Method and system for dynamically optimizing firewall access control strategy based on cooperation of flow analysis and large language model

Abstract

The invention relates to a firewall access control strategy dynamic optimization method and system based on cooperation of flow analysis and a large language model, and aims to solve the problems of rule expansion, low matching efficiency and operation and maintenance lag of a traditional static ACL strategy. The method comprises the following steps: collecting and analyzing network traffic and generating a rule hit log; standardizing the multi-manufacturer ACL strategy into structured data; performing semantic analysis by using a large language model, and constructing a strategy semantic knowledge graph; fusing the traffic behavior characteristics and semantic information, and generating an optimization strategy through a dual-drive model; the optimization feasibility is simulated, verified and evaluated; and deploying an optimization strategy and monitoring feedback to form closed-loop dynamic optimization. According to the method, rule combination, redundancy elimination and high-frequency rule preposition are realized through traffic behavior and large model semantics dual driving, the average matching frequency is reduced by more than 40%, and the forwarding delay is reduced by 30%-50%; and strategy dynamic reconstruction is supported to adapt to network changes, so that the operation and maintenance efficiency and the strategy effectiveness are remarkably improved.

Description

Technical Field

[0001] This application relates to the field of firewall access control technology, and in particular to a method, system, computer-readable storage medium, and electronic device for dynamic optimization of firewall access control policies based on traffic parsing and large language model collaboration. Background Technology

[0002] Traditional firewalls typically use static configuration for Access Control Lists (ACLs). ACLs determine whether to allow or block network traffic by sequentially matching five-tuple rules (source / destination IP, source / destination port, protocol number) locally on the device. However, with continuous business evolution, system expansion, and extended policy lifecycles, static ACLs reveal the following four structural flaws: First, the problem of policy expansion and redundancy is prominent. Affected by factors such as continuous iteration of business systems and dynamic changes in security requirements, the number of ACL rules has been growing continuously. Among them, a large number of rules have not been triggered by any traffic matching for a long time due to business function adjustments, interface changes, or evolution of threat scenarios (i.e., forming "policy zombies"). This has led to a significant increase in the proportion of redundant rules in the rule base, which not only occupies device storage resources but also increases management complexity.

[0003] Secondly, rule matching efficiency decreases significantly with scale. Traditional ACLs use a sequential matching mechanism, requiring a single data packet to traverse all rules in the rule base until a match is found or the traversal is complete. As the number of rules increases exponentially, the average matching latency of data packets increases linearly, directly limiting the firewall's forwarding performance for high-throughput network traffic, especially in ultra-large-scale network environments.

[0004] Third, policy configuration lacks verification and optimization basis based on actual traffic behavior. Existing ACL policies are mostly based on security requirement documents or initial configuration by human experience, without establishing a dynamic correlation mechanism with actual network traffic behavior characteristics. It is difficult to verify whether the policy covers real risk scenarios, whether there is over-protection or blind spots, and thus the effectiveness of the policy cannot be continuously calibrated through actual operation data.

[0005] Fourth, manual maintenance lacks timeliness and accuracy. Faced with tens of thousands to hundreds of thousands of rules, manual auditing struggles to continuously track the real-time matching status, traffic coverage, and business relevance of each rule. It cannot promptly identify and clean up redundant rules or adjust ineffective policies, resulting in a long-term discrepancy between the policy library and actual network security needs.

[0006] In summary, the "configure-forget" model of static ACLs can no longer meet the requirements of agile, accurate, and efficient security policies in cloud and microservice environments. There is an urgent need to introduce a dynamic policy optimization mechanism based on actual traffic behavior and intelligent analysis. Summary of the Invention

[0007] To address the aforementioned issues, this application proposes a novel method and system for dynamically optimizing firewall access control policies based on the collaboration of traffic parsing and large language models.

