatically learns historical access patterns and traffic characteristics in the network through machine learning algorithms, reduces the workload of manually defining rules, reduces the complexity of rule definitions, and improves the maintainability of the rule base. The system can automatically adapt to dynamic changes in the network environment without the need to manually update the rule base. It improves the system's adaptability to ensure that effective access control can be maintained when the network environment changes. It predicts and prioritizes the most likely micro-isolation policies through intelligent matching algorithms, reducing unnecessary full table scans. It significantly improves processing efficiency and reduces system resource consumption, especially in high-concurrency scenarios. It uses machine learning algorithms to predict access patterns and traffic characteristics that may occur in the future. It prevents potential security threats in advance, enhances the system's security protection capabilities, and reduces security risks. BRIEF DESCRIPTION OF THE DRAWINGS

[0026] Figure 1 An architectural diagram of a dynamic micro-isolation policy processing system provided by an embodiment of the present invention; Figure 2 Flowchart of the dynamic micro-isolation policy processing method provided in an embodiment of the present invention. DETAILED DESCRIPTION

[0027] The technical solution of the present invention will be clearly described below in conjunction with the accompanying drawings. Obviously, the described embodiments are not all embodiments of the present invention. All other embodiments obtained by ordinary technicians in this field without making creative work are within the scope of protection of the present invention.

[0028] It should be noted that, unless otherwise specifically stated, the relative arrangements of components and steps, and numerical expressions set forth in these embodiments should not be construed as limiting the scope of the present invention.

[0029] The following description of exemplary embodiments is merely illustrative and is not intended to limit the present invention, its application, or use in any sense. Technologies, methods, and apparatus known to those skilled in the art may not be discussed in detail herein, but to the extent applicable, such technologies, methods, and apparatuses should be considered part of this specification.

[0030] Example 1 See Figure 1 , Figure 1This is the architecture diagram of a machine learning-based dynamic micro-segmentation policy processing system proposed in this paper. This system, integrated into the smart factory operating system platform, improves the processing efficiency and flexibility of micro-segmentation policies through intelligent matching algorithms. The system also uses machine learning algorithms to analyze historical access patterns and traffic characteristics, predicting and prioritizing the most likely micro-segmentation policies. Specifically, it includes: A1. Data processing module: used to integrate data sources and collect traffic data, process the traffic data, extract traffic features to obtain a feature data set, and output the feature data set to the model training module and the policy decision module. The data processing module includes: A11. Data source integration unit: used to integrate data sources and collect traffic data; the system collects network traffic data from various devices and sensors in the smart factory network, including IP addresses, port numbers, communication protocols, timestamps, etc.

[0031] A12. Data cleaning unit: This unit is used to clean the traffic data collected by the data source integration unit. The data cleaning includes: detecting and deleting duplicate data, correcting erroneous data, and filtering irrelevant data to ensure data quality. A13. Feature Extraction Unit: This unit extracts traffic features from processed traffic data to generate a feature dataset. Key features, such as traffic size, packet type, and communication frequency, are extracted from the cleaned data for use in training machine learning models.

[0032] A2. Model training module: used to receive the feature dataset from the data processing module and train a policy prediction model based on the feature dataset using a bidirectional gated recurrent neural network architecture; wherein the feature dataset includes traffic features, time series features, and access pattern features; Choose an appropriate machine learning model based on the nature of the problem, such as a decision tree, random forest, or neural network. Considering the complexity and dynamic nature of micro-segmentation strategies, this solution uses an improved bidirectional LSTM architecture to dynamically learn network traffic patterns through a gating mechanism. The specific structure is as follows: A21, model selection unit: The bidirectional gated recurrent neural network architecture adopts a bidirectional LSTM architecture, which includes a triple gating mechanism of a forget gate, an input gate, and an output gate. The specific structure is as follows: A211. Cell state serves as a long-term memory carrier to store historical communication rules between smart factory devices. The specific update formula is:

[0033] in, is the output of the forget gate, is the input gate output, Candidate status.

[0034] A212. The expression of the forget gate is:

[0035] in, is the weight matrix of the forget gate, which is used to convert the hidden state of the previous moment and the current input The concatenated vector is linearly transformed into the forget gate signal, is the bias term of the forget gate, Sigmoid activation function; dynamically filters historical policy validity, such as expired device authentication rules.

