System and method for checking configuration compliance of network equipment based on artificial intelligence

Abstract

The invention discloses a network equipment configuration compliance check system and method based on artificial intelligence, and the system comprises a configuration check specification interpretation agent which is used for extracting a key semantic fragment of each check item in a security configuration compliance check standard and converting the key semantic fragment into a structured data object, generating a configuration collection script, a compliance check rule and a non-compliance repair script of the check item according to the structured data object; the configuration data acquisition agent is used for acquiring system configuration data of the target object based on the configuration acquisition script; the configuration compliance check agent is used for extracting key configuration items in the system configuration data, and performing matching check on the key configuration items based on a compliance check rule to obtain a check result; the configuration reinforcement agent is used for repairing the non-compliance configuration item in the target object based on the non-compliance repair script; the report generation agent is used for generating an inspection report of the target object. According to the invention, the efficiency and accuracy of configuration compliance check of the network equipment can be improved.

Description

Technical Field

[0001] This application relates to the field of network management technology, and specifically to a system and method for checking the compliance of network device configurations based on artificial intelligence. Background Technology

[0002] With increasingly stringent cybersecurity compliance requirements, network device configuration compliance checks have become a crucial aspect of ensuring network security. Traditional checking methods rely on manually written rule files, using fixed scripts to collect configurations and perform matching judgments, which has significant limitations: First, it has poor adaptability, struggling to handle diverse network devices (such as routers, switches, and firewalls) and dynamically updated compliance standards (such as graded protection and CIS benchmarks); second, rule maintenance costs are high, requiring continuous manual monitoring of standard changes and modification of hard-coded logic; third, automation is low, with configuration collection, compliance verification, and remediation / hardening largely dependent on manual operations, making incomplete checks susceptible to human error and difficult to adapt to the efficient management needs of large-scale network environments. Therefore, existing network device configuration compliance checks suffer from low efficiency and accuracy. Summary of the Invention

[0003] The purpose of this application is to provide a system, method, computer device, and machine-readable storage medium for network device configuration compliance inspection based on artificial intelligence, in order to solve the problem of low inspection efficiency and accuracy in the prior art of network device configuration compliance inspection.

[0004] To achieve the above objectives, the first aspect of this application provides a system for network device configuration compliance checking based on artificial intelligence, the system comprising: The configuration inspection specification interpretation agent is configured to receive security configuration compliance inspection standards in natural language form. It extracts key semantic fragments of each inspection item in the security configuration compliance inspection standards through natural language processing, converts each inspection item into a structured data object based on the key semantic fragments, and generates configuration collection scripts, compliance inspection rules, and non-compliance repair scripts for the inspection items based on the structured data objects. The configuration data acquisition agent is configured to acquire system configuration data of the target object based on the configuration acquisition script; Configure a compliance check agent, which is configured to receive system configuration data and compliance check rules for each check item, parse the system configuration data and extract key configuration items, and perform matching and verification on the key configuration items based on the compliance check rules for each check item to determine the check result. The check result includes the compliance status, which is compliant or non-compliant. Configure the hardened intelligent agent to receive non-compliant configuration items with a non-compliant status in the key configuration items and non-compliant repair scripts, and repair the non-compliant configuration items in the target object based on the non-compliant repair scripts; The report generation agent is configured to generate inspection reports for the target object based on compliance inspection rules, inspection results, and non-compliance remediation scripts.

[0005] In this embodiment, the configuration data acquisition agent is further configured to: receive login information of the target object, including the target object's IP address, remote connection protocol, username, and password; remotely log in to the target object based on the login information, and control the target object to execute a configuration acquisition script to obtain the target object's system configuration data.

[0006] In this embodiment of the application, the configuration data acquisition agent is further configured to receive system configuration data of the target object returned after the configuration acquisition script is manually executed.

[0007] In this embodiment, the compliance check rules include the target command, expected result, judgment logic, and output type; the non-compliance repair script is used to manipulate the target object's configuration file, system service, or registry to adjust the target object's compliance status to compliant.

[0008] In this application embodiment, the target object is an operating system, network device, security device, or application software.

[0009] In this embodiment of the application, the input data formats supported by the configuration compliance check agent include structured data and semi-structured data.