[0008] Specifically, this application provides the following technical solutions: The first aspect of this application provides a method for dynamically optimizing firewall access control policies based on the collaboration of traffic parsing and large language models, the method comprising: S1: Collect network traffic and analyze communication behavior and rule hit status, extract traffic behavior characteristics and generate ACL rule hit logs; S2: Obtain the current Access Control List (ACL) policy set of the firewall and perform standardization processing, convert it into structured policy data and clean the comment text; S3: Use a large language model to perform semantic analysis on the standardized ACL policy and generate a policy semantic knowledge graph; S4: Integrate traffic behavior characteristics and policy semantic information to generate an optimized set of access control policies based on a dual-drive model; S5: Perform simulation verification and risk assessment on the access control policy optimization set generated in the previous step to determine the feasibility of the optimization strategy; S6: Deploy a validated set of optimized access control policies, monitor their operation and collect feedback information to achieve closed-loop dynamic optimization.

[0009] Optionally, in the method of this application, step S1 includes: S11: Deploy data plane probes in front of and behind core switches or firewalls to capture network traffic using eBPF / XDP technology; S12: Select sampling mode or full capture based on the characteristics of captured network traffic, supporting IPv4 / IPv6, TCP / UDP / ICMP protocol stack; S13: Parse the captured data packets and extract the basic 5-tuple, session-level features, behavioral features, and application layer identifiers; S14: Based on the firewall log interface or bypass mirror traffic comparison, record the matching time window, matching number and matching traffic characteristics of each ACL rule, and generate an ACL rule hit log containing rule ID, matching number and matching traffic characteristics.

[0010] Optionally, in the method of this application, step S13 is described as follows: The basic 5-tuple includes: source IP, destination IP, source port, destination port, and protocol type; Session-level characteristics include: connection time, duration, and number of bytes; Behavioral characteristics include: frequency of visits, suddenness, and periodicity; Application layer identifiers include: application types identified by DPI.

[0011] Optionally, in the method of this application, step S2 includes: S21: Collect ACL policies from multi-vendor network devices (Huawei / H3C, Cisco ASA, Palo Alto, Fortinet, etc.) via standardized APIs (such as NETCONF / YANG, REST API, Panorama API); S22: Map heterogeneous ACL policy fields to a standard structure, including rule ID, source IP / CIDR, destination IP, source port, destination port, protocol, action, priority, effective time, and description fields; S23: Clean the policy fields, separate technical parameters from business descriptions, extract keywords (department, system, purpose, etc.), and generate a structured, standardized ACL policy set JSON file.

[0012] Optionally, in the method of this application, the semantic analysis of the standardized ACL policy using a large language model in step S3 includes semantic analysis of the description field and standard structure field of the standardized policy, performing the following tasks: (1) Intent recognition: Based on the policy description and field information, output business intent tags containing subject, object and action; (2) Entity normalization: Map IP addresses and port numbers to business entity names (such as "Finance Department Office Network" and "ERP Application Server"). (3) Semantic equivalence judgment: Identify rules with highly similar semantics (such as rules with different source IPs but pointing to the same business entity); (4) Construct a strategy semantic knowledge graph with “subject-action-object” as the core, which includes nodes and edges; wherein the nodes include user groups, servers and services, and the edges include access relationships and dependency paths.

[0013] Optionally, in the method of this application, step S4 further includes: establishing a "behavior-semantic joint decision matrix", integrating traffic behavior features (such as silence rules, high-frequency rules, path overlap) and semantic analysis results (such as intent tags, entity mapping, semantic similarity), judging the feasibility of optimization, and performing the following optimization operations: (1) Redundant rule merging: For rules with continuous / aggregable source IPs, the same destination port, consistent actions and semantics, the CIDR aggregation algorithm is used to merge IP segments; (2) Dead rules: Rules that have no matching records and no periodic characteristics within a specified period of time are marked as "to be frozen" and deleted after confirmation; (3) High-frequency rules are prioritized: The top rules are arranged in descending order of matching frequency and promoted to the front of the strategy. The priority logic is kept consistent through topological sorting. (4) Strategy grouping optimization: Automatically group by business system, insert grouping annotation headers and export as modular strategy templates.