[0036] A213, the expression of the input gate is:

[0037]

[0038] in, and is the weight matrix of the input gate, which is used to generate the input gate signal and candidate memory states , and are the bias items of the input gate and candidate memory state, respectively, used to adjust the linear transformation results, and Passing history information and current input, is the Sigmoid activation function, is a hyperbolic tangent function that integrates current traffic characteristics, such as abnormal port access frequency.

[0039] A214, the expression of the output gate is:

[0040]

[0041] in, is the weight matrix of the output gate, used to generate the output gate signal , is the bias term of the output gate, and Passing history information and current input, is the Sigmoid activation function, The cell state Compress to [-1, 1] to ensure the stability of the output value. Generate a policy priority vector, and trigger execution when the confidence level is > 0.85.

[0042] A22, data processing unit: used to divide the feature data set into training set and test set, and perform data standardization; A23, Model Training Unit: This unit initializes the weights and biases of the bidirectional LSTM architecture and defines the loss function. It uses the Adam optimizer combined with the backpropagation algorithm to update the model parameters according to the gradient of the loss function, thereby automatically adjusting the learning rate. It also sets the number of training rounds and batch size, and repeatedly performs parameter updates to obtain the policy prediction model.

[0043] The Bi-LSTM structure is used to simultaneously capture the before-and-after timing dependencies of device communications, improving the ability to detect new attack patterns.

[0044] A231. Training data preparation: Divide historical access pattern and traffic feature data into training and test sets for model training and validation.

[0045] A232. Model training: Use training set data to train the model, and adjust model parameters through iterative optimization algorithms so that the model can accurately predict the most likely micro-isolation strategy.

[0046] A3. Policy decision module: configured to receive the feature data set from the data processing module and input the feature data set into the policy prediction model to obtain a micro-segmentation policy. Specifically, the module may include: A31, traffic analysis unit: used to extract and process the feature data set; the system analyzes the current network traffic data in real time and extracts key features.

[0047] A32, Policy Prediction Unit: This unit inputs the feature dataset processed by the traffic analysis unit into the policy prediction model for policy prediction, prioritizes the output micro-segmentation policies, and prioritizes high-confidence policies for execution. It also inputs real-time traffic data into the trained machine learning model, which predicts the most likely micro-segmentation policy based on historical access patterns and traffic characteristics. The priority ranking formula is:

[0048] in, is the confidence level, is the historical success rate, and Adjust the weights according to actual needs, for example: is 0.7, is 0.3.

[0049] A33, Policy matching unit: Dynamically prioritizes matching based on confidence, triggering a full table scan when confidence is low; based on the prediction results, the system prioritizes matching the most likely micro-isolation policy to reduce unnecessary full table scans.

[0050] A4. Policy Execution Module: This module is used to generate access control rules based on the micro-isolation policy and implement traffic isolation, collect data on the effect of the micro-isolation policy execution, and feed the effect data back to the model training module. The policy execution module includes: A41, Policy Execution Unit: Used to configure the access control list or firewall rules of network devices according to the micro-isolation policy, and implement traffic isolation by dynamically isolating network traffic; the system applies the matched micro-isolation policy to network traffic control to achieve dynamic isolation.

[0051] A42, Evaluation and Optimization Unit: This unit monitors metrics and generates reports, updates models through incremental learning, and provides feedback to the model training module. It also monitors network traffic and access behavior to evaluate the effectiveness of micro-segmentation policies.

[0052] A43, Model Optimization Unit: Regularly updates the machine learning model based on evaluation results and new network traffic data to improve prediction accuracy and strategy matching efficiency.

[0053] Example 2 See Figure 2 , Figure 2 This is a flowchart of a method for processing dynamic micro-isolation policies based on machine learning provided by the present invention. The method may include the following steps: S1. Data processing: collecting and preprocessing smart factory network traffic data to generate a feature data set for subsequent model training and policy decision-making; outputting the feature data set to the model training step and policy decision-making step; S11. Identify data sources. Identifying data sources involves identifying various devices and systems within the smart factory, including industrial control equipment (PLCs, SCADA systems, etc.), sensors, switches, routers, and other network devices. Network traffic data is collected using network protocols such as SNMP (Simple Network Management Protocol), NetFlow, and sFlow. These protocols enable real-time capture of device network communication data, ensuring comprehensive monitoring of all critical network activity.

