A terminal security system and method for generating firewall control policies

Abstract

The application relates to the technical field of network security, in particular to a terminal security protection system and method for generating a firewall control strategy, which comprises a scene determination module, a second acquisition module, a risk assessment module and a strategy generation module; the scene determination module is used for determining a real-time business scene for generating a firewall control strategy according to running environment information; the second acquisition module is used for acquiring corresponding risk assessment parameters according to the real-time business scene; the risk assessment module is used for generating a risk assessment result according to the risk assessment parameters; and the strategy generation module is used for generating a firewall control strategy according to the risk assessment result. The application can generate a firewall control strategy according to risk levels by collecting terminal running environment information, combining real-time business scene dynamic identification and risk assessment, and has the advantages of strong dynamics, high precision, and adaptation to multiple scenes. The application can effectively reduce the misjudgment rate, improve the terminal security response efficiency, reduce manual intervention, and improve the overall protection capability.

Description

Technical Field

[0001] This invention relates to the field of network security technology, and specifically to an endpoint security protection system and method for generating firewall control policies. Background Technology

[0002] With the accelerating pace of digital transformation, terminal devices have become core nodes for enterprise data flow and business operations. According to statistics, over 80% of critical enterprise business data needs to be processed and transmitted through terminal devices. However, current terminal security protection methods still rely primarily on traditional static strategies, facing the dual dilemma of "static protection failure and difficulty in defending against dynamic threats," severely restricting enterprises' ability to operate securely in the digital environment.

[0003] Existing endpoint protection solutions primarily rely on traditional technologies such as static firewalls and antivirus software. Their core mechanism is threat identification and defense based on rule bases and signature matching. However, with the continuous evolution of new attack techniques and the increasing diversification and intelligence of attack methods, static rules are insufficient to cover all potential risks and are often outdated, failing to meet the actual needs of dynamic security protection. For example, in a corporate office setting, a financial institution, despite having deployed a traditional firewall system, still experiences frequent security incidents, such as the wrongful blocking of legitimate remote maintenance IPs and ransomware bypassing protection by using whitelisted applications. Statistics show that its security team manually adjusts firewall policies more than 200 times per month. However, due to the continuous emergence of new malicious processes every week (an average of 3 to 5 new types appearing weekly), and the average manual response cycle of 2 days, protection policies are outdated and unable to respond promptly to rapidly evolving attack methods.

[0004] Therefore, improving the network security of terminal devices is a current research direction. Summary of the Invention

[0005] (I) Purpose of the Invention

[0006] The purpose of this invention is to provide a terminal security protection system and method for generating firewall control policies based on risk levels by collecting terminal operating environment information, combining real-time business scenario dynamic identification and risk assessment, and possessing advantages such as high dynamism, high accuracy, and adaptability to multiple scenarios. This system effectively reduces false positive rates, improves terminal security response efficiency, reduces manual intervention, and enhances overall protection capabilities.

[0007] (II) Technical Solution

[0008] To address the aforementioned issues, this invention provides an endpoint security protection system for generating firewall control policies, comprising: a first acquisition module, a scenario determination module, a second acquisition module, a risk assessment module, and a policy generation module;

[0009] The first data acquisition module, the scenario determination module, the second data acquisition module, the risk assessment module, and the strategy generation module are connected in sequence;

[0010] The first acquisition module is used to collect operating environment information;

[0011] The scenario determination module is used to determine the real-time business scenario for generating firewall control policies based on the operating environment information and a scenario matching mechanism.

[0012] The second acquisition module is used to acquire corresponding risk assessment parameters based on the real-time business scenario;

[0013] The risk assessment module is used to generate risk assessment results based on the risk assessment parameters and a risk fitting mechanism.

[0014] The policy generation module is used to generate firewall control policies based on the risk assessment results.

[0015] In another aspect, preferably, the present invention includes: the first acquisition module includes a terminal type acquisition unit, a business process acquisition unit, and a user behavior acquisition unit;

[0016] The terminal type acquisition unit is used to collect terminal type information, and the terminal type features include hardware features, network connection method and geographical location information;

[0017] The business process acquisition unit is used to collect terminal business process information. The business process characteristics include business system type, data processing flow, access resource type and sensitive data interaction behavior information.

[0018] The user behavior collection unit is used to collect user behavior information of the terminal, and the user behavior characteristics include application usage records, operation time distribution and interaction frequency.

[0019] In another aspect of the present invention, preferably, the scene determination module includes a scene feature parsing unit and a scene matching unit;

[0020] The scene feature parsing unit is used to parse the operating environment information collected by the first acquisition module and extract features for scene determination.

[0021] The scenario determination module is used to determine the real-time business scenario for generating firewall control policies based on the operating environment information and a scenario matching mechanism.

[0022] In another aspect of the present invention, preferably, the second acquisition module includes a business analysis unit and an indicator acquisition unit;

[0023] The business analysis unit is used to identify the security objectives corresponding to the real-time business scenario and determine the collected risk assessment parameters based on the security objectives.