[0014] Optionally, in the method of this application, the simulation verification and risk assessment in step S5 includes: (1) Construct a lightweight policy simulation sandbox, load the original policy set and the optimized policy set; input historical real traffic replay (pcap replay) and synthetic boundary traffic (fuzz test). (2) Compare the decision results (allow / reject) of each traffic flow under the original strategy and the optimized strategy, and calculate the decision difference rate (PDR). The PDR should not be greater than 0%. (3) Calculate key performance indicators (total number of rules, average number of matching times, expected forwarding delay, CPU load, etc.) before and after optimization, and generate a policy change impact assessment report including functional consistency, performance improvement and risk level.

[0015] Optionally, in the method of this application, step S6 includes: S61: Adopts a canary release strategy, first deploying the optimization strategy in non-core areas (such as the test area), and then pushing it to the production environment after monitoring for a specified period without any anomalies; automatically backs up old strategies and supports one-click rollback; S62: Real-time monitoring of network device performance metrics (CPU utilization, memory usage, PPS) and service availability (critical service health checks); proactive collection of user complaint tickets and security log alerts; S63: Feeds deployment results, business feedback, and performance changes back to the large language model, updates the optimization suggestion generation strategy, and forms a closed loop of "perception → optimization → verification → deployment → learning".

[0016] A second aspect of this application provides a firewall access control policy dynamic optimization system based on the collaboration of traffic parsing and large language model, the system comprising: The traffic collection and parsing module is used to collect network traffic, parse communication behavior and rule hit status, extract traffic behavior features, and generate ACL rule hit logs. The policy standardization module is used to obtain the current access control list (ACL) policy set of the firewall and perform standardization processing, converting it into structured policy data and cleaning the comment text; The semantic analysis module is used to perform semantic analysis on the standardized ACL policy using a large language model and generate a policy semantic knowledge graph. The optimization strategy generation module is used to integrate traffic behavior characteristics and policy semantic information to generate an optimized set of access control policies based on a dual-drive model. The verification and evaluation module is used to perform simulation verification and risk assessment on the optimized access control policy set to determine the feasibility of the optimization policy. The deployment feedback module is used to deploy a validated set of optimized access control policies, monitor their operation status, and collect feedback information to achieve closed-loop dynamic optimization.

[0017] The system implements the steps of the aforementioned dynamic optimization method for firewall access control policies based on traffic parsing and large language model collaboration during runtime.

[0018] A third aspect of this application provides an electronic device, including: a memory and a processor; Memory: Used to store computer programs; Processor: Used to execute the computer program to implement the steps of the aforementioned method for dynamically optimizing firewall access control policies based on traffic parsing and large language model collaboration.

[0019] A fourth aspect of this application provides a computer-readable storage medium having a computer program stored thereon, wherein when the computer program is executed by a processor, it implements the steps of the aforementioned method for dynamically optimizing firewall access control policies based on traffic parsing and large language model collaboration.

[0020] In summary, this application, through innovative technological improvements, has achieved significant performance enhancements and operational model innovations in the field of firewall access control policy optimization. Its core advantages are as follows: (1) A breakthrough improvement in forwarding performance is achieved through policy optimization based on a dual-drive model of "traffic behavior + large-scale model semantics". Addressing the problems of rule bloat and low matching efficiency caused by static configuration in traditional ACL policies, this application overcomes the limitations of static rule compression by constructing a dual-drive policy optimization model of "traffic behavior + large-scale model semantics". On the one hand, the model deeply analyzes historical and real-time traffic behavior characteristics (such as the distribution of source / destination addresses, protocol types, and access time patterns of traffic), accurately identifying high-frequency matching rules and inefficient redundant rules (i.e., long-term unmatched "policy zombies"). On the other hand, relying on the semantic understanding capabilities of the large-scale language model, semantic-level analysis is performed on the logical relationships and coverage between rules (such as rule inclusion, conflict, and business semantic relevance), thereby proposing targeted strategies such as rule merging and sorting optimization. Experimental data shows that this dual-drive model can reduce the average number of packet matches by more than 40% and reduce forwarding latency by 30%~50%, significantly improving the firewall's forwarding performance in high-throughput scenarios.