[0054] S12. Data acquisition interface development: Develop dedicated interfaces that adapt to multiple device protocols, support Modbus, OPCUA and other industrial protocol parsing, achieve millisecond-level data acquisition and transmission, ensure data real-time and integrity, and capture data from various devices, sensors and network systems.

[0055] S13: Data Cleaning S131. Duplicate data detection and deletion: Use a hash table to compare data hash values, or identify duplicate records using a unique database index (such as a combination of device ID and timestamp). For example, if two data packets have identical timestamps and source IP addresses, they are considered duplicates and deleted.

[0056] S132. Identify and correct erroneous data. Use regular expressions to verify the IP address format (e.g., conforming to the "192.168.0.0-255" format specification), filter data items with port numbers out of range (e.g., greater than 65535), mark abnormal data as "invalid" or correct it according to preset rules (e.g., fill in the default port number 80).

[0057] S133, irrelevant data filtering, based on business tags, such as filtering non-production traffic between production environment and test environment, retaining only data related to smart manufacturing business, such as communication data between PLC and MES system.

[0058] S14. Feature extraction S141. Traffic feature extraction: extract key traffic features from the data, such as: Traffic size: calculate the total number of data bytes in a period of time. Packet type distribution: calculate the traffic proportion of protocols such as TCP and UDP. Communication frequency: calculate the number of communications per unit time. The formula is:

[0059] Wherein, packet size i represents the number of bytes of the i-th packet, and n is the total number of packets.

[0060] S142, time series features, through the sliding time window, extract the traffic change trend within a period of time. For example, the average traffic and peak traffic in the last hour can be calculated. For example: Average flow rate:

[0061] Peak flow:

[0062] in, is the total duration of the time window, is the flow rate at each time point.

[0063] S143 , access pattern characteristics, analyzing access patterns between IP addresses, such as periodic access, burst access, etc. Access patterns can be identified by using a frequency analysis method or a time series-based clustering algorithm.

[0064] S2, model training, receiving the feature data set, training a strategy prediction model based on a bidirectional gated recurrent neural network architecture, and iteratively updating the strategy prediction model parameters using a weighted loss function and an adaptive optimization algorithm; S21. Evaluate model applicability and select an appropriate machine learning model based on the complexity and dynamic nature of the micro-segmentation strategy. This patented improved bidirectional LSTM architecture.

[0065] S22. Training data preparation S221. Data partitioning: historically collected traffic data is divided into training and test sets in chronological order. Generally, 80% of the data is used as the training set and 20% as the test set, ensuring that the training and test sets do not overlap in time to avoid data leakage.

[0066] S222. Data standardization / normalization: standardize or normalize the feature values. For example, use Z-score standardization to convert each feature into a zero mean and unit variance form:

[0067] in, is the original data, is the mean, is the standard deviation.

[0068] S23. Model training S231. Initialize model parameters, randomly initialize LSTM weights and biases. Common initialization methods such as Xavier or He initialization can be used.

[0069] S232. Loss function definition: The loss function is used to measure the difference between the predicted strategy and the actual strategy. Here, weighted cross entropy loss is used:

[0070] in, is the sample balance weight of each strategy, are the true labels of various samples, is the predicted probability that the i-th sample belongs to the category.

[0071] S233, optimization algorithm, uses the Adam optimizer to update parameters, adjust model weights through the backpropagation algorithm, and minimize the loss function. The Adam optimizer combines the advantages of Momentum and RMSprop and can automatically adjust the learning rate during training.

[0072] S234, iterative training, set the appropriate number of iterations (epoch) and batch size (batchsize), and perform multiple training until the model converges or reaches the preset stopping condition.

[0073] S3, policy decision, receiving the feature data set, inputting the policy prediction model to generate a prediction result, calculating the dynamic priority based on the prediction result, and matching the micro-isolation policy according to the priority; when the confidence of the prediction result is greater than or equal to the preset threshold, the corresponding micro-isolation policy is executed first; when the confidence of the prediction result is less than the preset threshold, a full table scan is triggered to verify the matching result, and the verification result is fed back to the policy prediction model for optimization.

[0074] S31, data capture, real-time capture of current network traffic data, collection of new traffic data packets, and preliminary processing.

[0075] S32, feature extraction, extracting key features from real-time traffic data using the same method as step S102.

[0076] S33, feature processing layer, sliding window (window size T = 60s) statistics traffic characteristics, the specific formula is: , in, is the window size, is the traffic value at the t-th time point; and DBSCAN clustering is used to identify abnormal access patterns (clustering radius ε=0.5, minimum sample number MinPts=5).

