Firewall policy cleaning method, device and equipment based on industry specifications

Abstract

The invention relates to the technical field of information network security, in particular to a firewall policy cleaning method, device and equipment based on industry specifications, and the method comprises the steps: obtaining industry specification data of a target industry, historical network attack data of the target industry and a corresponding firewall policy; constructing a knowledge graph based on the historical network attack data, the industry specification data and the firewall policy, wherein nodes of the knowledge graph are entities in the historical network attack data, the firewall policy and the industry specification data; under the condition that the industry specification data in the industry specification database of the target industry is updated, determining a first firewall policy corresponding to the updated industry specification data based on the knowledge graph; and cleaning the first firewall policy by using the cleaning policy to obtain a second firewall policy adapted to the industry specification of the target industry.

Description

Technical Field

[0001] This invention relates to the field of information network security technology, specifically to a firewall policy cleaning method, apparatus, and device based on industry standards. Background Technology

[0002] With the rapid development of network technology, cybersecurity issues are becoming increasingly severe. As the first line of defense in a network security protection system, firewalls construct sets of access control rules (i.e., firewall policies) to strictly review and filter data flows entering and leaving the network to protect network security. However, in practical applications, firewall policy management faces numerous challenges. On the one hand, as network scale expands and business operations evolve, firewall policies become increasingly complex and redundant. A large number of invalid, expired, or conflicting policies not only consume significant computing and storage resources, leading to decreased firewall performance, but may also create security vulnerabilities and weaken the firewall's protective effectiveness. On the other hand, different industries have developed differentiated security specifications and compliance standards based on business characteristics and data sensitivity. Existing firewall policy management methods largely rely on manual configuration and experience-based judgment, making it difficult to accurately adapt to industry-specific specifications. This results in discrepancies between firewall policy settings and industry compliance requirements, failing to create targeted security barriers and hindering the protection of industry network security. In some scenarios, existing firewall policy cleaning and optimization tools mostly focus on basic levels such as rule redundancy checks, lacking deep integration mechanisms with industry standards. This makes it difficult to ensure that optimized firewall policies comply with specific industry security standards. Furthermore, their automation level is low, relying heavily on manual intervention for rule review and verification, resulting in low processing efficiency and the potential for introducing new risks due to human error. Therefore, existing firewall policy cleaning methods are significantly insufficient in both depth and breadth, lacking accuracy and timeliness, and are unable to effectively guarantee industry network security. Summary of the Invention

[0003] To address the technical problem of weak boundary protection capabilities in power information networks and the resulting defense failures due to firewall policy redundancy and conflicts, this invention aims to provide a firewall policy cleansing method, apparatus, and device based on industry standards. The specific technical solution adopted is as follows: In a first aspect, embodiments of the present invention disclose a firewall policy cleansing method based on industry standards, comprising: acquiring industry standard data of a target industry, historical network attack data of the target industry, and corresponding firewall policies; constructing a knowledge graph based on the historical network attack data, industry standard data, and firewall policies, wherein the nodes of the knowledge graph are entities in the historical network attack data, firewall policies, and industry standard data; when the industry standard data in the industry standard database of the target industry is updated, determining a first firewall policy corresponding to the updated industry standard data based on the knowledge graph; and cleaning the first firewall policy using a cleansing strategy to obtain a second firewall policy adapted to the industry standards of the target industry.

[0004] Secondly, embodiments of the present invention disclose a firewall policy cleaning device based on industry standards, comprising: an acquisition module for acquiring industry standard data of a target industry, historical network attack data of the target industry, and corresponding firewall policies; a construction module for constructing a knowledge graph based on the historical network attack data, industry standard data, and firewall policies, wherein the nodes of the knowledge graph are entities in the historical network attack data, firewall policies, and industry standard data; a determination module for determining a first firewall policy corresponding to the updated industry standard data based on the knowledge graph when the industry standard data in the industry standard database of the target industry is updated; and a cleaning module for cleaning the first firewall policy using a cleaning strategy to obtain a second firewall policy adapted to the industry standards of the target industry.

[0005] Thirdly, embodiments of the present invention disclose an electronic device, including: a processor and a memory; wherein the memory is used to store a computer program that can run on the processor; the processor is used to execute the program stored in the memory to implement the steps of the firewall policy cleaning method based on industry standards mentioned in the first aspect.

[0006] The technical solution disclosed in this invention uses a knowledge graph to associate historical network attack data, existing firewall policies, and industry standard data. When industry standards are updated, firewall policies can automatically adjust according to the updated standards, quickly locating the corresponding first firewall policy. A second firewall policy is then obtained through a cleaning process, ensuring the new policy closely aligns with the updated industry standard requirements. This reduces discrepancies between firewall policies and industry standards, improving the accuracy and timeliness of matching and avoiding security vulnerabilities or compliance risks due to inappropriate adaptation. Furthermore, the knowledge graph provides a clear framework for the association of various data types, allowing for a direct understanding of the relationships between industry standards, network attack data, and firewall policies. When industry standards are updated, there is no need to develop new firewall policies from scratch; instead, existing related firewall policies are quickly identified and optimized, significantly shortening the adjustment cycle and improving the timeliness of firewall policy application. Simultaneously, the cleaned second firewall policy is more targeted, focusing on new industry standards and enhancing the effectiveness of network security protection. Attached Figure Description

[0007] Figure 1 This is a flowchart illustrating a firewall policy cleaning method based on industry standards, provided as an embodiment of the present invention.