[0021] (2) The dynamic intent reconstruction mechanism drives the leap from "static adaptation" to "proactive evolution" in policy optimization. Unlike traditional static rule compression, which only focuses on local optimization of the current rule set, this application proposes the core improvement of "dynamic intent reconstruction." By continuously tracking the dynamic changes in network traffic (such as new traffic types brought about by business expansion and access pattern adjustments caused by threat evolution), and combining the intelligent inference of traffic behavior intent by the large model (such as identifying legitimate access requests of emerging businesses and detecting potential risk intents of abnormal traffic), the proactive reconstruction and dynamic optimization of the policy library are achieved. This mechanism enables firewall policies to adapt to changes in the network environment, avoids the policy failure problem caused by the lag in traditional manual auditing, and ensures that the policy library always keeps pace with actual security needs.

[0022] (3) An interpretable, verifiable, and closed-loop intelligent operation and maintenance mechanism to build full lifecycle management capabilities for security policy optimization. This application uses the semantic generation capabilities of a large language model to transform the abstract policy optimization process into understandable natural language suggestions (such as clearly indicating "Rule A and Rule B have an inclusion relationship, and it is recommended to merge them to reduce redundancy"), solving the problem of lack of interpretability caused by the "black box operation" of traditional optimization schemes; at the same time, the policy verification module built into the model can quantitatively evaluate the coverage, protection effect, and performance impact of the optimized policy based on traffic simulation and real environment testing (such as verifying whether the merged rules omit key traffic and whether the sorting adjustment reduces matching latency), forming a closed-loop mechanism of "optimization suggestion - effect verification - iterative implementation". This mechanism not only improves operation and maintenance efficiency, but also realizes the leap from "single adjustment" to "full lifecycle intelligent management" of policy optimization through continuous learning and feedback.

[0023] In summary, this application achieves a systematic breakthrough in three dimensions—performance enhancement, dynamic adaptability, and intelligent operation and maintenance—through deep integration of technological improvements, providing an innovative solution for firewall policy optimization in highly complex network environments.

[0024] Other features and advantages of this application will be set forth in detail in the following description, or will become apparent through the implementation of the relevant technical solutions of this application. The objectives and other advantages of this application can be achieved through the technical features and means explicitly pointed out in the description, claims, and drawings, and will be obtained through the implementation of these technical contents. Attached Figure Description

[0025] To more clearly illustrate the technical solutions of this application, the accompanying drawings involved in the description of the embodiments will be briefly introduced below. It should be noted that the drawings only show some embodiments of this application. For those skilled in the art, other related drawings can be derived from these drawings without creative effort.

[0026] Figure 1 This is a flowchart illustrating the implementation of the dynamic optimization method for firewall access control policies based on the collaboration of traffic parsing and large language models in this application.

[0027] Figure 2 This is a diagram illustrating the overall design architecture of the firewall access control policy dynamic optimization method provided in this application embodiment.

[0028] Figure 3 This is a structural diagram of the firewall access control policy dynamic optimization system based on the collaboration of traffic parsing and large language model in this application.

[0029] Figure 4 This is a schematic diagram of the structure of an electronic device provided in an embodiment of this application. Detailed Implementation

[0030] To make the objectives, technical solutions, and advantages of the embodiments of this application clearer, the technical solutions of the embodiments of this application will be clearly and completely described below with reference to the accompanying drawings. It should be noted that the described embodiments are only some embodiments of this application, and not all embodiments. All other embodiments obtained by those skilled in the art based on the embodiments of this application without creative effort are within the protection scope of this application.

