Enterprise information security defense strategy generation method based on adaptive rule engine

Abstract

The invention discloses an enterprise information security defense strategy generation method based on an adaptive rule engine, and relates to the technical field of network and information security, and the method comprises the steps: carrying out the multi-dimensional feature vectorization processing of real-time security event data, and generating a threat feature vector set; based on the threat feature vector set, constructing a dynamic threat model, calculating a risk assessment score of each threat feature vector, and performing clustering analysis on the threat feature vectors to generate a threat scene classification result and a threat level identifier; inputting the threat scene classification result into an adaptive rule engine to generate an initial defense rule set, and correcting the rule priority of the initial defense rule set in real time through a rule weight dynamic adjustment mechanism to form an adaptive defense rule set; and generating a hierarchical enterprise information security defense strategy according to the self-adaptive defense rule set, and sending the hierarchical enterprise information security defense strategy to an enterprise network. According to the method, the dynamic adaptation capability of defense rules and the hierarchical accuracy of strategy deployment are ensured.

Description

Technical Field

[0001] This invention relates to the field of network and information security technology, and in particular to a method for generating enterprise information security defense strategies based on an adaptive rule engine. Background Technology

[0002] Traditional enterprise information security defense strategies largely rely on static rule bases and predefined policy templates, adjusting policies periodically through manual updates or based on specific event triggers. While these methods are effective in single attack scenarios or with relatively fixed threat patterns, their response speed and policy matching accuracy are significantly insufficient when facing increasingly frequent APT attacks, zero-day exploits, insider threats, and cross-platform hybrid attack chains. Especially in dynamic network environments, the correlation and evolution patterns between real-time security event data and historical attack behavior data cannot be fully utilized, making it difficult for defense strategies to adapt to the latest threat landscape in a timely manner. Furthermore, traditional policy generation methods often lack dynamic adjustment mechanisms for rule weights, failing to prioritize and real-time correct different threat characteristics based on risk levels. This may result in high-risk threats not being prioritized, reducing overall protection efficiency. Regarding multi-level policy generation, existing technologies often operate independently in terms of access control, traffic monitoring, and response handling, lacking a unified layered collaborative optimization mechanism, making it difficult to achieve end-to-end adaptive closed-loop control from threat identification and rule generation to policy issuance.

[0003] CN119728302B discloses a multi-level information security policy generation method based on knowledge graphs. This method constructs and dynamically updates a knowledge graph by collecting multi-source security data, utilizes graph neural networks to identify threats and generate assessment reports, combines graph attention networks and generative adversarial networks to optimize protection strategies, and further refines them through meta-learning algorithms. While this approach offers advantages in the intelligence and dynamism of threat identification and policy generation, its policy adjustment process relies on the update cycle of the knowledge graph structure, making it difficult to achieve second-level response based on real-time threat characteristics. Furthermore, the policy optimization it generates focuses more on threat prediction and macro-level protection, lacking a fine-grained adaptive rule adjustment mechanism for specific threat scenarios.

[0004] CN105376246B proposes an SDN-based adaptive security policy generation and management system that combines NFV resource pools and virtual machine resource pools to provide security detection, data analysis and decision-making, and unified policy management functions for cloud environments. Although the system can customize and transmit policies based on detection results, its rule generation process is still mainly based on fixed templates and static configurations. It lacks the ability to dynamically correct the features of real-time security events, risk classification, and rule priority, and the coupling between policy layer management and threat scenario matching is not high. Summary of the Invention

[0005] In view of the common problems of existing enterprise information security policy generation technologies, such as large response latency, lack of adaptive rule engines based on threat characteristics, insufficient flexibility in policy priority adjustment, and low degree of coordination of layered policies, this invention is proposed.

[0006] Therefore, the problem to be solved by this invention is how to achieve adaptive generation and dynamic priority adjustment of defense rules in a dynamic enterprise network environment based on real-time threat characteristics and historical attack behaviors, so as to build an enterprise information security defense strategy that can be layered, finely matched and has rapid response capabilities.

[0007] To solve the above-mentioned technical problems, the present invention provides the following technical solution:

[0008] In a first aspect, embodiments of the present invention provide a method for generating enterprise information security defense strategies based on an adaptive rule engine, which includes,

[0009] Collect real-time security event data and historical attack behavior data of the enterprise network environment, and perform multi-dimensional feature vectorization processing on the real-time security event data to generate a set of threat feature vectors;

[0010] Based on the set of threat feature vectors, a dynamic threat model is constructed, the risk assessment score of each threat feature vector is calculated, and cluster analysis is performed on the threat feature vectors to generate threat scenario classification results and threat level identifiers.

[0011] The threat scenario classification results are input into the adaptive rule engine to generate an initial defense rule set. The rule priority of the initial defense rule set is then modified in real time through a rule weight dynamic adjustment mechanism to form an adaptive defense rule set.

[0012] Based on the adaptive defense rule set, a hierarchical enterprise information security defense strategy is generated and sent to the enterprise network.

[0013] As a preferred embodiment of the enterprise information security defense strategy generation method based on the adaptive rule engine described in this invention, the method includes: generating a hierarchical enterprise information security defense strategy according to the adaptive defense rule set and sending it to the enterprise network, including:

[0014] Based on the adaptive defense rule set, a hierarchical defense strategy is established, and access control rule entries are extracted.

[0015] Based on the source IP address, target port number, and protocol type, the access control rule entries are configured hierarchically according to the threat level identifier to generate a hierarchical access control rule set;

[0016] Based on the attack frequency index, attack intensity coefficient and lateral movement distance parameter, calculate the dynamic traffic monitoring threshold parameter and generate a set of traffic monitoring thresholds;

[0017] Based on the processing actions and threat level identifiers of the adaptive defense rule set, a response and handling action mapping table is constructed to generate a hierarchical set of response and handling actions;

[0018] The hierarchical access control rule set, the traffic monitoring threshold set, and the hierarchical response and handling action set are subjected to policy conflict detection and optimization.

[0019] A rule compatibility analysis algorithm is used to detect policy conflicts between different protection layers. Conflicts are resolved by policy priority adjustment and rule merging optimization methods to generate a hierarchical enterprise information security defense strategy.

[0020] Based on the enterprise network topology and hierarchical defense strategy, a policy deployment mapping scheme is generated, and the hierarchical enterprise information security defense strategy is pushed to each protection device in batches through the security management center, generating a policy deployment status report.