[0024] The indicator acquisition unit is used to collect data based on the risk assessment parameters.

[0025] In another aspect of the present invention, preferably, the risk assessment parameters include baseline parameters, threat parameters, resource parameters, and time parameters;

[0026] The risk assessment module includes a baseline calculation unit, a threat matching unit, a resource detection unit, a risk fitting unit, and a time factor adjustment unit;

[0027] The baseline calculation unit is used to calculate the baseline deviation of the baseline parameters and obtain the baseline deviation value;

[0028] The threat matching unit is used to match the threat parameters with a preset threat intelligence database to obtain a threat matching value;

[0029] The resource detection unit is used to compare the resource parameters with a preset resource utilization threshold to obtain abnormal resource values;

[0030] The risk fitting unit is used to fit the baseline deviation value, threat matching value and resource anomaly value based on the risk fitting mechanism to obtain an initial risk value.

[0031] The time factor adjustment unit is used to adjust the initial risk value according to the time parameter to obtain the risk assessment result.

[0032] In another aspect of the present invention, preferably, the baseline deviation value is calculated using the following formula:

[0033]

[0034] Where Q represents the baseline deviation value, P1 represents the current value of the baseline parameter, P2 represents the historical average value of the baseline parameter, and P3 represents the historical standard deviation of the baseline parameter.

[0035] In another aspect of the present invention, preferably, the initial risk value is calculated using the following formula:

[0036] S = α1·Q + α2·D + α3·Z

[0037] Where S represents the initial risk value, α1 represents the baseline deviation value weight, Q represents the baseline deviation value, α2 represents the threat matching value weight, D represents the threat matching value, α3 represents the resource anomaly value weight, and Z represents the resource anomaly value.

[0038] In another aspect of the present invention, preferably, the time factor adjustment unit is used to adjust the initial risk value according to the time parameter to obtain a risk assessment result, including:

[0039] When the time parameter is within the working hours of a weekday, the initial risk value is multiplied by a first adjustment coefficient to obtain the risk assessment result;

[0040] When the time parameter is during non-working hours, the initial risk value is multiplied by a second adjustment coefficient to obtain the risk assessment result.

[0041] In another aspect of the present invention, preferably, the policy generation module is used to generate a firewall control policy based on the risk assessment result, including:

[0042] When the risk assessment result is greater than or equal to the preset first risk threshold, it is identified as a high-risk level. The firewall control policy includes: firewall rules that block the network connection of abnormal processes, and controlling the abnormal processes to migrate to an isolated sandbox environment for execution.

[0043] When the risk score is between the preset second risk threshold and the first risk threshold, it is identified as a medium risk level. The firewall control policy includes: a policy to restrict the execution permission of the process command, allowing only the execution of specific whitelisted instructions.

[0044] When the risk score is lower than the preset second risk threshold, it is identified as a low-risk level. The firewall control policy includes: allowing the current operation and recording relevant operation behavior information to the log.

[0045] In another aspect of the present invention, preferably, a protection method based on an endpoint security protection system for generating firewall control policies as described above includes:

[0046] Collect information about the terminal's operating environment;

[0047] Based on the aforementioned operating environment information and a scenario matching mechanism, the current real-time business scenario of the terminal is determined.

[0048] Based on the real-time business scenario, collect the corresponding risk assessment parameters;

[0049] Based on the aforementioned risk assessment parameters and a risk fitting mechanism, the risk assessment results are obtained.

[0050] Based on the risk assessment results, a firewall control policy is generated.

[0051] (III) Beneficial Effects

[0052] The above-described technical solution of the present invention has the following beneficial technical effects:

[0053] This invention acquires environmental parameters such as terminal type, user behavior, and business processes through a first acquisition module. A scenario determination module then determines the current business scenario of the terminal, enabling dynamic adaptation of protection strategies and solving the problem that traditional firewalls' "one-size-fits-all" strategies cannot handle complex scenarios. A second acquisition module collects relevant risk assessment parameters based on the specific scenario. A risk assessment module evaluates the risk level and introduces dynamic weighting mechanisms such as time factors to improve the timeliness and accuracy of risk assessment. A policy generation module then generates corresponding firewall control policies based on the risk level. This invention boasts advantages such as strong dynamism, high accuracy, and adaptability to multiple scenarios. It effectively reduces false positive rates, improves terminal security response efficiency, reduces manual intervention, and enhances overall protection capabilities. Attached Figure Description

[0054] Figure 1 This is a schematic diagram of the overall structure of one embodiment of the present invention. Detailed Implementation

[0055] To make the objectives, technical solutions, and advantages of this invention clearer, the invention will be further described in detail below with reference to specific embodiments and the accompanying drawings. It should be understood that these descriptions are merely exemplary and not intended to limit the scope of the invention. Furthermore, descriptions of well-known structures and techniques are omitted in the following description to avoid unnecessarily obscuring the concept of the invention.

[0056] Obviously, the described embodiments are only some, not all, of the embodiments of the present invention. All other embodiments obtained by those skilled in the art based on the embodiments of the present invention without inventive effort are within the scope of protection of the present invention.