[0031] In this document, the term "comprising" and any variations thereof (such as "including," "including," etc.) are open-ended expressions and should be understood as "including but not limited to," meaning that the listed content is not exhaustive and may include other content not explicitly mentioned. The term "based on" should be understood as "at least partially based on," meaning that the basis or condition referred to may not be the only factor and may involve other relevant factors. The term "one embodiment" should be understood as "at least one embodiment," meaning that the described embodiment is not the only possible implementation, and other similar embodiments may exist.

[0032] In this application, the terms "a" and "a plurality of" are used to modify related elements or features, and their expression is illustrative rather than restrictive. Unless otherwise expressly stated in the context, "a" should be understood as "at least one," and "a plurality of" should be understood as "at least two." Those skilled in the art should reasonably interpret these terms based on the semantic and logical relationships of the context to ensure that they cover the possibility of "one or more."

[0033] Figure 1 The following is the implementation flow of the firewall access control policy dynamic optimization method based on traffic parsing and large language model collaboration proposed in this application, including the following steps: S1: Collect network traffic and analyze communication behavior and rule hit status, extract traffic behavior characteristics and generate ACL rule hit logs; S2: Obtain the current Access Control List (ACL) policy set of the firewall and perform standardization processing, convert it into structured policy data and clean the comment text; S3: Use a large language model to perform semantic analysis on the standardized ACL policy and generate a policy semantic knowledge graph; S4: Integrate traffic behavior characteristics and policy semantic information to generate an optimized set of access control policies based on a dual-drive model; S5: Perform simulation verification and risk assessment on the access control policy optimization set generated in the previous step to determine the feasibility of the optimization strategy; S6: Deploy a validated set of optimized access control policies, monitor their operation and collect feedback information to achieve closed-loop dynamic optimization.

[0034] To more clearly illustrate the technical solution of this application, the following will provide further explanation through specific scenario embodiments.

[0035] Figure 2 The diagram shows the overall design architecture of the firewall access control policy dynamic optimization method in this embodiment, and its implementation process is as follows: Step 1: Real-time collection of network traffic and analysis of communication behavior and rule matching status 1.1 Selection and Deployment of Traffic Collection Methods Deploy data plane probes with eBPF / XDP capabilities (such as eBPF programs running in Linux kernel mode) in front of and behind core switches or firewalls to capture network traffic.

[0036] For high-throughput scenarios, a sampling mode (e.g., sampling at a ratio of 1:1000) can be used; full capture can be enabled for critical areas (e.g., DMZ, database area). It needs to support multiple network protocol stacks: such as IPv4 / IPv6, TCP / UDP / ICMP, etc.

[0037] 1.2 Flow Feature Extraction and Five-Tument Settlement Perform deep parsing on the captured data packets to extract the following information: The basic 5-tuple: source IP, destination IP, source port, destination port, protocol type; Session-level characteristics: connection establishment / closure time, duration, number of bytes, number of packets, direction (in / out); Behavioral characteristics: access frequency (connections per second), burst pattern, periodicity (such as access time characteristics); Application layer identification: Identify application types (such as "MySQL" or "Microsoft RDP") through DPI (Deep Packet Inspection).

[0038] For example, a server 100.1.1.1:1521 is frequently accessed by clients from 192.168.1.0 / 24 between 9:00 and 10:00 every day, with an average of about 100 TCP connections initiated per minute for about 3 minutes. This can be preliminarily identified as an "ERP system scheduled synchronization task".

[0039] 1.3 Constructing ACL rule hit logs Use the firewall's built-in log interface (such as Syslog, NetStream, IPFIX) or bypass mirror traffic comparison to record the actual matching status of each ACL rule.

[0040] Log fields include: (1) Rule ID / Sequence Number; (2) Matching time window (e.g., statistics are collected every 5 minutes); (3) Number of matches; (4) Match traffic characteristics (source / destination IP range, port range, protocol).