[0010] In this embodiment of the application, the configuration hardening agent is further configured to: obtain the login information of the target object, connect to the target object according to the login information, and control the target object to execute the non-compliance repair script to repair the non-compliant configuration items in the target object. The login information includes the target object's IP, remote connection protocol, username, and password; or, generate a manual hardening instruction according to the non-compliance repair script and output the manual hardening instruction.

[0011] A second aspect of this application provides a method for network device configuration compliance checking based on artificial intelligence, the method comprising: It receives security configuration compliance inspection standards in natural language form, extracts key semantic fragments of each inspection item in the security configuration compliance inspection standards, converts each inspection item into a structured data object based on the key semantic fragments, and generates configuration collection scripts, compliance inspection rules, and non-compliance remediation scripts for the inspection items based on the structured data objects. Obtain system configuration data of the target object based on the configuration acquisition script; The system configuration data is parsed and key configuration items are extracted. Based on the compliance check rules of each check item, the key configuration items are matched and verified to determine the check results. The check results include the compliance status, which is either compliant or non-compliant. Repair non-compliant configuration items with a non-compliant status in critical configuration items based on the non-compliance repair script; An inspection report for the target object is generated based on the compliance inspection rules, inspection results, and non-compliance remediation scripts.

[0012] A third aspect of this application provides a computer device, including a memory and a processor, wherein the memory stores a computer program, and the processor executes the computer program to implement the above-described method for checking the configuration compliance of network devices based on artificial intelligence.

[0013] The fourth aspect of this application provides a machine-readable storage medium on which a program or instruction is stored, and when the program or instruction is executed by a processor, it implements the above-described method for checking the configuration compliance of network devices based on artificial intelligence.

[0014] The above technical solution provides an AI-based system for network device configuration compliance checks, comprising multiple intelligent agents. A configuration check specification interpretation agent extracts key semantic fragments from each check item in the security configuration compliance check standard, converts each check item into a structured data object based on the key semantic fragments, and generates configuration collection scripts, compliance check rules, and non-compliance remediation scripts for each check item based on the structured data objects. A configuration data collection agent acquires system configuration data of the target object based on the configuration collection scripts. A configuration compliance check agent parses the system configuration data and extracts key configuration items, matching and verifying the key configuration items based on the compliance check rules for each check item to determine the check results. A configuration hardening agent repairs non-compliant configuration items in the target object based on the non-compliance remediation scripts. A report generation agent generates a check report for the target object based on the compliance check rules, check results, and non-compliance remediation scripts. This application can automatically interpret security standards, generate collection scripts and compliance check rules, and automatically complete configuration data collection, compliance checks, and remediation hardening, greatly reducing the workload and human error of traditional manual operations and improving the efficiency and accuracy of network device configuration compliance checks.

[0015] Other features and advantages of the embodiments of this application will be described in detail in the following detailed description section. Attached Figure Description

[0016] The accompanying drawings are provided to further illustrate the embodiments of this application and form part of the specification. They are used together with the following detailed description to explain the embodiments of this application, but do not constitute a limitation on the embodiments of this application. In the drawings: Figure 1 A structural block diagram of a system for network device configuration compliance checking based on artificial intelligence, provided in an embodiment of this application; Figure 2 A flowchart illustrating a method for verifying network device configuration compliance based on artificial intelligence, as provided in this application embodiment. Detailed Implementation

[0017] To make the objectives, technical solutions, and advantages of the embodiments of this application clearer, the technical solutions of the embodiments of this application will be clearly and completely described below with reference to the accompanying drawings. It should be understood that the specific embodiments described herein are only for illustration and explanation of the embodiments of this application and are not intended to limit the embodiments of this application. All other embodiments obtained by those skilled in the art based on the embodiments of this application without creative effort are within the scope of protection of this application.

[0018] It should be noted that if the embodiments of this application involve directional indicators (such as up, down, left, right, front, back, etc.), the directional indicators are only used to explain the relative positional relationship and movement of each component in a certain specific posture (as shown in the figure). If the specific posture changes, the directional indicators will also change accordingly.

[0019] Furthermore, if the embodiments of this application involve descriptions such as "first" or "second," these descriptions are for descriptive purposes only and should not be construed as indicating or implying their relative importance or implicitly specifying the number of technical features indicated. Therefore, features defined with "first" or "second" may explicitly or implicitly include at least one of those features. Additionally, the technical solutions of various embodiments can be combined with each other, but this must be based on the ability of those skilled in the art to implement them. If the combination of technical solutions is contradictory or impossible to implement, it should be considered that such a combination of technical solutions does not exist and is not within the scope of protection claimed in this application.