[0057] Furthermore, the technical features involved in the different embodiments of the present invention described below can be combined with each other as long as they do not conflict with each other.

[0058] The invention will now be described in more detail with reference to the accompanying drawings. In the various drawings, the same elements are indicated by similar reference numerals. For clarity, the various parts in the drawings are not drawn to scale.

[0059] Example 1

[0060] An endpoint security protection system for generating firewall control policies. Figure 1 A schematic diagram of the overall structure of an embodiment of the present invention is shown, as follows. Figure 1 As shown, it includes: a first data acquisition module, a scenario determination module, a second data acquisition module, a risk assessment module, and a strategy generation module;

[0061] The first data acquisition module, the scenario determination module, the second data acquisition module, the risk assessment module, and the strategy generation module are connected in sequence;

[0062] The first acquisition module is used to collect runtime environment information. This runtime environment information includes, but is not limited to, terminal type, network status, application status, user login information, and access resource type. This module can obtain comprehensive and accurate environment data through system-level interface calls, API collection, or kernel monitoring. The collected runtime environment information is then transmitted to the scenario determination module. In this embodiment, the first acquisition module includes a terminal type acquisition unit, a business process acquisition unit, and a user behavior acquisition unit. The runtime environment information includes terminal type information, terminal business process information, and terminal user behavior information.

[0063] The terminal type acquisition unit is used to collect terminal type information. The terminal type features include hardware characteristics, network connection methods, and geographical location information. The terminal type acquisition unit is mainly used to identify the static and dynamic basic attributes of the terminal device. The terminal type features include hardware characteristics, network connection methods, and geographical location information. Hardware characteristics, such as the terminal device's CPU model, memory size, storage capacity, operating system version, and external device information, are obtained through system calls or hardware information interfaces. Network connection methods include whether the terminal uses a wired connection, Wi-Fi, VPN, cellular network, etc., and the type and security status of the network access point. Geographical location information can be determined based on the terminal's IP address geolocation, GPS positioning, network operator information, etc., to determine the terminal's current physical location and to judge whether it is in a trusted area or whether there is unauthorized access behavior.

[0064] The business process acquisition unit is used to collect terminal business process information. The business process characteristics include business system type, data processing flow, access resource types, and sensitive data interaction behavior information. The business process acquisition unit is responsible for collecting the business operation chain involved in the terminal's current running task and the associated data interaction characteristics. Specifically, this includes: business system type, data processing flow, access resource types, and sensitive data interaction behavior information. The business system type refers to the category of business system currently accessed or running by the terminal, such as office automation system, financial system, R&D platform, etc., used to determine its security level. The data processing flow includes the path and key node information of data from input, processing to output, reflecting the security risks of business flow. Access resource types include whether local databases, cloud services, internal file servers, external API interfaces, etc., are accessed. Sensitive data interaction behavior information includes whether customer privacy data, key technical documents, or financial statements are transmitted, whether transmission is encrypted, and whether external media are used. Data collection and labeling are achieved through business logs, system call records, and process modeling.

[0065] The user behavior collection unit is used to collect user behavior information from the terminal. The user behavior characteristics include application usage records, operation time distribution, and interaction frequency. The user behavior collection unit collects and analyzes the behavioral patterns of terminal operators to identify abnormal behavior or suspicious activities. The user behavior characteristics include application usage records, operation time distribution, and interaction frequency; application usage records refer to the list of programs used by the user over a period of time, usage duration, and launch frequency, used to analyze behavioral habits or identify potentially risky software; operation time distribution refers to the distribution of the user's daily activities over time periods, used to determine whether there are abnormal operations outside of normal working hours; interaction frequency refers to the frequency of user interaction actions with the system, such as clicking, inputting, switching windows, and accessing external links.

[0066] The scenario determination module is used to determine the real-time business scenario for generating firewall control policies based on the operating environment information. In this embodiment, the scenario determination module includes a scenario feature parsing unit and a scenario matching unit.

[0067] The scene feature parsing unit is used to parse the operating environment information collected by the first acquisition module and extract features for scene determination. The scene feature parsing unit also receives the raw operating environment information provided by the first acquisition module and performs structured parsing and feature extraction. The operating environment information is diverse, including terminal type information, terminal business process information, and terminal user behavior information. Through preset feature extraction rules, the operating environment information is analyzed from multiple dimensions to extract key features that are significant for scene identification, such as the type of currently accessed system (e.g., whether it is accessed through a financial system or R&D system), network status (e.g., whether it is accessed remotely via VPN), user operation mode (e.g., whether there is frequent application switching or access to sensitive resources). The feature parsing process can employ static rules, decision tree classifiers, or pattern recognition-based machine learning algorithms to ensure that the extracted results have good discriminative and generalization capabilities.