[0041] 1.4 Optimized Point Recognition Preliminary analysis based on historical traffic data: Silent rule identification: Custom rules that match 0 times within 7 consecutive days are marked as "suspected redundancy"; High-frequency rule identification: Rules that match more than a threshold number of times per unit time (e.g., >1000 times / hour) are marked as "hotspot rules"; Path overlap detection: If multiple rules cover the same IP segment and port combination (e.g., three rules allow 192.168.1.10, 192.168.1.11, and 192.168.1.12 to access 10.20.30.50:80 respectively), the message "can be merged" will be displayed. Output: Generates a "Traffic Behavior Profile Report", which includes a heatmap of each rule's hit, a list of silent rules, a list of high-frequency rules, and potential merging suggestions.

[0042] Step 2: Obtain and standardize the current ACL policy set of the firewall. 2.1 Multi-vendor policy data collection interface adaptation Pull ACL policies from mainstream network devices using standardized APIs, for example: Huawei / H3C: NETCONF / YANG model; Cisco ASA / Firepower: REST API or CLI + regular expression parsing; Palo Alto: Panorama API; Fortinet: FortiOS API; Batch collection of node policies from multiple network devices.

[0043] 2.2 Strategy Field Standardization and Structure Transformation The heterogeneous strategy is uniformly mapped to the standard structure shown in the table below: Table 1. Examples of Standard Structures

[0044] 2.3 Annotated Text Cleaning and Context Extraction Preprocess the description field: remove garbled characters and special symbols; Separate technical parameters from business descriptions (e.g., "[IT Operations][Emergency] Temporary RDP Activation"). Extract keywords: department (finance, HR), system (ERP, OA), purpose (backup, monitoring), etc.; Output: Generates a structured JSON file of "Standardized ACL Policy Set" as input for subsequent semantic analysis.

[0045] Step 3: Utilize large language models for policy semantic understanding and intent modeling 3.1 Semantic Analysis Task Execution (1) Intent recognition Input: Strategy description + standardized fields; Output: Structured business intent tags.

[0046] Example: Input: description="Allow HR system to access attendance database" + dst_ip=10.20.30.40,dst_port=3306 Output: {"intent": "access", "subject": "HR system", "object": "attendance database", "action": "read and write"} (2) Entity normalization Mapping IP addresses to business entity names enhances semantic consistency: Example: 192.168.1.0 / 24 → "Finance Department Office Website" 10.20.30.40 → “ERP Application Server” dst_port=3306 → “MySQL Database Service” (3) Semantic Equivalence Detection Determine whether two rules express the same business intent, even if they have different syntax.

[0047] Example: Rule A: src=192.168.1.10, dst=10.20.30.40, port=3306, action=permit Rule B: src=192.168.1.11, dst=10.20.30.40, port=3306, action=permit LLM output: "Semantically highly similar, it is recommended to merge them into one rule: src=192.168.1.0 / 24" 3.2 Output Semantic Knowledge Graph Construct a strategy semantic graph centered on "subject-action-object": Nodes: User group, server, service, region; Edges: access relationships, dependency paths; Attributes: Creation time and others; Output: Generates a "Policy Semantic Model" file, which includes intent labels, entity mappings, and a semantic similarity matrix.

[0048] Step 4: Integrate behavioral and semantic data to generate an optimization strategy set. 4.1 Dual-engine collaborative decision-making mechanism Establish a "behavior-semantic joint decision matrix" to comprehensively assess the feasibility of optimization: Table 2 Example of “Behavior-Semantic Joint Decision Matrix”

[0049] 4.2 Specific optimization operations (1) Merging redundant rules Conditions: Multiple rules have consecutive or aggregated source IPs, the same destination port, consistent actions, and point to the same business entity after semantic normalization.

[0050] Method: Use the CIDR aggregation algorithm (such as the ipaddress library) to merge IPs.

[0051] Example: Original rules: permit tcp 192.168.1.10 any → 10.20.30.40 3306 permit tcp 192.168.1.11 any → 10.20.30.40 3306 permit tcp 192.168.1.12 any → 10.20.30.40 3306 After the merger: permit tcp 192.168.1.0 / 24 any → 10.20.30.40 3306 (2) The silence rule is offline. Define "silent" criteria: no matching records within a specified period of time (such as 1 week or 1 month) and no periodic access characteristics.