[0077] S34. Strategy Prediction S341, model input, passes the real-time traffic features as input to the trained LSTM model (hidden layer ≥ 128 nodes) for strategy prediction. The input dimension is the feature vector X∈Rn×k (n is the time step, k is the number of features).

[0078] S342. Prediction output: The model outputs the most likely micro-segmentation strategy, which is expressed as a strategy category or execution parameter.

[0079] S35, Strategy Matching S351. Prioritization: Prioritize possible micro-isolation strategies based on the confidence of the model output, and prioritize high-confidence strategies. Dynamic priority ranking calculation:

[0080] Among them, Confidence is the confidence level, is the historical success rate, with weights of 0.7 and 0.3 respectively. This formula strikes a balance between real-time response and stability through a weight distribution of 0.7:0.3, and is suitable for complex systems that need to dynamically adjust decision priorities.

[0081] S352, matching execution, under the condition of meeting the policy priority, select the optimal policy and execute it, reducing unnecessary full table scans and improving matching efficiency.

[0082] S4. Policy execution: convert the micro-isolation policy into access control rules and implement traffic isolation, collect policy execution effect data and feed it back to the model training module.

[0083] S41. Rule configuration: Based on the matched micro-isolation policy, configure the access control list (ACL) or firewall rules of the network device to limit the access rights of network traffic.

[0084] S42, traffic isolation, implements configured rules, implements micro-segmentation strategies by dynamically isolating network traffic, and ensures that access rights between different devices and services meet security requirements.

[0085] S43. Effect evaluation S431. Monitoring indicators: Real-time monitoring of network traffic, access behavior, and policy enforcement effectiveness. Monitoring indicators include traffic reduction, changes in access patterns, etc.

[0086] S432. Evaluation report: Generate evaluation reports regularly to analyze the execution effect of micro-isolation strategies, including the execution efficiency of strategies, the isolation effect of traffic, etc.

[0087] S44. Model Optimization: Incremental learning is used, and the model is updated weekly, retaining a weight of 0.2 for historical data. When the confidence level is less than 0.85, a full table scan is triggered, and the results are fed back into model training.

[0088] In summary, the present invention has the following advantages: 1. Simplify rule definition: Automatically learn historical access patterns and traffic characteristics in the network through machine learning algorithms, reducing the workload of manually defining rules; reducing the complexity of rule definition and improving the maintainability of the rule base.

[0089] 2. Enhanced flexibility: Enables the system to automatically adapt to dynamic changes in the network environment without the need to manually update the rule base; improves the system's adaptability to ensure effective access control when the network environment changes.

[0090] 3. Improve processing efficiency: Through intelligent matching algorithms, the most likely micro-isolation strategies are predicted and prioritized, reducing unnecessary full table scans. This significantly improves processing efficiency and reduces system resource consumption, especially in high-concurrency scenarios.

[0091] 4. Enhanced intelligent prediction capabilities: Use machine learning algorithms to predict possible access patterns and traffic characteristics in the future; prevent potential security threats in advance, enhance the system's security protection capabilities, and reduce security risks.

[0092] The above specific embodiments are only used to illustrate the technical solutions of the present invention and are not intended to limit the present invention. Although the present invention has been described in detail with reference to examples, those skilled in the art should understand that the technical solutions of the present invention may be modified or replaced by equivalents without departing from the scope of the technical solutions of the present invention, and all of these should be included in the scope of the claims of the present invention.

Claims

1. A dynamic micro-isolation policy processing system based on machine learning, characterized in that: include: Data processing module: used to integrate data sources and collect traffic data, process the traffic data and extract traffic features to obtain features Data set, and output the feature data set to the model training module and the strategy decision module; Model training module: used to receive the feature data set of the data processing module, and obtain a strategy prediction model based on the feature data set through bidirectional gated recurrent neural network architecture training; Policy decision module: used to receive the feature data set of the data processing module and input the feature data set into the policy prediction model to obtain the micro-isolation policy; Policy execution module: used to generate access control rules based on the micro-isolation policy and implement traffic isolation, collect effect data of the execution of the micro-isolation policy, and feed the effect data back to the model training module.