[0021] As a preferred embodiment of the enterprise information security defense strategy generation method based on adaptive rule engine described in this invention, the adaptive defense rule set includes a core protection layer, an auxiliary protection layer, and a backup protection layer; the hierarchical defense strategy includes a first-level defense strategy layer, a second-level defense strategy layer, and a third-level defense strategy layer; the core protection layer corresponds to the enterprise network boundary protection layer; the auxiliary protection layer corresponds to the enterprise network internal protection layer; and the backup protection layer corresponds to the enterprise network terminal protection layer.

[0022] As a preferred embodiment of the enterprise information security defense strategy generation method based on adaptive rule engine described in this invention, the method for generating the adaptive defense rule set is as follows:

[0023] The network penetration scenario, data leakage scenario, malicious code propagation scenario and denial-of-service attack scenario classified by the threat scenario classification results are matched with the preset defense rule templates in the adaptive rule engine to establish a mapping relationship table between threat scenarios and defense rule templates;

[0024] The threat assessment results are input into the adaptive rule engine, which extracts the corresponding rule parameter configurations from the defense rule template based on the threat level identifier and arranges them according to the priority of threat level.

[0025] Based on the rule parameter configuration, combined with the threat type cluster label of the threat feature vector set, the attack frequency index, attack intensity coefficient and lateral movement distance parameters are used as rule threshold parameters to generate defense rule entries and form an initial defense rule set;

[0026] Establish a dynamic adjustment mechanism for rule weights, and calculate the rule weight adjustment factor by monitoring the changing trend of threat level indicators in threat assessment results and the fluctuation of comprehensive risk assessment scores;

[0027] The base weight value of each defense rule in the initial defense rule set is multiplied by the rule weight adjustment factor to obtain the corrected rule weight value, and the rule priority sequence is updated.

[0028] Based on the rule priority sequence and the resource configuration constraints of the adaptive rule engine, the first F high-priority defense rules are selected from the initial defense rule set to form a core rule subset;

[0029] The core rule subset and the remaining defense rules are organized hierarchically according to the modified rule weight values ​​to form an adaptive defense rule set.

[0030] As a preferred embodiment of the enterprise information security defense strategy generation method based on adaptive rule engine described in this invention, the method for generating the threat scenario classification results and threat level identifiers is as follows:

[0031] A dynamic threat model is constructed based on threat identifier codes and multidimensional threat feature vectors from a set of threat feature vectors.

[0032] Based on the laws of threat evolution, the feature weight coefficients of each dimension of each multidimensional threat feature vector in the threat feature vector set are calculated;

[0033] The multidimensional threat feature vectors are weighted and summed with the feature weight coefficients to calculate the initial risk score for each threat feature vector and generate a comprehensive risk assessment score.

[0034] The multidimensional threat feature vectors are numerically standardized, and an improved K-means clustering algorithm is used to perform cluster analysis on the standardized threat feature vectors to obtain a threat feature clustering result matrix.

[0035] Based on the clustering of the threat feature clustering result matrix, and combined with the threat type cluster labels of the threat feature vector set, a threat scenario mapping table is constructed.

[0036] Based on the threat scenario mapping table, each cluster is assigned to network penetration scenario, data leakage scenario, malicious code propagation scenario and denial-of-service attack scenario, respectively, to form a threat scenario classification result;

[0037] Based on the comprehensive risk assessment score and the threat scenario classification results, a graded threshold determination method is used to classify the threat level and generate a threat assessment result.

[0038] As a preferred embodiment of the enterprise information security defense strategy generation method based on adaptive rule engine described in this invention, the method for constructing the dynamic threat model is as follows:

[0039] Based on the threat identification code of the threat feature vector set, historical threat data are arranged in chronological order, statistical baseline parameters of multidimensional threat feature vectors are extracted, and a threat feature baseline database is established.

[0040] A sliding time window analysis method is used to perform time series analysis on the threat feature vector set to identify the change patterns of threat features in the time dimension.

[0041] By calculating the similarity coefficient and rate of change of threat feature vectors within adjacent time windows, the periodicity, trend, and suddenness patterns of threat evolution are extracted to form a threat evolution pattern feature library.

[0042] Based on the co-occurrence frequency and temporal correlation of the threat identification codes, a directed correlation graph between threat events is constructed; a graph neural network algorithm is used to analyze the propagation path and influence intensity between threat event nodes, calculate the causal correlation coefficient and propagation probability between threat events, and establish a threat correlation matrix;

[0043] Based on the threat evolution pattern feature library and the threat correlation matrix, a threat state transition model is constructed using Markov chain theory; the threat state set is defined to include latent state, active state, diffusion state and decay state, and the transition probability matrix between each state is calculated;

[0044] Combining the threat state transition model and historical threat evolution data, a threat development trend prediction function is constructed using a long short-term memory neural network to output the probability of threat occurrence and the estimated threat intensity within a future time period;

[0045] An adaptive update mechanism for dynamic threat model parameters is established. When a new threat feature vector is received, an incremental learning algorithm is used to update the threat feature baseline database, the threat evolution pattern feature library, and the threat correlation matrix in real time. The update parameters are controlled by setting the model update threshold and update frequency.

[0046] As a preferred embodiment of the enterprise information security defense strategy generation method based on adaptive rule engine described in this invention, the threat level is classified into levels using a hierarchical threshold determination method, including:

[0047] If the comprehensive risk assessment score is greater than the high-risk threshold and the attack propagation depth value is greater than the security tolerance threshold of the network topology critical link, it is judged as a high-risk threat, and the emergency isolation strategy is immediately triggered, and traffic blocking and host isolation instructions are issued; if the attack propagation depth value is less than or equal to the security tolerance threshold of the network topology critical link, it is judged as a high-risk latent threat, and the host-level deep detection and suspicious connection cleanup program is initiated first, while a continuous monitoring task is generated.

[0048] If the comprehensive risk assessment score is greater than the medium-risk threshold but less than or equal to the high-risk threshold, and the lateral movement distance parameter is greater than the cross-domain migration threshold defined by the security policy, it is determined to be a medium-risk threat, triggering access control enhancement and cross-domain traffic rate limiting policies, and notifying the security operations center for manual review.