[0052] Execution process: Mark the rule as "to be frozen"; if no matching record is found after a specified time, issue a deletion notification, and execute the deletion action after confirmation.

[0053] (3) High-frequency rules are placed in advance Sort by "number of matches" in descending order, and move the Top 20% rules to the front of the strategy.

[0054] Consider priority conflicts: the original policy logic order must not be disrupted (e.g., rejection rules cannot be skipped).

[0055] Use topological sorting algorithms to ensure semantic consistency.

[0056] (4) Strategy grouping and maintainability optimization Automatically group by business system (e.g., "OA System Group", "CRM System Group"); Insert group comment header: acl ! === [GROUP: Financial System] === Person in charge: Zhang Mou | Creation time: 2025-09-03 It supports exporting as a modular strategy template, which is easy to reuse across devices.

[0057] Step 5: Simulation Verification and Risk Assessment 5.1 Constructing a Strategy Simulation Sandbox Set up a lightweight environment to load the original and optimized policy sets; Input two types of traffic: (1) Historical real traffic playback (pcap replay); (2) Synthetic boundary flow (fuzz testing, such as scanning, fake connections).

[0058] 5.2 Decision Consistency Comparison For each traffic entry, compare the decision result (allow / deny) between the original policy and the optimized policy. Calculate the strategy decision difference rate (PDR): PDR = (Number of traffic instances with different decisions / Total number of test traffic instances) × 100%; For example: If 1000 traffic entries are tested, and 50 of them are allowed by the new system but blocked by the old system (or vice versa), then: PDR = 50 / 1000 × 100% = 5%; PDR should be set to 0%; otherwise, return to step four to readjust.

[0059] 5.3 Performance Indicator Prediction Calculate key performance indicators before and after optimization: Table 3 Key Performance Indicators

[0060] Output: Generates a "Strategy Change Impact Assessment Report", which includes functional consistency, performance improvement, and risk level (low / medium / high).

[0061] Step Six: Strategy Deployment and Closed-Loop Feedback 6.1 Security Deployment Process Adopt a canary release strategy: Deploy first in non-core areas (such as test areas); After monitoring for a specified period without any abnormalities, the data is then pushed to network devices in the production environment. Automatically backs up old policies and supports one-click rollback.

[0062] 6.2 Post-deployment monitoring and feedback collection Real-time monitoring: Network device performance metrics: CPU utilization, memory usage, PPS; Business availability: Critical service connectivity detection (such as HTTP health checks).

[0063] Active collection: User complaint tickets (e.g., "Unable to access the relevant webpage"); Security log alerts (such as a sudden increase in a large number of rejection logs).

[0064] 6.3 Closed-loop feedback and continuous model learning The deployment results (success / failure), business feedback, and performance changes are fed back to the large model. Build an "optimization effect feedback database" to fine-tune the optimization suggestion generation strategy of LLM and improve the accuracy and acceptance of future optimizations.

[0065] This forms a complete closed loop of "perception → optimization → verification → deployment → learning".

[0066] Figure 3 The figure shown is a firewall access control policy dynamic optimization system based on the collaboration of traffic parsing and large language model proposed in this application. The system includes: The traffic collection and parsing module is used to collect network traffic, parse communication behavior and rule hit status, extract traffic behavior features, and generate ACL rule hit logs. The policy standardization module is used to obtain the current access control list (ACL) policy set of the firewall and perform standardization processing, converting it into structured policy data and cleaning the comment text; The semantic analysis module is used to perform semantic analysis on the standardized ACL policy using a large language model and generate a policy semantic knowledge graph. The optimization strategy generation module is used to integrate traffic behavior characteristics and policy semantic information to generate an optimized set of access control policies based on a dual-drive model. The verification and evaluation module is used to perform simulation verification and risk assessment on the optimized access control policy set to determine the feasibility of the optimization policy. The deployment feedback module is used to deploy a validated set of optimized access control policies, monitor their operation status, and collect feedback information to achieve closed-loop dynamic optimization.