[0068] The scenario determination module is used to determine the real-time business scenario for generating firewall control policies based on the runtime environment information and a scenario matching mechanism. The scenario matching unit, after feature extraction, is responsible for comparing the currently extracted runtime feature vector with a pre-set scenario feature library in the system. The scenario feature library is a set of scenario templates pre-built based on a large number of typical business environments, covering terminal usage scenarios such as office intranet scenarios, remote access scenarios, data transmission scenarios, development and testing scenarios, and guest device access scenarios. Each scenario template contains a set of corresponding feature descriptions and threshold conditions. The scenario matching unit can use algorithms such as rule matching, K-nearest neighbors, support vector machines, or neural network classifiers to identify the business scenario type of the current terminal and output the corresponding scenario label and matching confidence score.

[0069] Through the synergy of scene feature analysis and matching mechanisms, the scene determination module can achieve real-time dynamic identification of terminal business status, enabling the system to quickly perceive and adapt to environmental changes. For example, when a terminal switches from a normal office scenario to a remote access scenario or a large file transfer scenario, the system can quickly identify the scene change and trigger the corresponding policy reconstruction process to meet the differentiated security protection needs under different business states.

[0070] The second acquisition module is used to acquire corresponding risk assessment parameters based on the real-time business scenario; in this embodiment, the second acquisition module includes a business analysis unit and an indicator acquisition unit.

[0071] The business analysis unit is used to identify the security objectives corresponding to the real-time business scenario and determine the collected risk assessment parameters based on the security objectives. The business analysis unit is responsible for further identifying the security objectives corresponding to the identified real-time business scenario. Security objectives refer to the key security attributes that need to be protected in a specific business environment, such as confidentiality, integrity, availability, and controllability. Security objectives are quantifiable protection effects that need to be achieved through technical means against the core risks that need to be prevented in a specific business scenario. Its core is to solve the questions of what to protect and what level of protection to achieve. Security objectives differ in different business scenarios. For example, in a financial system access scenario, confidentiality and data integrity may be the primary objectives; in a remote work scenario, identity authenticity and connection security are the focus; while in a software development and testing scenario, the emphasis is more on resource access control and operational integrity. The determination of security objectives needs to be combined with the characteristics of the business scenario, threat models, and compliance requirements, including:

[0072] Identify key business assets and determine the types of assets that need to be protected in the enterprise's office terminal environment. These assets include office documents, email systems, and internal servers.

[0073] Analyze the sources of threats and identify attack vectors that may harm the critical assets, including external intrusions, internal misoperations, and supply chain attacks;

[0074] Assess the impact of risks by evaluating the degree of risk of various threats based on the potential consequences of asset damage, such as data breaches, business interruptions, and compliance penalties.

[0075] Define security objectives and, based on the importance and risk impact of the assets, formulate protection effectiveness indicators, including: ransomware attack blocking rate of no less than 99%, data transmission detection delay of no more than 1 second, and false alarm rate of no more than 1%.

[0076] The following are information security objectives set for different typical business scenarios, describing the key security threats that need to be guarded against and the corresponding protection requirements for various terminals or systems during operation:

[0077] In enterprise office terminal scenarios, security objectives mainly include the following three aspects: First, preventing the leakage of sensitive data and preventing office documents from being illegally transmitted or leaked through external storage devices, emails, instant messaging tools, and other channels; second, blocking the execution of malicious software, especially against highly concealed and harmful attacks such as ransomware and fileless attacks; and third, monitoring and restricting illegal network connections to prevent terminals from privately connecting to suspicious external servers or control terminals, which could lead to potential data leakage or backdoor control risks.

[0078] In remote work scenarios, the focus is on ensuring the trustworthiness of remote access and the security of the transmission process. Specific security objectives include: ensuring the security of authentication during remote access, with multi-factor authentication recommended to reduce the risk of credential theft; ensuring the security of data transmission encryption during remote work, with high-security encryption protocols such as TLS 1.3 recommended; and restricting device access permissions, such as implementing access control through IP address and access time periods, to reduce the risk of sensitive resources being exposed.

[0079] In industrial control system scenarios, security objectives focus on ensuring the safe operation and data acquisition of industrial equipment. Key objectives include: blocking unauthorized control commands to prevent attackers from interfering with or disrupting industrial processes by maliciously injecting PLC control commands; ensuring the integrity and reliability of equipment status monitoring, such as detecting sudden changes or distortions in sensor data through anomaly detection mechanisms; and defending against attacks at the industrial control protocol layer, such as preventing malicious acts like tampering and forgery during Modbus / TCP communication.

[0080] In IoT device scenarios, security objectives mainly include: preventing device identity from being impersonated, such as by forging MAC addresses to access trusted networks for data theft or injection of control commands; promptly patching known vulnerabilities in device firmware, especially security flaws that could be remotely exploited to execute malicious code; and ensuring the integrity of data collected and transmitted by IoT devices, ensuring that sensor data is not tampered with during collection, transmission, and processing, and avoiding business misjudgments or control errors caused by data distortion.