[0049] If the overall risk assessment score is less than or equal to the low-risk threshold, and the threat type cluster label matches the historical low-risk pattern, it is determined to be a low-risk threat. It is only recorded and continuously monitored, and no additional defensive actions are taken.

[0050] As a preferred embodiment of the enterprise information security defense strategy generation method based on adaptive rule engine described in this invention, the specific formula for the comprehensive risk assessment score is as follows:

[0051]

[0052] Among them, R j Let w be the comprehensive risk assessment score for the j-th threat event group, N be the number of dimensions in the threat feature vector, and w be the total risk score for the j-th threat event group. i Let be the weight coefficient of the i-th feature. Let b be the i-th eigenvalue of the j-th threat event group. i Let t′ be the time decay coefficient of the i-th dimension feature. i Let ε be the time difference between the i-th feature and the current time, m be the number of nodes in the network topology, and ε be the time difference between the i-th feature and the current time. k Let K be the influence coefficient of the k-th network node. Let δ represent the impact strength of the j-th threat event group on the k-th node, and let B be the attack success rate amplification factor. j P is the cumulative value of the attack success identifier for the j-th threat event group. j is the protection strength coefficient for the j-th threat event group.

[0053] In a second aspect, embodiments of the present invention provide a computer device, including a memory and a processor, wherein the memory stores a computer program, and the computer program instructions, when executed by the processor, implement the steps of the enterprise information security defense strategy generation method based on an adaptive rule engine as described in the first aspect of the present invention.

[0054] Thirdly, embodiments of the present invention provide a computer-readable storage medium having a computer program stored thereon, wherein: when the computer program instructions are executed by a processor, they implement the steps of the enterprise information security defense strategy generation method based on an adaptive rule engine as described in the first aspect of the present invention.

[0055] Compared with existing technologies, the beneficial effects of this invention are as follows: By collecting real-time security event data and historical attack behavior data in the enterprise network environment, and performing multi-dimensional feature vectorization processing on the real-time data, a unified set of threat feature vectors is constructed, realizing the structuring and standardization of security data; by using a dynamic threat model combined with cluster analysis, risk scores, scenario classifications, and level identifications are performed on threats, which can comprehensively depict the types, evolution trends, and propagation paths of threats, integrating scattered attack behaviors into manageable threat scenario units; the classification results are input into an adaptive rule engine to generate and dynamically adjust the defense rule set, ensuring that core defense rules are triggered and executed first when the threat situation changes, thereby realizing real-time optimization and self-adjustment of defense strategies; based on the adaptive defense rule set, a hierarchical enterprise information security defense strategy is generated, and the strategy deployment and conflict optimization are completed in combination with the network topology, realizing the division of labor and efficient linkage between multiple protection layers; this invention not only improves the accuracy and foresight of threat identification and risk assessment, but also ensures the dynamic adaptability of defense rules and the hierarchical accuracy of strategy deployment. Attached Figure Description

[0056] To more clearly illustrate the technical solutions of the embodiments of the present invention, the accompanying drawings used in the description of the embodiments will be briefly introduced below. Obviously, the drawings described below are only some embodiments of the present invention. For those skilled in the art, other drawings can be obtained based on these drawings without creative effort. Wherein:

[0057] Figure 1 A flowchart illustrating a method for generating enterprise information security defense strategies based on an adaptive rule engine. Detailed Implementation

[0058] To make the above-mentioned objects, features and advantages of the present invention more apparent and understandable, the specific embodiments of the present invention will be described in detail below with reference to the accompanying drawings.

[0059] Many specific details are set forth in the following description in order to provide a full understanding of the invention. However, the invention may also be practiced in other ways different from those described herein, and those skilled in the art can make similar extensions without departing from the spirit of the invention. Therefore, the invention is not limited to the specific embodiments disclosed below.

[0060] Secondly, the term "one embodiment" or "embodiment" as used herein refers to a specific feature, structure, or characteristic that may be included in at least one implementation of the present invention. The phrase "in one embodiment" appearing in different places in this specification does not necessarily refer to the same embodiment, nor is it a single or selective embodiment that is mutually exclusive with other embodiments.

[0061] As mentioned in the background section, existing enterprise information security strategy generation technologies are insufficient in terms of response speed, dynamic adjustment capability of rule priorities, and layered collaborative optimization, making it difficult to meet the defense needs in a dynamic threat environment. To address these issues, this invention provides an enterprise information security defense strategy generation method based on an adaptive rule engine.

[0062] Figure 1 This is a flowchart illustrating a method for generating enterprise information security defense strategies based on an adaptive rule engine according to an embodiment of the present invention. Figure 1 As shown, a method for generating enterprise information security defense strategies based on an adaptive rule engine includes:

[0063] S1: Collect real-time security event data and historical attack behavior data of the enterprise network environment, perform multi-dimensional feature vectorization processing on the real-time security event data, and generate a set of threat feature vectors;

[0064] S2: Based on the set of threat feature vectors, construct a dynamic threat model, calculate the risk assessment score of each threat feature vector, and perform cluster analysis on the threat feature vectors to generate threat scenario classification results and threat level identifiers;

[0065] S3: Input the threat scenario classification results into the adaptive rule engine to generate an initial defense rule set, and use a rule weight dynamic adjustment mechanism to modify the rule priority of the initial defense rule set in real time to form an adaptive defense rule set;

[0066] S4: Generate a hierarchical enterprise information security defense strategy based on the adaptive defense rule set and send it to the enterprise network.

[0067] In this embodiment of the application, step S1 includes:

[0068] Specifically, distributed data collection agents are deployed at various key nodes of the enterprise network, including firewalls, intrusion detection systems, terminal devices, and servers. The distributed data collection agents use lightweight protocols to establish communication connections with the central collector and continuously monitor security-related activities such as network traffic, system calls, and file access according to a unified timestamp format.

[0069] S1.1: Acquire real-time security event data through a distributed data acquisition agent, and simultaneously extract historical attack behavior data from the enterprise security event repository;

[0070] Preferably, real-time security event data includes network-level information such as source IP address, target IP port number, protocol type, packet size, and connection duration, as well as host-level information such as process name, file path, registry operation, and system service call; historical attack behavior data covers confirmed attack event records and their corresponding attack tags within the past 6 months, specifically including attack type code, attack duration, number of affected assets, and attack success identifier.