[0008] Figure 2 This is a schematic diagram of a firewall policy cleaning device based on industry standards, provided as an embodiment of the present invention.

[0009] Figure 3 This is a schematic diagram of the structure of an electronic device provided in an embodiment of the present invention. Detailed Implementation

[0010] To further illustrate the technical means and effects adopted by the present invention to achieve its intended purpose, the following, in conjunction with the accompanying drawings and preferred embodiments, details the specific implementation, structure, features, and effects of a firewall policy cleaning method, apparatus, and device based on industry standards proposed by the present invention. In the following description, different "one embodiment" or "another embodiment" do not necessarily refer to the same embodiment. Furthermore, specific features, structures, or characteristics in one or more embodiments can be combined in any suitable form.

[0011] Unless otherwise defined, all technical and scientific terms used herein have the same meaning as commonly understood by one of ordinary skill in the art to which this invention pertains. The specific solution of a firewall policy cleaning method, apparatus, and device based on industry standards provided by this invention is described below in conjunction with the accompanying drawings.

[0012] like Figure 1 As shown, Figure 1 A flowchart illustrating a firewall policy cleaning method based on industry standards, provided by an embodiment of the present invention, includes the following steps: Step S101: Obtain industry standard data, historical network attack data, and corresponding firewall policies for the target industry.

[0013] Specifically, this embodiment of the invention collects security specification data from various industries through authoritative organizations, standard documents, and policy and regulatory channels. This security specification data includes, but is not limited to, industry-specific security specification data and standard text materials. Historical network attack data includes, but is not limited to, the time, location, type, and methods of attacks. The corresponding firewall policy refers to the firewall policy adopted when a network attack occurs. This firewall policy includes, but is not limited to, access control rules, protocol and service filtering rules, port management rules, log and auditing rules, security protection rules, and policy priority rules.

[0014] Step S102: Construct a knowledge graph based on historical network attack data, industry standard data, and firewall policies. The nodes of the knowledge graph are entities from the historical network attack data, firewall policies, and industry standard data.

[0015] Specifically, before constructing the knowledge graph, this embodiment of the invention first preprocesses historical network attack data, industry standard data, and firewall policies to remove noise and invalid information. Specifically, text cleaning tools from natural language processing can be used to clean the historical network attack data, industry standard data, and firewall policies.

[0016] Furthermore, after text cleaning of historical network attack data, industry standard data, and firewall policies, the data is classified according to the importance of sensitive words in accordance with national or industry standards. When constructing the knowledge graph, sensitive words with higher importance can be prioritized for knowledge graph construction.

[0017] Furthermore, as an optional embodiment of the present invention, constructing a knowledge graph based on historical network attack data, industry standard data, and firewall policies includes: extracting attack entities from historical network attack data, extracting policy entities from firewall policies, and extracting industry standard entities from industry standard data using a named entity recognition algorithm. Attack entities include attack type, attack method, attack source, attack target, and attack impact; policy entities include policy identifier, controlled object, action type, and effective time; and industry standard entities include standard clauses, compliance indicators, and responsible parties. A compliance mapping relationship is established between attack entities, policy entities, and industry standard entities. A knowledge graph is constructed using attack entities, policy entities, and industry standard entities as nodes and compliance mapping relationships as edges.

[0018] Specifically, this invention employs a named entity recognition algorithm to extract various entities from preprocessed historical network attack data, firewall policies, and industry standard data. These entities are then used as nodes in a knowledge graph, and the relationships between these nodes are clearly defined to construct the knowledge graph. The attack types within the attack entities include, but are not limited to, SQL injection, DDoS attacks, Trojan horse implantation, and port scanning. Attack methods include, but are not limited to, the vulnerability number exploited (e.g., CVE-2023-XXXX), the tool used, or the name of the malicious program. Attack sources include, but are not limited to, the source Internet Protocol (IP) address from which the attack originates. Attack targets include, but are not limited to, the target IP address or domain name, the specific timestamp of the attack, and the duration of the attack. Attack impacts include, but are not limited to, attack traffic characteristics (e.g., packet size, transmission frequency, protocol type), data leakage, system downtime, and the scope of business interruption. The policy identifiers in the policy entity include, but are not limited to, the identifiers of various rules; the controlled objects include, but are not limited to, the subjects (user identifier (ID), device number, network and object (server name, application system identifier, resource path), access direction (inbound, outbound), etc.) in access control rules; the action types include, but are not limited to, the protocol type and service port number in protocol and service filtering rules; the open port list, closed port list, and restricted usage conditions in port management rules; the log recording fields, storage location, and audit responsibility in log and audit rules; the intrusion detection signature database version and DDoS protection threshold in security protection rules; and the priority value and conflict handling identifier in policy priority rules. The effective time refers to the time when the firewall policy begins to be applied.