[0081] The business analysis unit maps scenario tags to corresponding sets of security objectives using rule logic, mapping tables, or model analysis. After clarifying the security objectives, the business analysis unit further determines the types of risk assessment parameters to be collected based on each security objective. Risk assessment parameters are key data items used to assess whether current business operations possess threats or vulnerabilities, such as: abnormal login behavior indicators, data transmission paths and frequencies, external connection status, sensitive operation logs, access control policy compliance, known vulnerability exploitation behavior, abnormal system resource usage, abnormal process behavior, and peripheral device call frequency. This process reflects on-demand data collection, meaning different scenarios correspond to different parameter sets, avoiding redundant collection, improving efficiency, and reducing system load.

[0082] Specifically, in this embodiment, the determination of risk assessment parameters includes:

[0083] Set security objectives for business scenarios, including at least one of the following: prevent sensitive data leakage, block malware execution, monitor and restrict unauthorized network connections, ensure secure remote access authentication, ensure encrypted data transmission, block unauthorized control commands, and ensure device status monitoring.

[0084] Based on the security objective, risk assessment parameters directly related to it are selected. These risk assessment parameters are quantifiable and dynamically adaptable, and are used to characterize whether the current behavior deviates from the security objective.

[0085] The risk assessment parameters are collected and analyzed in real time to determine whether the current security status of the information system meets the set security objectives.

[0086] Risk assessment parameters for preventing the leakage of sensitive data include: file operation frequency, used to count the creation and transmission of sensitive files; network connection target IP and port information, used to identify suspicious paths for data transmission; and data transmission volume, used to measure the size and frequency of transmitted files.

[0087] Risk assessment parameters for blocking malware execution include: process behavior characteristics, including parent-child process relationships and DLL injection behavior; system resource usage, including CPU and memory usage; and whether the file hash value matches the malicious signature database.

[0088] Risk assessment parameters for monitoring and restricting unauthorized network connections include: network connection frequency, i.e., the number of new connections established per unit time; whether the network connection target is a high-risk IP or port; and network protocol type, used to detect abnormal communication behaviors such as UDP flood attacks.

[0089] Risk assessment parameters for ensuring secure remote access authentication include: authentication method and whether multi-factor authentication is enabled; whether the login IP address or geographical location comes from a trusted area; and whether the login time is outside of working hours.

[0090] Risk assessment parameters for ensuring encrypted data transmission include: encryption protocol version, including TLS 1.2 or TLS 1.3; whether the data packet decryption behavior exhibits man-in-the-middle attack characteristics; and the validity of the transmission certificate, including whether it is self-signed or expired.

[0091] The risk assessment parameters for blocking unauthorized control commands include: the legality of the command and whether it is within the preset whitelist; whether the command parameters exceed the set threshold range; and whether the source of the command is local or remote control.

[0092] Risk assessment parameters for ensuring equipment status monitoring include: sensor data fluctuation amplitude, used to identify abnormal changes in physical quantities such as temperature and pressure; equipment status change frequency, used to monitor the frequency of equipment startup, shutdown, and other behaviors; and communication protocol integrity, such as the correctness of Modbus / TCP checksums.

[0093] The indicator acquisition unit is used to collect data based on the risk assessment parameters. The indicator acquisition unit performs specific data acquisition operations according to the risk assessment parameter list provided by the business analysis unit. This unit collects target parameters in real time or periodically by calling system interfaces, monitoring log files, parsing network traffic, accessing audit records, or calling third-party security modules.

[0094] The risk assessment module is used to generate risk assessment results based on the risk assessment parameters and a risk fitting mechanism. In this embodiment, the risk assessment parameters include baseline parameters, threat parameters, resource parameters, and time parameters. The baseline parameters are used to characterize the behavior pattern of the terminal under normal operating conditions. The threat parameters reflect the characteristics of known or potential security threats existing in the current environment. The resource parameters are used to monitor abnormal changes in the system resource usage status. The time parameters are used to analyze the fluctuation characteristics of behavior or threat events over time.

[0095] The risk assessment module includes a baseline calculation unit, a threat matching unit, a resource detection unit, a risk fitting unit, and a time factor adjustment unit;

[0096] The baseline calculation unit is used to calculate the baseline deviation of the baseline parameters and obtain the baseline deviation value; the baseline calculation unit is used to model and calculate the deviation of the baseline parameters. A baseline behavior model of the terminal under normal conditions is constructed based on historical operating data, and the long-term average and standard deviation of indicators such as process and file access behavior are extracted. The baseline deviation value is calculated using the following formula:

[0097]

[0098] Where Q represents the baseline deviation value, P1 represents the current value of the baseline parameter, P2 represents the historical average value of the baseline parameter, and P3 represents the historical standard deviation of the baseline parameter. This effectively quantifies whether terminal behavior deviates significantly from its normal pattern, providing an important indicator for subsequent risk assessment.

[0099] The threat matching unit is used to match the threat parameters with a preset threat intelligence database to obtain a threat matching value; the preset threat intelligence database contains more than 100,000 malicious features, such as ransomware file hashes and C2 server IPs; if any one of these is matched, it is considered a high-risk situation.