[0071] S1.2: Perform data cleaning and standardization on real-time security event data to form processed security event data;

[0072] In an optional implementation, the source IP address is converted to a 32-bit binary value; the attack type encoding is uniformly converted to a standard threat classification code; duplicate records are removed using a data deduplication algorithm; missing fields are filled using data completion technology; and the time format of different data sources is unified to the UTC standard time format.

[0073] S1.3: Based on the processed security event data, attack behaviors are grouped according to a unified threat event ID, and the attack frequency index, attack intensity coefficient, and attack persistence parameter of each threat event are calculated to construct a temporal feature matrix of attack behaviors;

[0074] Preferably, the specific formula for the attack behavior temporal feature matrix is ​​as follows:

[0075] A = [a j,t ] j＝1…J,t＝1…T

[0076]

[0077] Where A is the temporal feature matrix of attack behavior, a j,t Let J be the element in the j-th row and t-th column of the time-series feature matrix A, where J is the number of threat event groups, T is the number of time slots, and S is the element in the j-th row and t-th column of the time-series feature matrix A. jt Let Λ be the similarity factor scaled by the tanh function. j Let Int be the attack frequency index of the j-th threat event group. j Π is the attack strength coefficient for the j-th threat event group. j Let be the persistence parameter for the j-th threat event group, and the relevant formula is as follows:

[0078]

[0079] Where α is the time decay rate constant, Δ ij Let n be the time difference between the i-th record in the j-th threat event group and the right end of the time window. j Record the total number of events for the j-th threat event group within the window, Sij Let d be the data packet size of the i-th record in the j-th threat event group, β be the strength exponent, and d be the data packet size of the ith record in the j-th threat event group. ij γ is the connection duration of the i-th record in the j-th threat event group, K is the upper limit of the autocorrelation order, and γ k For the lag weight, ρ j (k) is the autocorrelation coefficient of the j-th threat event group at lag k.

[0080] It should be noted that Λ j ∈[0,∞): A larger value means that the event occurs more frequently per unit of time; Λ j =0= indicates that there are no event records in the window; Int j ∈[0,∞): A larger strength coefficient indicates a higher message volume or impact; Π j ∈[0,1): Values ​​closer to 1 indicate highly persistent / periodic attacks, while values ​​closer to 0 or negative values ​​indicate no persistence or randomness; S jt ∈(-1,1), after mapping Normalized gain representing vector similarity (close to 1 indicates a highly matched attack feature pattern); a j,t ∈[0,∞), which can usually be normalized to [0,1] for input into the rule engine; the larger this element is, the higher the overall harm of the j-th threat event group in time slot tt.

[0081] S1.4: Using the source IP address and target port number after grouping, combined with the network topology baseline data, generate a network topology attack path map, calculate the attack propagation depth value, lateral movement distance parameter and asset correlation coefficient, and obtain the attack space distribution feature set;

[0082] S1.5: Combining the attack frequency index, attack intensity coefficient, and attack success indicator, a weighted scoring algorithm is used to calculate the threat severity score, and the score is normalized according to the 0-1 range to generate a standardized threat level value.

[0083] In an optional implementation, the specific formula for the standardized threat level value is as follows:

[0084]

[0085] in, Let z be the relative normalized threat severity score for the j-th threat event group, τ be the scaling factor controlling the score distribution, and z be the relative normalized threat severity score for the j-th threat event group. j Let z be the risk incentive for the j-th threat event group. l This represents the risk incentive for the l-th threat event group.

[0086] S1.6: The attack behavior temporal feature matrix, attack spatial distribution feature set and standardized threat level values ​​are dimensionally aligned, and a feature fusion algorithm is used to combine various features into a unified multi-dimensional threat feature vector;

[0087] S1.7: Perform cluster analysis on multidimensional threat feature vectors, classify threat vectors with similar feature patterns into the same threat type cluster, and generate a set of threat feature vectors;

[0088] It should be noted that the threat feature vector set includes threat identifier codes, multidimensional threat feature vectors, and threat type cluster labels.

[0089] In this embodiment of the application, step S2 includes:

[0090] S2.1: Construct a dynamic threat model based on threat identification codes and multi-dimensional threat feature vectors from a set of threat feature vectors;

[0091] In an optional implementation, the dynamic threat model is constructed as follows: based on the threat identification code of the threat feature vector set, historical threat data is arranged in chronological order, and statistical baseline parameters of multidimensional threat feature vectors are extracted to establish a threat feature baseline database; a sliding time window analysis method is used to perform time-series analysis on the threat feature vector set to identify the change patterns of threat features in the time dimension; by calculating the similarity coefficient and change rate of threat feature vectors within adjacent time windows, the periodicity, trend, and suddenness patterns of threat evolution are extracted to form a threat evolution pattern feature library.

[0092] Specifically, a directed correlation graph between threat events is constructed based on the co-occurrence frequency and temporal correlation of threat identifier codes; a graph neural network algorithm is used to analyze the propagation path and influence intensity between threat event nodes, calculate the causal correlation coefficient and propagation probability between threat events, and establish a threat correlation matrix; based on the threat evolution pattern feature library and the threat correlation matrix, a threat state transition model is constructed using Markov chain theory; the threat state set is defined to include latent state, active state, diffusion state, and decay state, and the transition probability matrix between each state is calculated.

[0093] Furthermore, combining threat state transition models and historical threat evolution data, a threat development trend prediction function is constructed using a long short-term memory neural network. The threat prediction function takes the current threat feature vector as input and outputs the probability of threat occurrence and the estimated threat intensity within a future time period. An adaptive update mechanism for dynamic threat model parameters is established. When a new threat feature vector is received, an incremental learning algorithm is used to update the threat feature baseline database, the threat evolution pattern feature library, and the threat correlation matrix in real time. The update parameters are controlled by setting the model update threshold and update frequency.

[0094] S2.2: Based on the law of threat evolution, calculate the feature weight coefficients of each dimension of each multidimensional threat feature vector in the threat feature vector set;

[0095] It should be noted that the feature weight coefficients are quantified by analyzing the frequency of occurrence of threat identifier codes, the distribution density of threat type cluster labels, and the gradient of temporal feature changes in the threat feature vector set.