[0020] Figure 1 This is a structural block diagram of a system for verifying network device configuration compliance based on artificial intelligence, provided as an embodiment of this application. Figure 1 As shown in the figure, this application embodiment provides a system 100 for network device configuration compliance checking based on artificial intelligence. The system 100 includes: The configuration inspection specification interpretation agent 110 is configured to receive security configuration compliance inspection standards in natural language form. It extracts key semantic fragments of each inspection item in the security configuration compliance inspection standards through natural language processing, converts each inspection item into a structured data object based on the key semantic fragments, and generates configuration collection scripts, compliance inspection rules, and non-compliance repair scripts for the inspection items based on the structured data objects.

[0021] In this embodiment, the configuration check specification interpretation intelligent agent 110 is the core component of the entire AI-based network device configuration compliance check system 100. It primarily receives and parses the security configuration compliance check standards, automatically converting the normative text in natural language form into three types of executable objects: configuration collection scripts, compliance check rules, and non-compliance repair scripts. Specifically, the configuration collection scripts extract relevant configuration data from the target object, the compliance check rules determine whether the collected data conforms to the standards, and the non-compliance repair scripts automatically harden or repair non-compliant items.

[0022] In this embodiment, the target object is an operating system, network device, security device, or application software. This satisfies the unified security management needs in heterogeneous environments and enhances the overall collaborative capabilities of enterprise security management.

[0023] In this embodiment of the application, the goal of the configuration inspection specification interpretation intelligent agent 110 is to achieve "configuration based on documents, inspection based on documents, and consolidation based on documents", that is, to automatically generate system configuration processing logic through standard documents, thereby achieving a closed loop of configuration compliance inspection without human intervention.

[0024] Specifically, the configuration inspection specification interpretation agent 110 first preprocesses and semantically segments the security configuration compliance inspection standard (i.e., the standard document) in natural language form input by the user. The security configuration compliance inspection standard can originate from current national or industry standards, and its format can be PDF, Word, Markdown, or plain text. The security configuration compliance inspection standard includes multiple inspection items. The configuration inspection specification interpretation agent 110 can utilize a large model for natural language processing to segment and identify the standard document, extracting key semantic fragments for each inspection item. Then, based on these key semantic fragments, each inspection item is transformed into a structured data object, serving as the basis for subsequent rule and script generation.

[0025] In one example, the key semantic fragments for each inspection item include the inspection item number and title, description, audit method, hardening recommendation, and non-compliance explanation; wherein, the inspection item number and title are used to uniquely identify compliant items; the description is used to explain the background of the inspection item; the audit method is used to explain how to detect the current configuration; the hardening recommendation is used to provide a way to handle non-compliant configurations; and the non-compliance explanation is used to supplement the risk description when the inspection fails.

[0026] Furthermore, configuration collection scripts, compliance check rules, and non-compliance remediation scripts are generated based on structured data objects.

[0027] Specifically, in the standard text, the audit method section for each inspection item typically describes the operation commands or procedures used to check the configuration status of that item. The configuration inspection specification interpretation agent 110 can identify the instructions in this section and automatically generate the corresponding configuration collection script based on the operating system platform. Preferably, the execution results of the subsequent script can be output to a specified preset directory for subsequent inspection modules to read and analyze.

[0028] The configuration check specification interpretation intelligent agent 110, while generating the collection script, can also generate corresponding compliance check rules to determine whether the relevant data configuration of the target object is compliant. These compliance check rules can be expressed using structured logic. In this embodiment, the compliance check rule includes a target command, expected result, judgment logic, and output type; wherein, the target command is the check command to be executed; the expected result is the output when the standard deems it compliant; the judgment logic is used to compare the actual result with the expected result; and the output type is used to indicate the classification method of the check result.

[0029] The configuration inspection specification interpretation intelligent agent 110 can also automatically generate non-compliance remediation scripts based on the hardening suggestion paragraphs in the key semantic segments of the inspection items. When the inspection result of the target object is non-compliant, the non-compliance remediation script can manipulate the target object's configuration file, system service, or registry to adjust the target object's compliance status to compliant. Preferably, the non-compliance remediation script has judgment logic to ensure that it is not repeatedly written, so as to meet the operation and maintenance needs of the actual production environment.