[0100] The resource detection unit is used to compare the resource parameters with preset resource utilization thresholds to obtain resource anomaly values; it is also used to analyze the usage of terminal resources, such as memory, CPU, disk I / O, and network bandwidth, to determine whether there have been unexpected sudden changes or overloads. The system compares the current resource usage value with the preset threshold to calculate resource anomaly values, which can be comprehensively evaluated based on multiple factors such as resource usage percentage, duration, and rate of change.

[0101] The risk fitting unit is used to fit the baseline deviation value, threat matching value, and resource anomaly value based on the risk fitting mechanism to obtain an initial risk value; the initial risk value is calculated using the following formula:

[0102] S = α1·Q + α2·D + α3·Z

[0103] Where S represents the initial risk value, α1 represents the baseline deviation value weight, Q represents the baseline deviation value, α2 represents the threat matching value weight, D represents the threat matching value, α3 represents the resource anomaly value weight, and Z represents the resource anomaly value. The three weight values ​​can be adjusted according to business type, endpoint attributes, or security policy requirements, supporting dynamic configuration and training optimization.

[0104] The time factor adjustment unit is used to adjust the initial risk value according to the time parameters to obtain a risk assessment result. The time factor adjustment unit further performs time-sensitivity correction on the initial risk value. Based on the collected time parameters, the time factor adjustment unit introduces a time weighting factor to adjust the initial risk value and generate the final risk assessment result. This time adjustment mechanism can effectively identify time-sensitive risk characteristics such as logins outside of working hours and short-term, high-frequency operations, improving the accuracy and interpretability of risk judgment.

[0105] In this embodiment, the time factor adjustment unit is used to adjust the initial risk value according to the time parameter to obtain a risk assessment result, including:

[0106] When the time parameter is within the working hours of a weekday, the initial risk value is multiplied by a first adjustment factor to obtain the risk assessment result; the first adjustment factor can be 1.5.

[0107] When the time parameter is outside of working hours, the initial risk value is multiplied by a second adjustment factor to obtain the risk assessment result. The second adjustment factor can be 0.8.

[0108] The policy generation module is used to generate firewall control policies based on the risk assessment results, including:

[0109] When the risk assessment result is greater than or equal to the preset first risk threshold, it is identified as a high-risk level. The firewall control policy includes: firewall rules that block the network connection of abnormal processes, and controlling the abnormal processes to migrate to an isolated sandbox environment for execution.

[0110] When the risk score is between the preset second risk threshold and the first risk threshold, it is identified as a medium risk level. The firewall control policy includes: a policy to restrict the execution permission of the process command, allowing only the execution of specific whitelisted instructions.

[0111] When the risk score is lower than the preset second risk threshold, it is identified as a low-risk level. The firewall control policy includes: allowing the current operation and recording relevant operation behavior information to the log.

[0112] Example: Scenario 1: Business scenario type is ransomware interception on enterprise office terminals. Specifically, an employee's computer at a financial company is infected with ransomware, which attempts to encrypt shared files by creating an unsigned child process.

[0113] The second acquisition module performs data acquisition, including: the terminal agent captures process A (legitimate office software Office.exe) calling execve() to create child process B (path / tmp / malware.exe, without digital signature), and detects file write operations (target path / shared / documents).

[0114] The risk assessment module performs the following risk assessments: Baseline deviation value: Process A historically creates an average of 1 child process per hour, and currently creates 5 within the last 10 minutes, deviation = (5-1×2) / 1 = 300% (score 85%); Threat matching value: The hash value of child process B matches the ransomware characteristics in the threat intelligence database (score 70%); Resource anomaly value: CPU utilization spikes to 95% due to virus encryption operations (score 60%); Time factor: The current time is 10:00 AM on a weekday (weight 1.5); Overall risk = (85%×0.6+70%×0.3+60%×0.1)×1.5 = 92 points (high risk).

[0115] The policy generator immediately issues the following rules: Block all network connections of child process B: iptables -AOUTPUT -ptcp --dport any port -m pid --pid 1234 -j DROP; Isolate process A to the sandbox (restrict file write permissions): chattr +i / shared / documents # Set file to read-only.

[0116] Results Verification: The virus was unable to transmit data over the network, file encryption was blocked, and the security team removed the virus and recovered the files after receiving the alert.

[0117] Scenario 2: Secure access to remote office terminals. Specifically, an engineer from a manufacturing company needs to temporarily open the SSH port to access the internal Git server via his home network.

[0118] The second acquisition module collects data, including: the terminal agent detects an SSH connection request (source IP: 192.168.1.100, not the company VPN network segment), target port 22, and the process is ssh-client (whitelisted application).

[0119] The risk assessment module performs the following risk assessments: Baseline deviation value: The engineer's historical SSH connection frequency is twice a week, and this is the third time (deviation = 0%, score 20%); Threat matching value: The source IP is not marked in the threat intelligence database (score 10%); Resource anomaly value: CPU / memory usage is normal (score 5%); Time factor: The current time is 14:00 on a weekday (weight 1.5); Overall risk = (20% × 0.6 + 10% × 0.3 + 5% × 0.1) × 1.5 = 22.5 points (medium risk).