[0096] S2.3: Perform a weighted summation operation on the multidimensional threat feature vectors and feature weight coefficients to calculate the initial risk score of each threat feature vector and generate a comprehensive risk assessment score;

[0097] In an optional implementation, the specific formula for the comprehensive risk assessment score is as follows:

[0098]

[0099] Among them, R j Let w be the comprehensive risk assessment score for the j-th threat event group, N be the number of dimensions in the threat feature vector, and w be the total risk score for the j-th threat event group. i Let be the weight coefficient of the i-th feature. Let b be the i-th eigenvalue of the j-th threat event group. i Let t′ be the time decay coefficient of the i-th dimension feature. i Let ε be the time difference between the i-th feature and the current time, m be the number of nodes in the network topology, and ε be the time difference between the i-th feature and the current time. k Let K be the influence coefficient of the k-th network node. Let δ represent the impact strength of the j-th threat event group on the k-th node, and let B be the attack success rate amplification factor. j P is the cumulative value of the attack success identifier for the j-th threat event group. j is the protection strength coefficient for the j-th threat event group.

[0100] It should be noted that the range of the comprehensive risk assessment score formula is [0,1], where 0≤R j ≤0.3 indicates a low-risk threat, and conventional monitoring strategies should be used; 0.3 <R j ≤0.6 indicates a medium risk threat, requiring enhanced protective measures; 0.6 <R j A score of ≤1 indicates a high-risk threat, requiring the activation of an emergency response and the implementation of emergency isolation and comprehensive protection.

[0101] S2.4: The multidimensional threat feature vectors are numerically standardized, and the standardized threat feature vectors are clustered using an improved K-means clustering algorithm to obtain the threat feature clustering result matrix.

[0102] It should be noted that the numerical range standardization process maps the feature values ​​of each dimension to the interval [0,1]. Based on the distribution characteristics of the comprehensive risk assessment score, outlier detection and data smoothing are performed on the standardized threat feature vector. The improved K-means clustering algorithm adaptively determines the number of clusters according to the distribution density of the comprehensive risk assessment score. The threat feature clustering result matrix is ​​generated by iteratively calculating the Euclidean distance between the threat feature vector and the cluster center point.

[0103] S2.5: Based on the clustering results matrix of threat feature clustering, and combined with the threat type cluster labels of the threat feature vector set, construct a threat scenario mapping table;

[0104] In an optional implementation, the threat scenario mapping table is generated based on the clustering analysis and risk assessment results of the method of the present invention in an experimental environment. As shown in Table 1, it displays the differences of different threat types in key indicators such as comprehensive risk assessment score, attack propagation depth, lateral movement distance, and asset correlation. Experimental data shows that the present invention can accurately identify high-risk threats such as long-term APT attacks and botnet DDoS attacks through multi-dimensional feature fusion and adaptive rule engine, and generate a layered defense strategy in combination with risk quantification results to achieve dynamic optimal allocation of resources. At the same time, for low-risk behaviors such as low-frequency port scanning, only continuous monitoring is retained, thereby reducing operation and maintenance costs while ensuring the defense effect, demonstrating the advantages of accurate threat identification, scientific risk quantification, and intelligent strategy generation.

[0105] Table 1. Threat Scenario Mapping Table

[0106]

[0107] S2.6: Based on the threat scenario mapping table, each cluster is assigned to network penetration scenario, data leakage scenario, malicious code propagation scenario and denial-of-service attack scenario, respectively, to form a threat scenario classification result;

[0108] S2.7: Based on the comprehensive risk assessment score and threat scenario classification results, the threat level is divided into levels using a graded threshold determination method to generate threat assessment results.

[0109] In an optional implementation, based on historical distribution data of comprehensive risk assessment scores, preset thresholds are set, including high-risk, medium-risk, and low-risk thresholds. The high-risk threshold is a slight upward adjustment based on the P80 quantile of the score distribution, so that only 15% to 20% of the highest-risk events in the historical threat sample are classified as high-risk, ensuring that emergency resources are concentrated on the most destructive threats. The medium-risk threshold is the weighted median of the distribution mean and the P50 quantile, used to identify threats that require enhanced protection but do not yet need to be fully isolated. The low-risk threshold is fixed at the distribution mean minus one standard deviation, ensuring that low-frequency, low-impact threats remain under monitoring without consuming excessive defense resources.

[0110] Preferably, if the comprehensive risk assessment score is greater than the high-risk threshold and the attack propagation depth is greater than the security tolerance threshold of the network topology critical link, it is determined to be a high-risk threat, and an emergency isolation policy is immediately triggered, along with traffic blocking and host isolation instructions. If the attack propagation depth is less than or equal to the security tolerance threshold of the network topology critical link, it is determined to be a high-risk latent threat, and host-level deep detection and suspicious connection cleanup procedures are initiated first, while a continuous monitoring task is generated. If the comprehensive risk assessment score is greater than the medium-risk threshold but less than or equal to the high-risk threshold, and the lateral movement distance parameter is greater than the cross-domain migration threshold defined by the security policy, it is determined to be a medium-risk threat, and access control enhancement and cross-domain traffic rate limiting policies are triggered, and the security operations center is notified for manual review. If the comprehensive risk assessment score is less than or equal to the low-risk threshold, and the threat type cluster label matches a historical low-risk pattern, it is determined to be a low-risk threat, and only recording and continuous monitoring are performed without additional defensive actions.

[0111] In an optional implementation, if the threat status does not change in level for several consecutive analysis cycles, a policy adaptive adjustment mechanism is triggered to lower the rule weight corresponding to the threat in order to release defense resources; conversely, if the threat status upgrades to two or more levels in a short period of time, an emergency policy upgrade mechanism is triggered and the rule weight of the threat is locked to prevent it from being mistakenly downgraded.

[0112] It should be noted that each threat feature vector in the threat feature vector set is assigned a corresponding threat level identifier. The threat assessment result includes a threat identifier code, threat scenario classification result, and threat level identifier. The cross-domain migration threshold is determined based on the enterprise network topology and security domain partitioning strategy. Specifically, the physical distance, routing hop count, and data flow path between each security domain in the enterprise network are first obtained. Combined with the distribution of the shortest migration distance for malicious behavior in the cross-domain access history logs, the P75 quantile of this distribution is calculated. A correction coefficient is introduced based on the sensitivity of the business to cross-domain access to obtain the final cross-domain migration threshold. The security tolerance threshold is determined based on the interruptibility and business continuity requirements of the network topology's critical links. The business importance score, bandwidth utilization, and maximum tolerable hop count under historical attacks for each link node are first analyzed. The maximum acceptable attack propagation depth value under the condition that it does not affect the normal operation of core businesses is taken, and a security margin coefficient (e.g., 10%–20%) is introduced for downward adjustment, thus forming the security tolerance threshold.