[0019] Furthermore, after identifying each entity as a node in the knowledge graph, a compliance mapping relationship is constructed between these nodes, indicating the associations between them. Specifically, attack types in historical network attack data are correlated with security protection rules in firewall policies; for example, a certain type of DDoS attack corresponds to a specific DDoS protection threshold and detection rule. The vulnerability numbers exploited by network attacks are associated with vulnerability remediation clauses required in industry standard data, indicating that the vulnerability needs to be patched promptly according to industry standards. Protection requirements in industry standard data are directly correlated with specific rules in firewall policies; for example, the clause "data transmission must be encrypted" in industry standards corresponds to the mandatory use of Hypertext Transfer Protocol Secure (HTTPS) in the protocol filtering rules of firewall policies. Compliance detection indicators in industry standards are correlated with log auditing rules in firewall policies; for example, the indicator "logs retained for 6 months" corresponds to log storage duration rules. Internal nodes within firewall policies are also correlated: subjects and objects in access control rules are correlated by access direction; protocol and service filtering rules and port management rules are correlated by port numbers; and policy priority rules are correlated with all policy nodes, clarifying the order of rule execution. Furthermore, the target IP addresses of historical attacks may be associated with objects of access control rules in firewall policies, and the attack time may have a time-series correlation with the policy update time, which can be used to analyze the impact of firewall policy updates on attack defense effectiveness. Through these compliance mapping relationships, the knowledge graph can clearly present the logical chains between the three types of data, providing data support for subsequent firewall policy updates and optimizations. It is worth noting that, depending on the actual application scenario, the compliance mapping relationships between attack entities, policy entities, and industry standard entities can also be other cases, which are not limited in this embodiment of the invention.

[0020] Step S103: If the industry standard data in the industry standard database of the target industry is updated, determine the first firewall policy corresponding to the updated industry standard data based on the knowledge graph.

[0021] Specifically, in this embodiment of the invention, after the knowledge graph is constructed, the change log of the industry standard database is monitored. When the industry standard database adds or modifies standard clauses, the added or modified standard clauses are mapped to the knowledge graph, thereby finding the first firewall policy corresponding to the updated industry standard data.

[0022] Furthermore, as an optional embodiment of the present invention, determining the first firewall strategy corresponding to the updated industry standard data based on the knowledge graph includes: converting the updated industry standard data into semantic vectors and mapping them to entity nodes in the knowledge graph; determining the association between the semantic vectors of the industry standard data and the firewall strategies in the knowledge graph using a graph traversal algorithm; converting the industry standard data into semantic vectors based on the TransE graph embedding algorithm, and mapping the firewall strategies associated with the semantic vectors in the knowledge graph to the same low-dimensional space; calculating the cosine similarity between the semantic vectors and the firewall strategies associated with them in the knowledge graph; and selecting firewall strategies with a cosine similarity not less than a predetermined threshold as the first firewall strategy.

[0023] Specifically, in this embodiment of the invention, when converting updated industry standard data into semantic vectors, the industry standard data must first be segmented, entity identified, and feature extracted to transform key clauses in the industry standard data into high-dimensional semantic vectors. Subsequently, these semantic vectors are mapped to entity nodes in a knowledge graph. By matching vector features with entity node attributes (such as "protection requirement clauses" and "compliance detection indicators" in industry standard nodes), the set of entity nodes related to the semantic vectors of the updated industry standard data is found. After completing the mapping of semantic vectors to entity nodes, a graph traversal algorithm (such as depth-first search or breadth-first search) is used to traverse the knowledge graph. Starting from the mapped entity nodes, paths are explored along established relationships (such as direct association between industry standard clauses and firewall policies, and indirect association between standard requirements and historical attack protection policies), tracking all firewall policy nodes related to the semantic vectors of the updated industry standard data. For example, when the updated industry standard data involves "improving DDoS attack protection levels," the graph traversal algorithm starts from the "DDoS protection requirements" entity node and finds all firewall policy nodes related to DDoS protection in the knowledge graph through the "corresponding protection rules" relationship, initially screening out the potential policy range. Then, using the TransE graph embedding algorithm, the semantic vector of the updated industry standard data and the associated firewall policy nodes in the knowledge graph are simultaneously mapped to the same low-dimensional vector space. The TransE algorithm models the vector representation of entity nodes and relationships, and the vector relationships hold in the low-dimensional space, effectively preserving the original semantic associations and structural information in the knowledge graph. In the low-dimensional space, the positional distribution of the semantic vector of the updated industry standard data and the related firewall policy vectors reflects their semantic closeness; the more semantically related the vectors are, the closer they are in space. Finally, in the low-dimensional vector space, the cosine similarity between the semantic vector of the updated industry standard data and each associated firewall policy vector is calculated. Cosine similarity measures the degree of similarity between two vectors by the cosine of the angle between them. The closer the value is to 1, the stronger the semantic relationship between the two. For example, if the cosine similarity between the semantic vector of updated industry standard data and the vector of a firewall policy is 0.85, it means that the firewall policy is consistent with the updated industry standard data in terms of protection objectives and constraints. Subsequently, a predetermined threshold (such as 0.7) is set, and firewall policies with a cosine similarity of not less than this threshold are selected as the first firewall policy.