[0030] The data acquisition agent 120 is configured to acquire system configuration data of the target object based on the configuration acquisition script.

[0031] It is understandable that the configuration data acquisition agent 120 is used to obtain system configuration data from the target object, providing comprehensive and accurate raw data support for subsequent compliance checks, and ensuring that the configuration compliance check process can be carried out based on complete configuration information.

[0032] In this embodiment, the configuration data acquisition agent 120 is further configured to: receive login information of the target object, including the target object's IP address, remote connection protocol, username, and password; remotely log in to the target object based on the login information, and control the target object to execute a configuration acquisition script to obtain the target object's system configuration data.

[0033] It is understandable that the configuration data acquisition agent 120 can actively acquire the system configuration data of the target object. Specifically, the configuration data acquisition agent 120 can accept the login information of the target object provided by the user, including the target object's IP address, remote connection protocol, username, and password. The remote connection protocol can be SSH, Telnet, WinRM, etc. Then, based on the login information, it remotely logs into the target object and controls the target object to execute the configuration acquisition script to complete data retrieval and obtain the target object's system configuration data. The active acquisition method depends on the target object's IP address, login credentials, and device type provided by the user. The configuration data acquisition agent 120 can select the appropriate remote connection library or tool based on the protocol type, supporting login operations for Linux, Windows, and mainstream network devices. After successful login, the configuration data acquisition agent 120 executes commands in batches according to the configuration acquisition script template, such as reading system configuration files and querying service status, and returns the acquisition results in a structured format.

[0034] In this embodiment of the application, the configuration data acquisition agent 120 is further configured to receive system configuration data of the target object returned after the configuration acquisition script is manually executed.

[0035] It is understandable that the configuration data acquisition agent 120 can passively acquire the system configuration data of the target object. Specifically, operations and maintenance personnel manually log in to the target object and execute the configuration acquisition script to collect the system configuration data. The configuration data acquisition agent 120 then receives the system configuration data returned by the manually executed configuration acquisition script. This passive acquisition method is suitable for environments where remote automatic login is not possible or where security restrictions are strict. The configuration check specification interpretation agent 110 automatically generates an executable configuration acquisition script based on compliance check requirements, such as Shell, BAT, CMD, PowerShell, or device CLI commands, along with detailed comments and execution instructions. Operations and maintenance personnel or security personnel manually log in to the target object to execute the script. After the execution results are saved in text file or log format, the results are manually or systematically returned to the configuration data acquisition agent 120 for subsequent parsing and compliance analysis. This passive acquisition method takes into account the operational requirements of high-security isolation environments, avoids the security risks and network restrictions brought by automated login, and flexibly adapts to multiple platforms and multi-vendor devices. With its templated script generation and batch packaging capabilities, it supports large-scale distribution and unified management, ensuring the integrity and standardization of configuration data collection. It is suitable for complex environments with strict security policies and restricted remote access.

[0036] In this way, by configuring the data collection agent 120, it can be ensured that the configuration information with broad coverage and clear structure can be collected, which is convenient for subsequent rule matching and compliance judgment.

[0037] The compliance check agent 130 is configured to receive system configuration data and compliance check rules for each check item, parse the system configuration data and extract key configuration items, and perform matching and verification on the key configuration items based on the compliance check rules for each check item to determine the check result. The check result includes the compliance status, which is either compliant or non-compliant.

[0038] It is understandable that the configuration compliance check agent 130 is used to compare the collected system configuration data of the target object with the compliance check rules and output the check results.

[0039] In this embodiment, the compliance check agent 130 supports input data formats including structured and semi-structured data. The rule base can be dynamically updated and customized to meet different security standards and enterprise-specific needs, enhancing the system's adaptability and long-term application value.

[0040] Specifically, for structured data such as JSON and YAML, and semi-structured data such as text logs and configuration file fragments, the configuration compliance check agent 130 can parse the input system configuration data, extract key configuration items, and then generate compliance check rules according to the configuration check specifications. These rules are then used to match and verify the key configuration items. During the check, the configuration compliance check agent 130 can execute each compliance check rule to determine whether the configuration data of the key configuration items meets the requirements, and record the compliance status and specific reasons for non-compliance. Finally, standardized check result data is generated, which includes the compliance status, check item details, and risk description. The compliance status is either compliant or non-compliant. This enables automated compliance checks of configuration data.