[0113] In this embodiment of the application, step S3 includes:

[0114] Specifically, the network penetration scenario, data leakage scenario, malicious code propagation scenario, and denial-of-service attack scenario classified by the threat scenario classification results are matched with the preset defense rule templates in the adaptive rule engine to establish a mapping relationship table between threat scenarios and defense rule templates; the threat assessment results are input into the adaptive rule engine, and based on the threat level identifier, the corresponding rule parameter configurations are extracted from the defense rule templates and arranged according to the priority order of threat level.

[0115] In an optional implementation, an initial weight coefficient for each defense rule template is calculated based on the comprehensive risk assessment score and the attack propagation depth value; a weighted scoring algorithm is used to integrate the comprehensive risk assessment score, the attack propagation depth value, and the asset correlation coefficient to generate the basic weight value of the rule.

[0116] It should be noted that the defense rule templates include access control rule templates, traffic restriction rule templates, content filtering rule templates, and behavior monitoring rule templates. Based on the threat level identifiers corresponding to each defense rule in the initial defense rule set, a basic weight value is assigned to each defense rule in the initial defense rule set. The basic weight values ​​are assigned in a hierarchical manner: defense rules corresponding to high-risk levels are assigned a weight value of 0.8-1.0, defense rules corresponding to medium-risk levels are assigned a weight value of 0.4-0.7, and defense rules corresponding to low-risk levels are assigned a weight value of 0.1-0.3.

[0117] Furthermore, based on the rule parameter configuration and combined with the threat type cluster labels of the threat feature vector set, the attack frequency index, attack intensity coefficient, and lateral movement distance parameters are used as rule threshold parameters to generate defense rule entries and form an initial defense rule set.

[0118] It should be noted that the extracted rule parameter configuration is combined with the source IP address, target port number and protocol type identifier in the threat feature vector to generate an initial defense rule set containing rule number, rule type, trigger condition and processing action.

[0119] Furthermore, a dynamic adjustment mechanism for rule weights is established, which calculates the rule weight adjustment factor by monitoring the changing trends of threat level indicators in the threat assessment results and the fluctuations of the comprehensive risk assessment score.

[0120] It should be noted that when the threat level identifier remains stable for several consecutive analysis periods, the weight coefficient of the corresponding rule will be adjusted by attenuation; when the threat level identifier upgrades in a short period of time, the weight coefficient of the corresponding rule will be adjusted by enhancement. The rule weight adjustment factor is quantified by weighted fusion of threat urgency parameter, rule hit accuracy parameter and defense response timeliness parameter, and the value range is [0.5, 2.0].

[0121] Specifically, the basic weight value of each defense rule in the initial defense rule set is multiplied by the rule weight adjustment factor to obtain the corrected rule weight value, and the rule priority sequence is updated. Based on the rule priority sequence and the resource configuration constraints of the adaptive rule engine, the top F high-priority defense rules are selected from the initial defense rule set to form a core rule subset. The core rule subset and the remaining defense rules are organized hierarchically according to the corrected rule weight values ​​to form an adaptive defense rule set.

[0122] It should be noted that the updated rule priority sequence is based on the corrected rule weight values, and the defense rules in the initial defense rule set are arranged in descending order according to their weights; the adaptive defense rule set includes the adaptive defense rule sets of the core protection layer, the auxiliary protection layer, and the backup protection layer.

[0123] In this embodiment of the application, step S4 includes:

[0124] Preferably, enterprise information security defense strategies include access control rules, traffic monitoring thresholds, and response and handling actions.

[0125] Furthermore, based on the adaptive defense rule set, a hierarchical defense strategy is established, and access control rule entries are extracted. Based on the source IP address, target port number, and protocol type, the access control rule entries are configured hierarchically according to the threat level identifier to generate a hierarchical access control rule set.

[0126] In an optional implementation, based on the modified rule weight values ​​and rule priority sequences, the core protection layer is mapped to the enterprise network boundary protection layer, the auxiliary protection layer to the enterprise network internal protection layer, and the backup protection layer to the enterprise network terminal protection layer, thus generating a three-level defense hierarchy.

[0127] In an optional implementation, the hierarchical access control rule set is constructed by converting the source IP address into a network segment whitelist and blacklist configuration, combining the target port number and protocol type identifier to generate a port access permission matrix, and the access control rule set includes an IP access control list, port access policies, and protocol filtering conditions.

[0128] It should be noted that high-risk levels correspond to access denial rules, medium-risk levels correspond to access restriction rules, and low-risk levels correspond to monitoring access rules.

[0129] Furthermore, based on the attack frequency index, attack intensity coefficient, and lateral movement distance parameters, dynamic traffic monitoring threshold parameters are calculated to generate a set of traffic monitoring thresholds; based on the processing actions and threat level identifiers of the adaptive defense rule set, a response and handling action mapping table is constructed to generate a set of hierarchical response and handling actions.

[0130] In an optional implementation, the traffic monitoring threshold set is as follows: a threshold adaptive algorithm is used to fuse and analyze the comprehensive risk assessment score with historical traffic baseline data to generate a traffic monitoring threshold set that includes traffic rate threshold, connection quantity threshold and abnormal behavior detection threshold, and it is deployed in layers according to a three-level defense hierarchy.

[0131] In an optional implementation, the tiered response and handling action set is configured as follows: for high-risk threats, the handling action is configured as immediate blocking and isolation; for medium-risk threats, the handling action is configured as traffic restriction and alarm notification; and for low-risk threats, the handling action is configured as logging and continuous monitoring.

[0132] Specifically, policy conflict detection and optimization are performed on the hierarchical access control rule set, traffic monitoring threshold set, and graded response and handling action set; a rule compatibility analysis algorithm is used to detect policy conflicts between different protection layers, and conflicts are resolved through policy priority adjustment and rule merging optimization methods to generate a hierarchical enterprise information security defense strategy.

[0133] Furthermore, based on the enterprise network topology and hierarchical defense strategy, a policy deployment mapping scheme is generated, and the hierarchical enterprise information security defense strategy is pushed to each protection device in batches through the security management center, generating a policy deployment status report.