[0024] Furthermore, when the cosine similarity is less than a predetermined threshold, it is determined that there is a semantic deviation between the firewall policy and industry standard data. In this case, a targeted policy optimization and supplementation process needs to be initiated. Specifically, firstly, by combining the differences in vector features between the protection policy and industry standards in the knowledge graph, the specific dimensions of the deviation are clarified. For example, if the industry standard requires "multi-factor authentication verification for all external access," while a firewall policy only includes single-factor password verification, and the vector similarity is lower than the threshold, then the deviation mainly lies in the compliance of the identity authentication mechanism. By analyzing the deviation dimensions, the direction of protection that needs to be supplemented is determined. Then, the interface connection with the external threat intelligence platform is initiated to synchronize the latest threat data in real time. The information obtained includes, but is not limited to: a list of recently active attack source IP addresses (such as ransomware attack sources that have been verified multiple times), domain names and Uniform Resource Locators (URLs) marked as malicious (such as phishing website domains, malware distribution domains), newly added attack tool signatures (such as the behavioral characteristics of new Trojans), and the latest evolution trends of mainstream attack types (such as changes in the mixed traffic characteristics of DDoS attacks), etc. This real-time threat intelligence can compensate for the lack of timeliness in historical data in knowledge graphs, providing examples for optimizing protection strategies. Further, the acquired real-time attack source IPs, malicious domains, and other information are compared item by item with the blacklists and whitelists in the firewall policy. For attack source IPs appearing in the threat intelligence, if they are not included in the firewall blacklist, they are immediately added to the blacklist rules to block their access to the target network; for IPs already in the blacklist, their blocking priority is adjusted based on the attack frequency and severity information from the threat intelligence, implementing stricter full-port blocking policies for high-frequency, high-risk IPs. Simultaneously, the whitelist is checked for any suspicious IPs or domains mistakenly included, and potential risks are identified by comparing them with the threat intelligence to ensure the security of the whitelist. Finally, based on the characteristic information of common attack types in the threat intelligence, the attack signature database of the firewall policy is updated. For example, detection rules in the signature database are supplemented for newly added SQL injection variant attack characteristics in the threat intelligence; and the traffic anomaly detection thresholds in the signature database are optimized based on the traffic characteristics of new DDoS attacks. Subsequently, the filtering rules in the firewall policy (such as protocol filtering rules and intrusion detection rules) are fully matched with the updated signature database to identify any missing attack signature protection items in the filtering rules. For example, if the signature database adds "AI-based malicious email attachment detection features," but the firewall's current filtering rules do not include this detection logic, then the corresponding email attachment filtering rules need to be added to the policy to achieve accurate interception of new attack types.In this way, when there are semantic discrepancies between firewall policies and industry standard data, the real-time input of external threat intelligence can be used to quickly fill firewall policy vulnerabilities, enabling firewall policies to meet industry standard requirements while also having the ability to resist the latest network attacks, thereby improving the reliability and security of network protection.

[0025] Step S104: The first firewall policy is cleaned using a cleaning strategy to obtain a second firewall policy that adapts to the industry standards of the target industry.

[0026] Specifically, the aforementioned first firewall policy may contain invalid, conflicting, redundant, non-compliant with industry standards, or insufficient attack protection elements. This invention can automate the process by writing scripts to clean firewall policies according to preset cleaning strategies. For example, using Python in conjunction with the firewall device's Application Programming Interface (API), scripts can be written to traverse firewall policies and automatically process them according to rules such as "deleting policies that have not been used for a long time" and "merging duplicate policies." Scripts can also be used to periodically check and optimize firewall policies, improving the efficiency of firewall policy cleaning.

[0027] Furthermore, as an optional embodiment of the present invention, cleaning the first firewall policy using a cleaning strategy to obtain a second firewall policy adapted to the industry standards of the target industry includes at least one of the following: identifying invalid firewall policies from the first firewall policy and deleting the invalid firewall policies based on the cleaning strategy; identifying conflicting policies from the first firewall policy and determining which firewall policies to retain or modify based on preset conflict resolution rules in the cleaning strategy; identifying redundant policies from the first firewall policy, retaining representative policies from the redundant policies based on the cleaning strategy, and deleting other redundant policies; identifying non-compliant policies from the first firewall policy and adjusting the non-compliant policies based on the industry standard requirements in the cleaning strategy; and identifying weak policies with insufficient attack protection from the first firewall policy and optimizing the weak policies in a virtual network environment based on reinforcement learning algorithms in the cleaning strategy.