[0120] The policy generator generates a timed rule: Open SSH port (22 / tcp) to the source IP.

[0121] 192.168.1.100, valid for 5 minutes: iptables -AINPUT -s 192.168.1.100 -p tcp --dport 22 -m time --timestart NOW --timestop NOW+5min -j ACCEPT; Restrict command execution permissions (only allow git-related commands): i.iptables -A INPUT -p tcp --dport 22 -m string --string"gitpull" --algo bm -j ACCEPT;

[0122] ii.iptables -AINPUT -p tcp --dport 22 -m string --string"scp" --algo bm -jACCEPT; iii.iptables -A INPUT -p tcp --dport 22 -j DROP # Deny other commands.

[0123] Results Verification: The engineer successfully connected to the Git server via SSH. After the connection timed out, the rules automatically expired and the port returned to a closed state.

[0124] Furthermore, in this embodiment, the system further includes: a strategy execution and feedback module and a strategy optimization and iteration module;

[0125] The policy execution and feedback module distributes the generated firewall control policies in real time through the firewall execution layer, such as the Linux iptables command, and records the policy content, execution time, and effects through the log service, such as "blocking port 22 of IP 192.168.1.100, successfully intercepting SSH connections, etc."

[0126] The strategy optimization and iteration module regularly analyzes interception logs, updates the threat intelligence database and behavioral baseline model, and improves the accuracy of subsequent risk assessments. Specifically, the baseline model can be optimized using machine learning algorithms to improve the baseline deviation calculation parameters.

[0127] This invention acquires environmental parameters such as terminal type, user behavior, and business processes through a first acquisition module. A scenario determination module then determines the current business scenario of the terminal, enabling dynamic adaptation of protection strategies and solving the problem that traditional firewalls' "one-size-fits-all" strategies cannot handle complex scenarios. A second acquisition module collects relevant risk assessment parameters based on the specific scenario. A risk assessment module evaluates the risk level and introduces dynamic weighting mechanisms such as time factors to improve the timeliness and accuracy of risk assessment. A policy generation module then generates corresponding firewall control policies based on the risk level. This invention boasts advantages such as strong dynamism, high accuracy, and adaptability to multiple scenarios. It effectively reduces false positive rates, improves terminal security response efficiency, reduces manual intervention, and enhances overall protection capabilities.

[0128] Example 2

[0129] A protection method based on the endpoint security protection system for generating firewall control policies as described above includes:

[0130] Collect information about the terminal's operating environment;

[0131] Based on the aforementioned operating environment information and a scenario matching mechanism, the current real-time business scenario of the terminal is determined.

[0132] Based on the real-time business scenario, collect the corresponding risk assessment parameters;

[0133] Based on the aforementioned risk assessment parameters and a risk fitting mechanism, the risk assessment results are obtained.

[0134] Based on the risk assessment results, a firewall control policy is generated.

[0135] It should be understood that the specific embodiments described above are merely illustrative or explanatory of the principles of the invention and do not constitute a limitation thereof. Therefore, any modifications, equivalent substitutions, improvements, etc., made without departing from the spirit and scope of the invention should be included within the protection scope of the invention. Furthermore, the appended claims are intended to cover all variations and modifications falling within the scope and boundaries of the appended claims, or equivalent forms of such scope and boundaries.

[0136] The present invention has been described above with reference to embodiments thereof. However, these embodiments are merely illustrative and not intended to limit the scope of the invention. The scope of the invention is defined by the appended claims and their equivalents. Various substitutions and modifications can be made by those skilled in the art without departing from the scope of the invention, and all such substitutions and modifications should fall within the scope of the invention.

[0137] Although embodiments of the present invention have been described in detail, it should be understood that various changes, substitutions, and modifications can be made to the embodiments of the present invention without departing from the spirit and scope of the invention.

[0138] Obviously, the above embodiments are merely illustrative examples for clear explanation and are not intended to limit the implementation. Those skilled in the art will recognize that other variations or modifications can be made based on the above description. It is neither necessary nor possible to exhaustively list all possible implementations here. However, obvious variations or modifications derived therefrom are still within the scope of protection of this invention.

Claims

1. An endpoint security protection system for generating firewall control policies, characterized in that, include: The system comprises a first data acquisition module, a scenario determination module, a second data acquisition module, a risk assessment module, and a strategy generation module. The first data acquisition module, the scenario determination module, the second data acquisition module, the risk assessment module, and the strategy generation module are connected in sequence; The first acquisition module is used to collect operating environment information; The scenario determination module is used to determine the real-time business scenario for generating firewall control policies based on the operating environment information and a scenario matching mechanism. The second acquisition module is used to acquire corresponding risk assessment parameters based on the real-time business scenario; The risk assessment module is used to generate risk assessment results based on the risk assessment parameters and a risk fitting mechanism. The policy generation module is used to generate firewall control policies based on the risk assessment results; The risk assessment parameters include baseline parameters, threat parameters, resource parameters, and time parameters. The risk assessment module includes a baseline calculation unit, a threat matching unit, a resource detection unit, a risk fitting unit, and a time factor adjustment unit; The baseline calculation unit is used to calculate the baseline deviation of the baseline parameters and obtain the baseline deviation value; The threat matching unit is used to match the threat parameters with a preset threat intelligence database to obtain a threat matching value; The resource detection unit is used to compare the resource parameters with a preset resource utilization threshold to obtain abnormal resource values; The risk fitting unit is used to fit the baseline deviation value, threat matching value and resource anomaly value based on the risk fitting mechanism to obtain an initial risk value. The time factor adjustment unit is used to adjust the initial risk value according to the time parameter to obtain the risk assessment result.