[0041] Configure the hardened intelligent agent 140 to receive non-compliant configuration items with a non-compliant status in the key configuration items and non-compliant repair scripts, and repair the non-compliant configuration items in the target object based on the non-compliant repair scripts.

[0042] It is understandable that the configuration hardening agent 140 can determine the non-compliant configuration items in the key configuration items based on the compliance status in the inspection results. The non-compliant configuration items are those with a non-compliant status. Then, based on the non-compliant repair script corresponding to the non-compliant configuration item, the non-compliant configuration items in the target object are repaired.

[0043] In this embodiment of the application, the configuration hardening agent 140 is further configured to: obtain the login information of the target object, connect to the target object according to the login information, and control the target object to execute the non-compliance repair script to repair the non-compliant configuration items in the target object. The login information includes the target object's IP, remote connection protocol, username, and password; or, generate a manual hardening instruction according to the non-compliance repair script and output the manual hardening instruction.

[0044] Specifically, the remediation methods for non-compliant configuration items include automatic hardening and manual hardening. Automatic hardening is suitable for environments with sufficient permissions and network connectivity, while manual hardening is for scenarios with restricted remote access or strict security policies. In one example, in automatic hardening mode, the configuration hardening agent 140 can obtain the login information of the target object input by the user. The login information includes the target object's IP address, remote connection protocol, username, and password. The remote connection protocol can be SSH, Telnet, WinRM, etc. Then, based on the login information, it remotely logs into the target object and controls the target object to execute the non-compliant remediation script, thereby quickly and accurately resolving the configuration issue. In another example, in manual hardening mode, the configuration hardening agent 140 can generate manual hardening instructions and execution instructions based on the non-compliant remediation script, and output these instructions and instructions. Operations personnel then manually log into the target object to execute these instructions, thereby ensuring security compliance.

[0045] Thus, based on the non-compliance remediation script, the configuration of the hardened agent 140 achieves closed-loop automation from compliance standard parsing to configuration remediation, significantly improving the efficiency and accuracy of security configuration management.

[0046] Report generation agent 150 is configured to generate inspection reports for the target object based on compliance inspection rules, inspection results, and non-compliance remediation scripts.

[0047] It is understandable that the report generation agent 150 is used to organically combine compliance detection rules, compliance inspection results, and remediation plans to generate a comprehensive and detailed security inspection report. Specifically, the report generation agent 150 first receives the compliance inspection rules provided by the configuration inspection specification interpretation agent 110, then integrates the inspection results output by the configuration compliance inspection agent 130 and the hardening remediation plan generated by the configuration hardening agent 140, providing a comprehensive summary of the entire security compliance process. The report content includes an overview of the inspection standards, the compliance status of each inspection indicator, specific non-compliance items and risk analysis, and detailed remediation suggestions and implemented hardening measures. The report generation agent 150 supports multiple output formats (such as PDF, HTML, and JSON), facilitating auditing, archiving, and subsequent tracking by security management personnel. Through automated integration and formatting, the report preparation efficiency is improved, the transparency and standardization of compliance audits are ensured, and closed-loop management from standard input to report output is achieved.

[0048] The above technical solution provides an AI-based system for network device configuration compliance checks, comprising multiple intelligent agents. A configuration check specification interpretation agent extracts key semantic fragments from each check item in the security configuration compliance check standard, converts each check item into a structured data object based on the key semantic fragments, and generates configuration collection scripts, compliance check rules, and non-compliance remediation scripts for each check item based on the structured data objects. A configuration data collection agent acquires system configuration data of the target object based on the configuration collection scripts. A configuration compliance check agent parses the system configuration data and extracts key configuration items, matching and verifying the key configuration items based on the compliance check rules for each check item to determine the check results. A configuration hardening agent repairs non-compliant configuration items in the target object based on the non-compliance remediation scripts. A report generation agent generates a check report for the target object based on the compliance check rules, check results, and non-compliance remediation scripts. This application can automatically interpret security standards, generate collection scripts and compliance check rules, and automatically complete configuration data collection, compliance checks, and remediation hardening, greatly reducing the workload and human error of traditional manual operations and improving the efficiency and accuracy of network device configuration compliance checks.