[0028] Specifically, when identifying invalid firewall policies from the first firewall policy, it is necessary to consider the current network architecture of the target industry, changes in business needs, and historical protection effectiveness data. Invalid policies typically include: access control rules targeting offline servers or obsolete business systems, which lose their protective significance due to the non-existence of the target object; redundant filtering rules that have not been triggered for a long time and have no actual protection scenarios, such as filtering rules targeting outdated protocols (e.g., SSLv3), which are no longer applicable in the current network environment; and policies that have become invalid due to changes in network parameters such as IP addresses and ports, for example, old IP addresses that were allowed in the original policy have been reclaimed, and the relevant rules can no longer control valid targets. Based on the cleaning strategy, an automated scanning tool is used to traverse the first firewall policy, mark the above invalid policies, and then delete them in batches, reducing policy redundancy and improving the operating efficiency of the firewall. Furthermore, embodiments of the present invention can also use traffic analysis tools to collect network traffic data and analyze the matching between traffic and firewall policies. Through analysis, it can be found which firewall policies have not actually played a role in controlling traffic, i.e., "silent policies," and these are marked as needing cleaning. For example, some firewall policies may allow specific source addresses to access specific services, but traffic analysis over a period of time reveals that no corresponding traffic is passing through, indicating that the firewall policy may be ineffective. Furthermore, traffic characteristics can also identify areas where firewall policies are configured improperly, such as overly lenient access policies for certain high-risk services, allowing for targeted optimization of the firewall policy.

[0029] Furthermore, conflicting policies are identified from the first firewall policy, primarily focusing on logical inconsistencies or execution order conflicts between policies. For example, one policy may allow a specific IP address to access a target server through port 80, while another policy may prohibit that IP address from accessing port 80 of the same server, creating a direct logical conflict. Another example is when two policies target the same protection scenario but have inconsistent priority settings, leading to a higher-priority policy being unexpectedly overridden by a lower-priority policy. Based on the preset conflict resolution rules in the cleaning policy, conflicting policies are first categorized and classified. For conflicting policies involving core business protection, key protection rules are retained according to the "business continuity priority" principle, while secondary rules are modified to eliminate conflicts. For conflicting policies related to non-core business, the "least privilege principle" and the "optimal protection effect principle" are followed. By comparing historical attack protection data and compliance requirements, policies with greater protection value are retained, or conflicting clauses are merged and modified to ensure policy logic consistency. In addition, this embodiment of the invention also develops standardized firewall policy templates containing policy configurations that conform to best practices and security specifications. The first firewall policy is compared with the template, and firewall policies that do not meet the template requirements are corrected and cleaned. For example, the template specifies access policy rules between different business areas. If the primary firewall policy does not conform to it, it will be adjusted according to the template to ensure the consistency and security of the firewall policy.

[0030] Furthermore, identifying redundant policies from the primary firewall strategy requires recognizing policy sets with overlapping functions and protection scopes. Redundant policies are common when policies are not promptly cleaned up after multiple iterations. For example, multiple protection rules may be set for the same attack type (such as SQL injection), with consistent core logic and only minor differences in parameters; or multiple policies may target the same IP segment or port for access control, with highly overlapping protection objectives and restrictions. Based on the cleaning strategy, core protection elements (such as protection objectives, attack types, and control methods) are extracted from redundant policies using policy feature comparison algorithms. Representative policies with the broadest coverage and best protection effect are then selected. For example, among multiple SQL injection protection rules, the rule that covers the latest attack characteristics and has the lowest false positive rate is retained, while other redundant policies with overlapping functions are deleted. This simplifies the policy structure without weakening the protection effect.

[0031] Furthermore, identifying non-compliant policies from the primary firewall policy requires verification against the latest industry standards. Non-compliant policies may manifest as: failure to meet mandatory protection clauses in industry standards; or policy parameters not meeting security standards. Based on the industry standard requirements in the cleanup strategy, targeted adjustments are made to the non-compliant policies, and corresponding policy clauses are added for missing protection functions.

[0032] Furthermore, weak policies with insufficient attack protection are identified from the first firewall strategy, primarily based on historical network attack data and threat intelligence. These policies typically perform poorly against new or complex attack scenarios. For example, protection strategies against new variants of DDoS attacks may lack detection rules for the latest attack traffic characteristics, resulting in unreasonable protection thresholds and difficulty in effectively blocking attacks. Similarly, access control strategies against privilege abuse may lack fine-grained permission verification, posing a risk of unauthorized access. Based on reinforcement learning algorithms in the cleaning strategy, these weak policies are imported into a virtual network environment that simulates the target industry's real network architecture, business traffic, and various attack scenarios. The reinforcement learning algorithm continuously interacts with the virtual environment to generate policy optimization solutions, such as adjusting the traffic detection thresholds and filtering rules of the DDoS protection strategy, adding multi-dimensional permission verification logic to the access control strategy, and verifying the optimization effect through multiple attack and defense drills. Finally, a strengthened protection strategy is output and integrated into the second firewall strategy. Thus, through the above multi-dimensional cleaning and optimization, the second firewall strategy achieves a lightweight firewall strategy system, logical consistency, compliance, and upgraded protection capabilities, enabling it to more accurately adapt to the industry standards and network security protection needs of the target industry. Optionally, as an optional embodiment of the present invention, after cleaning the first firewall policy using a cleaning strategy to obtain a second firewall policy adapted to the industry standards of the target industry, the method further includes: simulating real network topology and business traffic based on virtual network environment construction technology to build a virtual network environment; applying the second firewall policy to the virtual firewall device in the virtual network environment to simulate normal business traffic and attack scenarios to verify the effectiveness of the second firewall policy. The attack scenarios include DDoS attacks, SQL injection attacks, and phishing attacks.