2. The dynamic micro-isolation policy processing system based on machine learning according to claim 1 is characterized in that The data processing module includes: Data source integration unit: used to integrate data sources and collect traffic data; Data cleaning unit: used to clean the traffic data collected by the data source integration unit. The data cleaning includes: duplicate data detection and deletion, error data correction and irrelevant data filtering; Feature extraction unit: used to extract traffic features from processed traffic data to obtain a feature data set.

3. The dynamic micro-isolation policy processing system based on machine learning according to claim 2 is characterized in that: The feature dataset includes traffic features, time series features, and access pattern features.

4. The dynamic micro-isolation policy processing system based on machine learning according to claim 1 is characterized in that The model training module includes: Model selection unit: The bidirectional gated recurrent neural network architecture adopts a bidirectional LSTM architecture, and the bidirectional LSTM architecture includes a triple gating mechanism of a forget gate, an input gate, and an output gate; Data processing unit: used to divide the feature data set into training set and test set, and perform data standardization; Model training unit: This unit is used to initialize the weights and biases of the bidirectional LSTM architecture and define the loss function. It uses the Adam optimizer combined with the backpropagation algorithm to update the model parameters according to the gradient of the loss function, thereby automatically adjusting the learning rate. The number of training rounds and batch size are set, and parameter updates are repeated to obtain the policy prediction model.

5. The dynamic micro-isolation policy processing system based on machine learning according to claim 4 is characterized in that: The expression of the forget gate is: in, is the weight matrix of the forget gate, which is used to convert the hidden state of the previous moment and the current input The concatenated vector is linearly transformed into the forget gate signal, is the bias term of the forget gate, is the Sigmoid activation function; The expression of the input gate is: , in, and is the weight matrix of the input gate, which is used to generate the input gate signal and candidate memory states , and are the bias items of the input gate and candidate memory state, respectively, used to adjust the linear transformation results, and Passing history information and current input, is the Sigmoid activation function, is the hyperbolic tangent function; The expression of the output gate is: , in, is the weight matrix of the output gate, used to generate the output gate signal , is the bias term of the output gate, and Passing history information and current input, is the Sigmoid activation function, The cell state Compress to [-1,1] to ensure the stability of the output value.

6. The dynamic micro-isolation policy processing system based on machine learning according to claim 1 is characterized in that: The policy decision module includes: Traffic analysis unit: used for extracting and processing features of the feature data set; Policy prediction unit: This unit is used to input the feature dataset processed by the traffic analysis unit into the policy prediction model for policy prediction, prioritize the output micro-segmentation policies, and give priority to executing policies with high confidence. Policy matching unit: Dynamically prioritizes matching based on confidence, and triggers a full table scan when confidence is low.

7. The dynamic micro-isolation policy processing system based on machine learning according to claim 6 is characterized in that: The calculation formula for the priority ranking is: in, is the confidence level, is the historical success rate, and is the weight.

8. The dynamic micro-isolation policy processing system based on machine learning according to claim 1 is characterized in that: The policy execution module includes: Policy execution unit: used to configure access control lists or firewall rules for network devices according to micro-segmentation policies, and implement traffic isolation by dynamically isolating network traffic; Evaluation and optimization unit: used to monitor indicators and generate reports, update the model through incremental learning, and feed back to the model training module.

9. A dynamic micro-isolation policy processing method based on machine learning, characterized in that: include: S1, data processing, collects smart factory network traffic data and preprocesses it to generate feature data sets; Outputting the feature data set to the model training step and the strategy decision step; S2, model training, receiving the feature data set, training a strategy prediction model based on a bidirectional gated recurrent neural network architecture, and iteratively updating the strategy prediction model parameters using a weighted loss function and an adaptive optimization algorithm; S3, policy decision, receiving the feature data set, inputting the policy prediction model to generate a prediction result, calculating a dynamic priority based on the prediction result, and matching the micro-segmentation policy according to the priority; S4. Policy execution: convert the micro-isolation policy into access control rules and implement traffic isolation, collect policy execution effect data and feed it back to the model training module.

10. The method for processing dynamic micro-isolation strategies based on machine learning according to claim 9 is characterized in that: Step S3 matches the micro-isolation policy by priority, specifically including: When the confidence level of the prediction result is greater than or equal to a preset threshold, the corresponding micro-isolation strategy is preferentially executed; When the confidence level of the prediction result is less than the preset threshold, a full table scan is triggered to verify the matching result, and the verification result is fed back to the strategy prediction model for optimization.

Images