[0049] Figure 2 This is a flowchart illustrating a method for verifying network device configuration compliance based on artificial intelligence, as provided in an embodiment of this application. Figure 2 As shown in the illustration, this application provides a method for network device configuration compliance checking based on artificial intelligence. This method can be applied to a network device configuration compliance checking system based on artificial intelligence as described above. The method may include the following steps: Step S101: Receive the security configuration compliance check standard in natural language form, extract the key semantic fragments of each check item in the security configuration compliance check standard, convert each check item into a structured data object based on the key semantic fragments, and generate the configuration collection script, compliance check rules, and non-compliance repair script for the check item based on the structured data object.

[0050] In this embodiment, the compliance check rules include the target command, expected result, judgment logic, and output type; the non-compliance repair script is used to manipulate the target object's configuration file, system service, or registry to adjust the target object's compliance status to compliant.

[0051] Step S102: Obtain system configuration data of the target object based on the configuration acquisition script.

[0052] In this embodiment, the target object is an operating system, network device, security device, or application software. In one example, obtaining system configuration data of the target object based on a configuration acquisition script may include: receiving login information of the target object, including the target object's IP address, remote connection protocol, username, and password; remotely logging into the target object based on the login information; and controlling the target object to execute the configuration acquisition script to obtain the target object's system configuration data. In another example, obtaining system configuration data of the target object based on a configuration acquisition script may include: receiving the system configuration data of the target object returned after the configuration acquisition script is manually executed.

[0053] Step S103: Parse the system configuration data and extract key configuration items, and perform matching and verification on the key configuration items based on the compliance check rules of each check item to determine the check results. The check results include the compliance status, which is either compliant or non-compliant.

[0054] Step S104: Repair non-compliant configuration items with a non-compliant status in the key configuration items based on the non-compliance repair script.

[0055] In this embodiment of the application, repairing non-compliant configuration items with a non-compliant status in the key configuration items based on the non-compliant repair script may include: obtaining the login information of the target object, connecting to the target object according to the login information, and controlling the target object to execute the non-compliant repair script to repair the non-compliant configuration items in the target object. The login information includes the target object's IP, remote connection protocol, username, and password; or, generating a manual hardening instruction according to the non-compliant repair script and outputting the manual hardening instruction.

[0056] Step S105: Generate an inspection report for the target object based on the compliance inspection rules, inspection results, and non-compliance remediation scripts.

[0057] It is understood that the method for network device configuration compliance inspection based on artificial intelligence provided in this application embodiment is applied to a system 100 for network device configuration compliance inspection based on artificial intelligence in the above embodiment. The above steps S101 to S105 can be executed by the configuration inspection specification interpretation intelligent agent 110, configuration data collection intelligent agent 120, configuration compliance inspection intelligent agent 130, configuration hardening intelligent agent 140 and report generation intelligent agent 150 in the system 100, respectively. The specific execution process is the same as the above embodiment, and will not be repeated here.

[0058] In this way, the above technical solution can automatically interpret security standards, generate collection scripts and compliance check rules, and automatically complete configuration data collection, compliance checks and repair reinforcement, which greatly reduces the workload and human error of traditional manual operations and improves work efficiency and accuracy.

[0059] The AI-based network device configuration compliance check system described in this application can be widely applied to the information security management practices of various enterprises and organizations. The following are specific application examples: 1. The enterprise's intranet server is secure and compliant.

[0060] Large enterprises use this system to automatically collect security configurations of their internal Linux and Windows servers. Combining this with national or industry security standards (such as CIS benchmarks and ISO 27001), the system performs compliance checks on critical configurations such as server account management, permission settings, and password policies. The system automatically identifies non-compliant items and remotely executes hardening scripts to patch vulnerabilities, significantly improving internal network security capabilities.

[0061] 2. Security inspection of network equipment.

[0062] In telecommunications operators or large data centers, this invention can be used to perform batch data collection and compliance verification of network device configurations such as routers, switches, and firewalls. Through automated rule interpretation, it quickly generates collection and inspection scripts, reducing the risks and workload of manual operations and ensuring that network devices comply with operational security standards and vendor security recommendations.