[0033] Specifically, this embodiment of the invention uses virtualization technology VMware or KVM to build a virtual network environment similar to the actual network topology and business traffic. A second firewall policy is applied to the virtual firewall device to simulate normal business traffic and attack scenarios, including DDoS attacks, SQL injection attacks, and phishing attacks. More specifically, when simulating real network topology and business traffic based on virtual network environment construction technology, it is necessary to proceed from three aspects: network architecture, device configuration, and traffic simulation. In terms of network topology construction, referring to the real network architecture of the target industry, a hierarchical topology including core switches, access switches, virtual servers (World Wide Web (Web) servers, database servers, application servers), virtual firewall devices, and terminal devices is constructed using virtualization technology (such as VMware, KVM). Regarding device configuration, the virtual servers are deployed with operating systems (such as Windows Server, Linux), application software (such as Apache, MySQL), and business services (such as online transaction systems, user authentication systems) consistent with the real environment, and the same port opening policies and service operating parameters are configured. Simultaneously, basic configurations are performed on the virtual firewall device, including interface IP addresses, subnet masks, and default route settings, to ensure it establishes a complete communication link with other devices in the virtual network topology. Business traffic simulation is achieved using traffic generation tools (such as Tcpreplay and Iperf) to generate normal traffic models based on the business characteristics of the target industry. For example, it simulates HTTP / HTTPS request traffic from users browsing web pages, POST request traffic from order submissions, and database interaction traffic from product queries, setting parameters such as peak traffic periods, packet size distribution, and request frequency.

[0034] Furthermore, applying the second firewall policy to the virtual firewall device requires first using a policy import tool to batch load the cleaned policy rules (including access control lists, filtering rules, protection thresholds, etc.) into the virtual firewall, and then performing a policy compatibility check. This involves simulating normal business traffic in the virtual network environment and continuously monitoring the virtual firewall's policy execution. Traffic analysis tools (such as Wireshark and Snort) are used to capture data packets passing through the firewall to verify whether the policy allows legitimate traffic to pass normally: for example, whether normal access requests from office terminals to the business server are allowed, and whether user transaction data via HTTPS can be successfully transmitted to the database server. Simultaneously, metrics such as the throughput, latency, and packet loss rate of normal traffic are statistically analyzed. If the deviation of these metrics from the standard of normal business operation in a real environment is within a preset range (e.g., latency deviation less than 5ms), it indicates that the policy is effective in ensuring business continuity. DDoS attack simulation tools (such as LOIC and Hping3) are used to launch SYN Flood and UDP Flood attacks in the virtual network, with the attack traffic directed to the virtual web server. Monitor whether the virtual firewall can accurately identify attack traffic (e.g., through traffic threshold detection, abnormal packet feature matching) and trigger protection mechanisms (e.g., traffic scrubbing, source IP blocking) based on the DDoS protection rules in the secondary firewall policy. Verification metrics include attack traffic interception rate (target should reach 99% or higher), whether the CPU utilization and memory usage of the attacked server have returned to normal ranges, and whether normal business traffic has not been affected by attack interception operations. Use SQL injection testing tools (e.g., SQLMap) to launch injection attacks on the virtual web server's form submission interface and URL parameters, simulating the attacker's input of malicious SQL statements (e.g., "OR 1=1--"). Check whether the virtual firewall can intercept requests containing malicious injection code based on the SQL injection feature detection rules in the policy and record attack logs. Verification focuses on the success rate of attack request interception, whether there are any missed detections, and whether normal SQL query requests are not falsely identified and blocked. Simulate phishing email sending (sending emails containing malicious links or attachments via email server simulation tools) and phishing website access (building phishing pages impersonating official websites in a virtual DMZ zone to lure virtual terminals to access them). Verify the effectiveness of malicious domain blocking rules and URL filtering rules in the second firewall policy: whether the malicious link domains in the phishing emails are identified and blocked by the firewall, and whether HTTP requests from terminal devices to phishing websites are blocked. Simultaneously, check whether the firewall can record information such as the source IP, attack time, and attack method of the phishing attack, providing a basis for subsequent policy optimization.Thus, through multiple rounds of simulation verification of normal business traffic and attack scenarios, the interception efficiency, false positive rate, and impact on business of the firewall policy are comprehensively analyzed. If all indicators meet the preset effectiveness standards, the second firewall policy is confirmed to have reliable protection capabilities. If any indicators fail to meet the standards, feedback needs to be sent to the policy optimization stage to make secondary adjustments to the second firewall policy until it passes the verification.

[0035] Furthermore, as an optional embodiment of the present invention, after cleaning the first firewall policy using a cleaning strategy to obtain a second firewall policy adapted to the industry standards of the target industry, the method further includes: applying the second firewall policy to the actual firewall devices in a portion of the network area, monitoring network traffic and security events in the portion of the network area; and triggering an automatic rollback mechanism to restore the firewall policy of the actual firewall device to its previous state if the second firewall policy has a significant negative impact or insufficient protection.