2. The endpoint security protection system for generating firewall control policies according to claim 1, characterized in that, include: The operating environment information includes terminal type information, terminal service process information, and terminal user behavior information; The first acquisition module includes a terminal type acquisition unit, a business process acquisition unit, and a user behavior acquisition unit; The terminal type acquisition unit is used to collect terminal type information, which includes hardware characteristics, network connection method and geographical location information. The business process acquisition unit is used to collect terminal business process information, which includes business system type, data processing flow, access resource type and sensitive data interaction behavior information. The user behavior collection unit is used to collect user behavior information of the terminal, including application usage records, operation time distribution, and interaction frequency.

3. The endpoint security protection system for generating firewall control policies according to claim 2, characterized in that, The scene determination module includes a scene feature parsing unit and a scene matching unit; The scene feature parsing unit is used to parse the operating environment information collected by the first acquisition module and extract features for scene determination. The scene matching unit is used to compare the features with a preset scene feature library based on the scene matching mechanism to determine the business scene in which the current terminal is located.

4. The endpoint security protection system for generating firewall control policies according to claim 1, characterized in that, The second data acquisition module includes a business analysis unit and an indicator acquisition unit; The business analysis unit is used to identify the security objectives corresponding to the real-time business scenario and determine the collected risk assessment parameters based on the security objectives. The indicator acquisition unit is used to collect data based on the risk assessment parameters.

5. The endpoint security protection system for generating firewall control policies according to claim 1, characterized in that, The baseline deviation value is calculated using the following formula: Where Q represents the baseline deviation value, P1 represents the current value of the baseline parameter, P2 represents the historical average value of the baseline parameter, and P3 represents the historical standard deviation of the baseline parameter.

6. The endpoint security protection system for generating firewall control policies according to claim 1, characterized in that, The initial risk value is calculated using the following formula: Where S represents the initial risk value, This indicates the weight of the baseline deviation value, where Q represents the baseline deviation value. This indicates the threat match value weight, where D represents the threat match value. Z represents the resource outlier weight, where Z represents the resource outlier.

7. The endpoint security protection system for generating firewall control policies according to claim 6, characterized in that, The time factor adjustment unit is used to adjust the initial risk value according to the time parameter to obtain a risk assessment result, including: When the time parameter is within the working hours of a weekday, the initial risk value is multiplied by a first adjustment coefficient to obtain the risk assessment result; When the time parameter is during non-working hours, the initial risk value is multiplied by a second adjustment coefficient to obtain the risk assessment result.

8. The endpoint security protection system for generating firewall control policies according to claim 1, characterized in that, The policy generation module is used to generate firewall control policies based on the risk assessment results, including: When the risk assessment result is greater than or equal to the preset first risk threshold, it is identified as a high-risk level. The firewall control policy includes: firewall rules that block the network connection of abnormal processes, and controlling the abnormal processes to migrate to an isolated sandbox environment for execution. When the risk score is between the preset second risk threshold and the first risk threshold, it is identified as a medium risk level. The firewall control policy includes: a policy to restrict the execution permission of process commands, allowing only the execution of specific whitelisted commands. When the risk score is lower than the preset second risk threshold, it is identified as a low-risk level. The firewall control policy includes: allowing the current operation and recording relevant operation behavior information to the log.

9. A protection method for an endpoint security protection system for generating firewall control policies according to any one of claims 1-8, characterized in that, include: Collect information about the terminal's operating environment; Based on the aforementioned operating environment information and a scenario matching mechanism, the current real-time business scenario of the terminal is determined. Based on the real-time business scenario, collect the corresponding risk assessment parameters; Based on the aforementioned risk assessment parameters and a risk fitting mechanism, the risk assessment results are obtained. Based on the risk assessment results, generate firewall control policies; The risk assessment parameters include baseline parameters, threat parameters, resource parameters, and time parameters. Calculate the baseline deviation of the baseline parameters and obtain the baseline deviation value; The threat parameters are matched with a preset threat intelligence database to obtain threat matching values; The resource parameters are compared with a preset resource utilization threshold to obtain abnormal resource values; The baseline deviation value, threat matching value, and resource anomaly value are fitted using a risk fitting mechanism to obtain an initial risk value. The initial risk value is adjusted based on the time parameter to obtain the risk assessment result.

Images