[0063] 3. Cloud environment security configuration management.

[0064] Cloud service providers or enterprise cloud platform operations and maintenance teams can use this system to automatically collect security configuration data of cloud hosts and containers, conduct compliance checks in accordance with the Cloud Security Alliance (CSA) standards, automatically harden potentially risky configurations, and effectively prevent cloud environment security incidents caused by configuration errors.

[0065] 4. Automated security audit and compliance reporting.

[0066] Audit firms or internal security teams can use this invention to automatically generate detailed security configuration compliance reports, including standard interpretations, inspection results, and remediation records, improving audit efficiency and report quality, and providing strong data support for compliance certification and risk management.

[0067] Through the above applications, the embodiments of this application realize the transformation of security configuration management from manual operation to intelligent and automated operation, improve the coverage, accuracy and response speed of security compliance, and help organizations build a more solid security defense.

[0068] This application also provides a computer device, including a memory and a processor. The memory stores a computer program, and the processor executes the computer program to implement the method for network device configuration compliance checking based on artificial intelligence in the above embodiments.

[0069] This application also provides a machine-readable storage medium on which a program or instruction is stored. When the program or instruction is executed by a processor, it implements the method for checking the network device configuration compliance based on artificial intelligence in the above embodiments.

[0070] Those skilled in the art will understand that embodiments of this application can be provided as methods, systems, or computer program products. Therefore, this application can take the form of a completely hardware embodiment, a completely software embodiment, or an embodiment combining software and hardware aspects. Furthermore, this application can take the form of a computer program product embodied on one or more computer-usable storage media (including, but not limited to, disk storage, CD-ROM, optical storage, etc.) containing computer-usable program code.

[0071] This application is described with reference to flowchart illustrations and / or block diagrams of methods, apparatus (systems), and computer program products according to embodiments of this application. It will be understood that each block of the flowchart illustrations and / or block diagrams, and combinations of blocks in the flowchart illustrations and / or block diagrams, can be implemented by computer program instructions. These computer program instructions can be provided to a processor of a general-purpose computer, special-purpose computer, embedded processor, or other programmable data processing apparatus to produce a machine, such that the instructions, which execute via the processor of the computer or other programmable data processing apparatus, generate instructions for implementing the flowchart... Figure 1 One or more processes and / or boxes Figure 1 A device that provides the functions specified in one or more boxes.

[0072] These computer program instructions may also be stored in a computer-readable storage medium that can direct a computer or other programmable data processing device to function in a particular manner, such that the instructions stored in the computer-readable storage medium produce an article of manufacture including instruction means, which are implemented in a process Figure 1One or more processes and / or boxes Figure 1 The function specified in one or more boxes.

[0073] These computer program instructions may also be loaded onto a computer or other programmable data processing equipment to cause a series of operational steps to be performed on the computer or other programmable equipment to produce a computer-implemented process, thereby providing instructions that execute on the computer or other programmable equipment for implementing the process. Figure 1 One or more processes and / or boxes Figure 1 The steps of the function specified in one or more boxes.

[0074] In a typical configuration, a computing device includes one or more processors (CPU), input / output interfaces, network interfaces, and memory.

[0075] Memory may include non-persistent memory in computer-readable media, such as random access memory (RAM) and / or non-volatile memory, such as read-only memory (ROM) or flash RAM. Memory is an example of computer-readable media.

[0076] Computer-readable media includes both permanent and non-permanent, removable and non-removable media that can store information using any method or technology. Information can be computer-readable instructions, data structures, modules of programs, or other data. Examples of computer storage media include, but are not limited to, phase-change memory (PRAM), static random access memory (SRAM), dynamic random access memory (DRAM), other types of random access memory (RAM), read-only memory (ROM), electrically erasable programmable read-only memory (EEPROM), flash memory or other memory technologies, CD-ROM, digital versatile optical disc (DVD) or other optical storage, magnetic tape, magnetic disk storage or other magnetic storage devices, or any other non-transferable medium that can be used to store information accessible by a computing device. As defined herein, computer-readable media does not include transient computer-readable media, such as modulated data signals and carrier waves.