[0036] Specifically, after the virtual test is passed, a phased deployment approach will be adopted. The second firewall policy will first be applied in selected network areas, and after a period of observation, it will be fully rolled out. At the same time, a real-time monitoring system will be established to monitor network traffic and security events in selected network areas. If it is found that the second firewall policy has a negative impact on business or is insufficient in protection, an automatic rollback mechanism will be immediately triggered to restore the firewall policy of the actual firewall device to its previous state.

[0037] The technical solution disclosed in this invention uses a knowledge graph to associate historical network attack data, existing firewall policies, and industry standard data. When industry standards are updated, the corresponding first firewall policy can be quickly located. A second firewall policy is then obtained through a cleaning strategy, ensuring that the new policy closely aligns with the updated industry standard requirements. This reduces discrepancies between firewall policies and industry standards, improving the accuracy and timeliness of matching firewall policies with industry standards and avoiding security vulnerabilities or compliance risks caused by inappropriate adaptation. Furthermore, the construction of the knowledge graph provides a clear framework for the association of various types of data, allowing for an intuitive understanding of the relationship between industry standards, network attack data, and firewall policies. When industry standards are updated, it is not necessary to develop new firewall policies from scratch; instead, existing related firewall policies can be quickly identified and optimized, significantly shortening the firewall policy adjustment cycle and improving the timeliness of firewall policy application. Simultaneously, the cleaned second firewall policy is more targeted, focusing on new industry standards and enhancing the effectiveness of network security protection.

[0038] Based on the same inventive concept, embodiments of the present invention also provide a firewall policy scrubbing device based on industry standards, such as... Figure 2 As shown, Figure 2 This is a schematic diagram of a firewall policy cleaning device based on industry standards provided in an embodiment of the present invention. The firewall policy cleaning device based on industry standards includes: an acquisition module 201, used to acquire industry standard data of the target industry, historical network attack data of the target industry, and corresponding firewall policies; a construction module 202, used to construct a knowledge graph based on the historical network attack data, industry standard data, and firewall policies, wherein the nodes of the knowledge graph are entities in the historical network attack data, firewall policies, and industry standard data; a determination module 203, used to determine a first firewall policy corresponding to the updated industry standard data based on the knowledge graph when the industry standard data in the industry standard database of the target industry is updated; and a cleaning module 204, used to clean the first firewall policy using a cleaning strategy to obtain a second firewall policy adapted to the industry standards of the target industry.

[0039] It should be noted that the firewall policy cleaning device based on industry standards provided in this embodiment of the invention and the firewall policy cleaning method based on industry standards in the above embodiments are based on the same application concept. The same or similar aspects of the specific implementation of the two embodiments can be referred to each other and have the same or similar beneficial effects. The repeated parts will not be described again.

[0040] Corresponding to the method provided in the above embodiments, and based on the same technical concept, this embodiment of the invention also provides an electronic device for executing the above-described firewall policy cleaning method based on industry standards. Figure 3 This is a schematic diagram of the structure of an electronic device provided in an embodiment of the present invention, such as... Figure 3 As shown. Electronic devices can vary considerably due to differences in configuration or performance, and may include one or more processors 301 and memories 302. The memory 302 stores computer programs that can run on the processor 301, and the processor 301 executes the programs stored in the memory 302 to achieve the above. Figure 1 The various steps in the method embodiment are described. The memory 302 can be temporary or persistent storage. The application stored in the memory 302 may include one or more modules (not shown), each module may include a series of computer-executable instructions for the electronic device.

[0041] Furthermore, the processor 301 may be configured to communicate with the memory 302 and execute a series of computer-executable instructions stored in the memory 302 on the electronic device. The electronic device may also include one or more power supplies 303, one or more wired or wireless network interfaces 304, one or more input / output interfaces 305, and one or more keyboards 306.

[0042] Specifically, in this embodiment, the electronic device includes a processor, a communication interface, a memory, and a communication bus; wherein, the processor, the communication interface, and the memory communicate with each other via the bus; the memory is used to store computer programs; and the processor is used to execute the programs stored in the memory to achieve the above. Figure 1 The various steps in the method embodiments are the same as those in the above method embodiments, and have the same beneficial effects. To avoid repetition, the embodiments of the present invention will not be described again here.

[0043] Furthermore, based on the same inventive concept, embodiments of the present invention provide a computer storage medium on which a computer program is stored. When the computer program is executed by a processor, it implements the steps of the firewall policy cleaning method based on industry standards mentioned in the above method implementation.

[0044] It should be noted that the order of the above embodiments of the present invention is merely for descriptive purposes and does not represent the superiority or inferiority of the embodiments. The processes depicted in the accompanying drawings do not necessarily require a specific or sequential order to achieve the desired result. In some embodiments, multitasking and parallel processing are also possible or may be advantageous.

[0045] The various embodiments in this specification are described in a progressive manner. The same or similar parts between the various embodiments can be referred to each other. Each embodiment focuses on describing the differences from other embodiments.