[0134] In an optional implementation, the defense policies corresponding to the enterprise network boundary protection layer are deployed to firewall and gateway devices, the defense policies corresponding to the enterprise network internal protection layer are deployed to switch and router devices, and the defense policies corresponding to the enterprise network terminal protection layer are deployed to terminal security software and host protection systems.

[0135] In an optional implementation, a policy delivery status monitoring mechanism is established to record the policy reception status, policy effective time, and policy execution feedback of each device, generate a policy deployment status report, and perform retry push and abnormal alarm handling for devices that fail to deliver policies.

[0136] In summary, this invention collects real-time security event data and historical attack behavior data in the enterprise network environment, and performs multi-dimensional feature vectorization processing on the real-time data to construct a unified set of threat feature vectors, thus achieving the structuring and standardization of security data. Utilizing a dynamic threat model combined with cluster analysis, it calculates risk scores, classifies scenarios, and identifies levels of threats, comprehensively depicting threat types, evolution trends, and propagation paths, integrating dispersed attack behaviors into manageable threat scenario units. The classification results are input into an adaptive rule engine to generate and dynamically adjust the defense rule set, ensuring that core defense rules are triggered and executed first when the threat situation changes, thereby achieving real-time optimization and self-adjustment of the defense strategy. Based on the adaptive defense rule set, a hierarchical enterprise information security defense strategy is generated, and combined with network topology, strategy deployment and conflict optimization are completed, achieving division of labor and efficient linkage among multiple protection layers. This invention improves the accuracy and foresight of threat identification and risk assessment, while ensuring the dynamic adaptability of defense rules and the hierarchical accuracy of strategy deployment.

[0137] This embodiment also provides a computer device applicable to the enterprise information security defense strategy generation method based on an adaptive rule engine, including a memory and a processor; the memory is used to store computer-executable instructions, and the processor is used to execute the computer-executable instructions to implement the enterprise information security defense strategy generation method based on an adaptive rule engine as proposed in the above embodiment.

[0138] The computer device can be a terminal, comprising a processor, memory, communication interface, display screen, and input devices connected via a system bus. The processor provides computing and control capabilities. The memory includes non-volatile storage media and internal memory. The non-volatile storage media stores the operating system and computer programs. The internal memory provides an environment for the operation of the operating system and computer programs stored in the non-volatile storage media. The communication interface is used for wired or wireless communication with external terminals; wireless communication can be achieved through Wi-Fi, carrier networks, NFC (Near Field Communication), or other technologies. The display screen can be an LCD screen or an e-ink screen. The input devices can be a touch layer covering the display screen, buttons, a trackball, or a touchpad on the computer device's casing, or an external keyboard, touchpad, or mouse.

[0139] It should be noted that the above embodiments are only used to illustrate the technical solutions of the present invention and are not intended to limit it. Although the present invention has been described in detail with reference to preferred embodiments, those skilled in the art should understand that modifications or equivalent substitutions can be made to the technical solutions of the present invention without departing from the spirit and scope of the technical solutions of the present invention, and all such modifications or substitutions should be covered within the scope of the claims of the present invention.

Claims

1. A method for generating enterprise information security defense strategies based on an adaptive rule engine, characterized in that: include, Collect real-time security event data and historical attack behavior data of the enterprise network environment, and perform multi-dimensional feature vectorization processing on the real-time security event data to generate a set of threat feature vectors; Based on the set of threat feature vectors, a dynamic threat model is constructed, the risk assessment score of each threat feature vector is calculated, and cluster analysis is performed on the threat feature vectors to generate threat scenario classification results and threat level identifiers. The threat scenario classification results are input into the adaptive rule engine to generate an initial defense rule set. The rule priority of the initial defense rule set is then modified in real time through a rule weight dynamic adjustment mechanism to form an adaptive defense rule set. Based on the adaptive defense rule set, a hierarchical enterprise information security defense strategy is generated and sent to the enterprise network.

2. The enterprise information security defense strategy generation method based on an adaptive rule engine as described in claim 1, characterized in that: Based on the adaptive defense rule set, a hierarchical enterprise information security defense strategy is generated and sent to the enterprise network, including: Based on the adaptive defense rule set, a hierarchical defense strategy is established, and access control rule entries are extracted. Based on the source IP address, target port number, and protocol type, the access control rule entries are configured hierarchically according to the threat level identifier to generate a hierarchical access control rule set; Based on the attack frequency index, attack intensity coefficient and lateral movement distance parameter, calculate the dynamic traffic monitoring threshold parameter and generate a set of traffic monitoring thresholds; Based on the processing actions and threat level identifiers of the adaptive defense rule set, a response and handling action mapping table is constructed to generate a hierarchical set of response and handling actions; The hierarchical access control rule set, the traffic monitoring threshold set, and the hierarchical response and handling action set are subjected to policy conflict detection and optimization. A rule compatibility analysis algorithm is used to detect policy conflicts between different protection layers. Conflicts are resolved by policy priority adjustment and rule merging optimization methods to generate a hierarchical enterprise information security defense strategy. Based on the enterprise network topology and hierarchical defense strategy, a policy deployment mapping scheme is generated, and the hierarchical enterprise information security defense strategy is pushed to each protection device in batches through the security management center, generating a policy deployment status report.

3. The enterprise information security defense strategy generation method based on an adaptive rule engine as described in claim 2, characterized in that: The adaptive defense rule set includes a core protection layer, an auxiliary protection layer, and a backup protection layer; the hierarchical defense strategy includes a first-level defense strategy layer, a second-level defense strategy layer, and a third-level defense strategy layer; the core protection layer corresponds to the enterprise network boundary protection layer; the auxiliary protection layer corresponds to the enterprise network internal protection layer; and the backup protection layer corresponds to the enterprise network terminal protection layer.