[0077] It should also be noted that the terms "comprising," "including," or any other variations thereof are intended to cover non-exclusive inclusion, such that a process, method, article, or apparatus that comprises a list of elements includes not only those elements but also other elements not expressly listed, or elements inherent to such process, method, article, or apparatus. Unless otherwise specified, an element defined by the phrase "comprising one..." does not exclude the presence of other identical elements in the process, method, article, or apparatus that includes that element.

[0078] The above are merely embodiments of this application and are not intended to limit the scope of this application. Various modifications and variations can be made to this application by those skilled in the art. Any modifications, equivalent substitutions, improvements, etc., made within the spirit and principles of this application should be included within the scope of the claims of this application.

Claims

1. A system for verifying the compliance of network device configurations based on artificial intelligence, characterized in that, The system includes: The configuration inspection specification interpretation agent is configured to receive security configuration compliance inspection standards in natural language form, extract key semantic fragments of each inspection item in the security configuration compliance inspection standards through natural language processing, convert each inspection item into a structured data object based on the key semantic fragments, and generate configuration collection scripts, compliance inspection rules, and non-compliance repair scripts for the inspection items based on the structured data objects. A data acquisition agent is configured to acquire system configuration data of a target object based on the configuration acquisition script. A compliance check intelligent agent is configured to receive the system configuration data and the compliance check rules for each check item, parse the system configuration data and extract key configuration items, and perform matching and verification on the key configuration items based on the compliance check rules for each check item to determine the check result. The check result includes a compliance status, which is either compliant or non-compliant. The hardening agent is configured to receive non-compliant configuration items with a non-compliant status in the key configuration items and the non-compliance repair script, and repair the non-compliant configuration items in the target object based on the non-compliance repair script. The report generation agent is configured to generate an inspection report for the target object based on the compliance inspection rules, the inspection results, and the non-compliance remediation script.

2. The system according to claim 1, characterized in that, The configured data acquisition agent is further configured to: Receive login information from the target object, the login information including the target object's IP address, remote connection protocol, username, and password; Remotely log in to the target object based on the login information, and control the target object to execute the configuration acquisition script to obtain the system configuration data of the target object.

3. The system according to claim 1, characterized in that, The configured data acquisition agent is further configured to: Receive the system configuration data of the target object that is returned after the configuration collection script is manually executed.

4. The system according to claim 1, characterized in that, The compliance check rules include the target command, expected result, judgment logic, and output type; The non-compliance repair script is used to manipulate the target object's configuration file, system service, or registry to adjust the target object's compliance status to compliant.

5. The system according to claim 1, characterized in that, The target object is an operating system, network device, security device, or application software.

6. The system according to claim 1, characterized in that, The configuration compliance check agent supports input data formats including structured data and semi-structured data.

7. The system according to claim 1, characterized in that, The configured hardened agent is also configured to: Obtain the login information of the target object, connect to the target object based on the login information, and control the target object to execute the non-compliance repair script to repair the non-compliant configuration items in the target object. The login information includes the target object's IP address, remote connection protocol, username, and password. Alternatively, generate manual reinforcement instructions based on the non-compliance repair script and output the manual reinforcement instructions.

8. A method for verifying the compliance of network device configurations based on artificial intelligence, characterized in that, The method includes: The system receives security configuration compliance inspection standards in natural language form, extracts key semantic fragments from each inspection item in the security configuration compliance inspection standards, converts each inspection item into a structured data object based on the key semantic fragments, and generates configuration collection scripts, compliance inspection rules, and non-compliance repair scripts for each inspection item based on the structured data objects. Based on the configuration acquisition script, obtain the system configuration data of the target object; The system configuration data is parsed and key configuration items are extracted. The key configuration items are matched and verified based on the compliance check rules of each check item to determine the check result. The check result includes a compliance status, which is either compliant or non-compliant. Based on the aforementioned non-compliance repair script, repair the non-compliant configuration items in the critical configuration items whose compliance status is non-compliant; An inspection report for the target object is generated based on the compliance inspection rules, the inspection results, and the non-compliance remediation script.

9. A computer device comprising a memory and a processor, wherein the memory stores a computer program, characterized in that, When the processor executes the computer program, it implements the method for network device configuration compliance checking based on artificial intelligence as described in claim 8.

10. A machine-readable storage medium on which a program or instructions are stored, characterized in that, When the program or the instructions are executed by the processor, the method for checking the configuration compliance of network devices based on artificial intelligence as described in claim 8 is implemented.

Images