Claims

1. A firewall policy scrubbing method based on industry standards, characterized in that, The firewall policy scrubbing method based on industry standards includes: Acquire industry standard data for the target industry, historical network attack data for the target industry, and corresponding firewall policies; A knowledge graph is constructed based on the historical network attack data, the industry standard data, and the firewall policy. The nodes of the knowledge graph are entities in the historical network attack data, the firewall policy, and the industry standard data. When the industry standard data in the industry standard database of the target industry is updated, a first firewall policy corresponding to the updated industry standard data is determined based on the knowledge graph. The first firewall policy is cleaned using a cleaning strategy to obtain a second firewall policy that is adapted to the industry standards of the target industry.

2. The firewall policy scrubbing method based on industry standards according to claim 1, characterized in that, The construction of the knowledge graph based on the historical network attack data, the industry standard data, and the firewall policies includes: The attack entities are extracted from the historical network attack data, the policy entities are extracted from the firewall policy, and the industry standard entities are extracted from the industry standard data using the named entity recognition algorithm. The attack entities include attack type, attack method, attack source, attack target, and attack impact. The policy entities include policy identifier, control object, action type, and effective time. The industry standard entities include standard clauses, compliance indicators, and responsible entities. Establish a compliance mapping relationship between the attack entity, the policy entity, and the industry standard entity; The knowledge graph is established using the attack entity, the policy entity, and the industry standard entity as nodes, and the compliance mapping relationship as edges.

3. The firewall policy scrubbing method based on industry standards according to claim 1, characterized in that, The first firewall policy, which determines the corresponding updated industry standard data based on the knowledge graph, includes: The updated industry standard data is converted into semantic vectors and mapped to entity nodes in the knowledge graph. The association between the semantic vectors of the industry standard data and firewall policies in the knowledge graph is determined by a graph traversal algorithm. The industry standard data is converted into semantic vectors based on the TransE graph embedding algorithm, and the firewall policies associated with the semantic vectors in the knowledge graph are mapped to the same low-dimensional space. Calculate the cosine similarity between the semantic vector and the firewall policies associated with the knowledge graph; The firewall policy with a cosine similarity of not less than a predetermined threshold is selected as the first firewall policy.

4. The firewall policy scrubbing method based on industry standards according to claim 1, characterized in that, The step of using a cleaning strategy to clean the first firewall policy to obtain a second firewall policy adapted to the industry standards of the target industry includes at least one of the following: Identify invalid firewall policies from the first firewall policy and delete them based on the cleaning policy; Determine the conflict policy from the first firewall policy, and determine the firewall policy to retain or modify based on the preset conflict resolution rules in the cleaning policy; Redundant policies are determined from the first firewall policy, and representative policies from the redundant policies are retained based on the cleaning policy, while other redundant policies are deleted. Identify non-compliant policies from the first firewall policy that do not conform to industry standards, and adjust the non-compliant policies based on the industry standard requirements in the cleaning policy; Weak policies with insufficient attack protection are identified from the first firewall policy, and the weak policies are optimized in a virtual network environment based on the reinforcement learning algorithm in the cleaning policy.

5. The firewall policy scrubbing method based on industry standards according to claim 1, characterized in that, After cleaning the first firewall policy using a cleaning strategy to obtain a second firewall policy adapted to the industry standards of the target industry, the method further includes: Virtual network environments are built by simulating real network topology and service traffic using virtual network environment construction technology. The second firewall policy is applied to the virtual firewall device in the virtual network environment to simulate normal business traffic and attack scenarios in order to verify the effectiveness of the second firewall policy. The attack scenarios include DDoS attacks, SQL injection attacks, and phishing attacks.

6. The firewall policy scrubbing method based on industry standards according to claim 5, characterized in that, After cleaning the first firewall policy using a cleaning strategy to obtain a second firewall policy adapted to the industry standards of the target industry, the method further includes: The second firewall policy is applied to the actual firewall devices in certain network areas to monitor network traffic and security events in those areas. If the second firewall policy has a significant negative impact or insufficient protection, an automatic rollback mechanism is triggered to restore the firewall policy of the actual firewall device to its previous state.

7. A firewall policy scrubbing device based on industry standards, characterized in that, include: The acquisition module is used to acquire industry standard data of the target industry, historical network attack data of the target industry, and corresponding firewall policies. A construction module is used to construct a knowledge graph based on the historical network attack data, the industry standard data, and the firewall policy, wherein the nodes of the knowledge graph are entities in the historical network attack data, the firewall policy, and the industry standard data. The determination module is used to determine a first firewall policy corresponding to the updated industry standard data based on the knowledge graph when the industry standard data in the industry standard database of the target industry is updated. The cleaning module is used to clean the first firewall policy using a cleaning strategy to obtain a second firewall policy that conforms to the industry standards of the target industry.

8. An electronic device, characterized in that, include: Processor and memory; wherein the memory is used to store computer programs that can run on the processor; A processor for executing a program stored in memory to implement the steps of the firewall policy cleaning method based on industry standards as described in any one of claims 1-6.

Images