4. The enterprise information security defense strategy generation method based on an adaptive rule engine as described in claim 3, characterized in that: The method for generating the adaptive defense rule set is as follows: The network penetration scenario, data leakage scenario, malicious code propagation scenario and denial-of-service attack scenario classified by the threat scenario classification results are matched with the preset defense rule templates in the adaptive rule engine to establish a mapping relationship table between threat scenarios and defense rule templates; The threat assessment results are input into the adaptive rule engine, which extracts the corresponding rule parameter configurations from the defense rule template based on the threat level identifier and arranges them according to the priority of threat level. Based on the rule parameter configuration, combined with the threat type cluster label of the threat feature vector set, the attack frequency index, attack intensity coefficient and lateral movement distance parameters are used as rule threshold parameters to generate defense rule entries and form an initial defense rule set; Establish a dynamic adjustment mechanism for rule weights, and calculate the rule weight adjustment factor by monitoring the changing trend of threat level indicators in threat assessment results and the fluctuation of comprehensive risk assessment scores; The base weight value of each defense rule in the initial defense rule set is multiplied by the rule weight adjustment factor to obtain the corrected rule weight value, and the rule priority sequence is updated. Based on the rule priority sequence and the resource configuration constraints of the adaptive rule engine, the first F high-priority defense rules are selected from the initial defense rule set to form a core rule subset; The core rule subset and the remaining defense rules are organized hierarchically according to the modified rule weight values ​​to form an adaptive defense rule set.

5. The enterprise information security defense strategy generation method based on an adaptive rule engine as described in claim 4, characterized in that: The method for generating the threat scenario classification results and threat level identifiers is as follows: A dynamic threat model is constructed based on threat identifier codes and multidimensional threat feature vectors from a set of threat feature vectors. Based on the laws of threat evolution, the feature weight coefficients of each dimension of each multidimensional threat feature vector in the threat feature vector set are calculated; The multidimensional threat feature vectors are weighted and summed with the feature weight coefficients to calculate the initial risk score for each threat feature vector and generate a comprehensive risk assessment score. The multidimensional threat feature vectors are numerically standardized, and an improved K-means clustering algorithm is used to perform cluster analysis on the standardized threat feature vectors to obtain a threat feature clustering result matrix. Based on the clustering of the threat feature clustering result matrix, and combined with the threat type cluster labels of the threat feature vector set, a threat scenario mapping table is constructed. Based on the threat scenario mapping table, each cluster is assigned to network penetration scenario, data leakage scenario, malicious code propagation scenario and denial-of-service attack scenario, respectively, to form a threat scenario classification result; Based on the comprehensive risk assessment score and the threat scenario classification results, a graded threshold determination method is used to classify the threat level and generate a threat assessment result.

6. The enterprise information security defense strategy generation method based on an adaptive rule engine as described in claim 5, characterized in that: The method for constructing the dynamic threat model is as follows: Based on the threat identification code of the threat feature vector set, historical threat data are arranged in chronological order, statistical baseline parameters of multidimensional threat feature vectors are extracted, and a threat feature baseline database is established. A sliding time window analysis method is used to perform time series analysis on the threat feature vector set to identify the change patterns of threat features in the time dimension. By calculating the similarity coefficient and rate of change of threat feature vectors within adjacent time windows, the periodicity, trend, and suddenness of threat evolution are extracted to form a threat evolution pattern feature library. Based on the co-occurrence frequency and temporal correlation of the threat identification codes, a directed correlation graph between threat events is constructed; a graph neural network algorithm is used to analyze the propagation path and influence intensity between threat event nodes, calculate the causal correlation coefficient and propagation probability between threat events, and establish a threat correlation matrix; Based on the threat evolution pattern feature library and the threat correlation matrix, a threat state transition model is constructed using Markov chain theory; the threat state set is defined to include latent state, active state, diffusion state and decay state, and the transition probability matrix between each state is calculated; Combining the threat state transition model and historical threat evolution data, a threat development trend prediction function is constructed using a long short-term memory neural network to output the probability of threat occurrence and the estimated threat intensity within a future time period; An adaptive update mechanism for dynamic threat model parameters is established. When a new threat feature vector is received, an incremental learning algorithm is used to update the threat feature baseline database, the threat evolution pattern feature library, and the threat correlation matrix in real time. The update parameters are controlled by setting the model update threshold and update frequency.

7. The enterprise information security defense strategy generation method based on an adaptive rule engine as described in claim 5, characterized in that: Threat levels are classified into different levels using a tiered threshold determination method, including: If the comprehensive risk assessment score is greater than the high-risk threshold and the attack propagation depth value is greater than the security tolerance threshold of the network topology critical link, it is judged as a high-risk threat, and the emergency isolation strategy is immediately triggered, and traffic blocking and host isolation instructions are issued; if the attack propagation depth value is less than or equal to the security tolerance threshold of the network topology critical link, it is judged as a high-risk latent threat, and the host-level deep detection and suspicious connection cleanup program is initiated first, while a continuous monitoring task is generated. If the comprehensive risk assessment score is greater than the medium-risk threshold but less than or equal to the high-risk threshold, and the lateral movement distance parameter is greater than the cross-domain migration threshold defined by the security policy, it is determined to be a medium-risk threat, triggering access control enhancement and cross-domain traffic rate limiting policies, and notifying the security operations center for manual review. If the overall risk assessment score is less than or equal to the low-risk threshold, and the threat type cluster label matches the historical low-risk pattern, it is determined to be a low-risk threat. It is only recorded and continuously monitored, and no additional defensive actions are taken.

8. The enterprise information security defense strategy generation method based on an adaptive rule engine as described in claim 7, characterized in that: The specific formula for the comprehensive risk assessment score is as follows: Among them, R j Let w be the comprehensive risk assessment score for the j-th threat event group, N be the number of dimensions in the threat feature vector, and w be the total risk score for the j-th threat event group. i Let be the weight coefficient of the i-th feature. Let b be the i-th eigenvalue of the j-th threat event group. i Let t be the time decay coefficient of the i-th dimension feature. ′ i Let ε be the time difference between the i-th feature and the current time, m be the number of nodes in the network topology, and ε be the time difference between the i-th feature and the current time. k Let K be the influence coefficient of the k-th network node. Let δ represent the impact strength of the j-th threat event group on the k-th node, and let B be the attack success rate amplification factor. j P is the cumulative value of the attack success identifier for the j-th threat event group. j is the protection strength coefficient for the j-th threat event group.

9. A computer device comprising a memory and a processor, wherein the memory stores a computer program, characterized in that: When the processor executes the computer program, it implements the steps of the enterprise information security defense strategy generation method based on the adaptive rule engine as described in any one of claims 1 to 8.

10. A computer-readable storage medium having a computer program stored thereon, characterized in that: When the computer program is executed by the processor, it implements the steps of the enterprise information security defense strategy generation method based on the adaptive rule engine as described in any one of claims 1 to 8.

Images