[0067] The above system implements the steps of the dynamic optimization method for firewall access control policies based on traffic parsing and large language model collaboration disclosed in this application when it is running.

[0068] The flowcharts and block diagrams in the accompanying drawings illustrate possible implementations of systems, methods, and computer program products according to various embodiments of this application, including architecture, functionality, and operation. In these figures, each block may represent a module, program segment, or portion of code containing one or more executable instructions for implementing a specified logical function. It should be noted that each block in the block diagrams and / or flowcharts, and combinations thereof, can be implemented using either a dedicated hardware-based system or a combination of dedicated hardware and computer instructions to achieve the specified function or operation.

[0069] like Figure 4 As shown in the illustration, an embodiment of this application also discloses an electronic device, including: a processor 310, a communication interface 320, a memory 330 for storing a processor-executable computer program, and a communication bus 340. The processor 310, communication interface 320, and memory 330 communicate with each other via the communication bus 340. The processor 310 executes the executable computer program to implement the steps of the aforementioned dynamic optimization method for firewall access control policies based on traffic parsing and large language model collaboration.

[0070] It is understood that, in addition to memory and a processor, this electronic device may also include input devices (such as a keyboard), output devices (such as a display), and other communication modules. These input devices, output devices, and other communication modules all communicate with the processor through I / O interfaces (i.e., input / output interfaces).

[0071] The operations described in this application can be implemented by writing computer program code using one or more programming languages ​​or a combination thereof. The programming languages ​​include, but are not limited to, the following types: Object-oriented programming languages, such as Java, Smalltalk, C++, etc. Conventional procedural programming languages, such as "C" or similar programming languages.

[0072] The execution methods of program code include, but are not limited to: It runs entirely on the user's computer; Part of it executes on the user's computer, and part of it executes on a remote computer; Execute as a standalone software package; It is executed entirely on a remote computer or server.

[0073] In scenarios involving remote computers, the remote computer can connect to the user's computer via any type of network, including but not limited to local area networks (LANs) or wide area networks (WANs). Furthermore, the remote computer can also connect to external computers through an internet service provider, for example, by utilizing the internet for connection.

[0074] Furthermore, this application also discloses a computer-readable storage medium, which, when the instructions in the computer-readable storage medium are executed by the processor of an electronic device, enables the electronic device to perform the various steps of the dynamic optimization method for firewall access control policies based on traffic parsing and large language model collaboration disclosed in this application.

[0075] In the context of this application, a computer-readable storage medium refers to a tangible medium capable of storing computer program code and related data. Specific examples include, but are not limited to, the following: (1) Portable computer disk: such as floppy disks and other removable magnetic storage media.

[0076] (2) Hard disk: including mechanical hard disks and solid-state hard disks and other fixed storage devices.

[0077] (3) Random Access Memory (RAM): A volatile storage medium used for temporary storage of data and program code.

[0078] (4) Read-only memory (ROM): a non-volatile storage medium used to store fixed programs and data.

[0079] (5) Erasable programmable read-only memory (EPROM) or flash memory: non-volatile storage media that supports multiple erasures and reprogrammings.

[0080] (6) Fiber optic storage devices: storage media based on fiber optic technology.

[0081] (7) Portable compact disc read-only memory (CD-ROM): a read-only medium that stores data in the form of an optical disc.

[0082] (8) Optical storage devices: such as DVDs, Blu-ray discs and other storage media based on optical principles.

[0083] (9) Magnetic storage devices: such as magnetic tapes, disks and other storage media based on magnetic principles.

[0084] (10) Any suitable combination of the above: for example, combining multiple storage media to meet different storage needs.

[0085] These computer-readable storage media can be used to store the program code and related data described in this application to support program execution and persistent data storage.

[0086] Specifically, according to embodiments of this application, the processes described in the flowcharts can be implemented as computer software programs. For example, embodiments of this application relate to a computer program product comprising a computer program carried on a non-transitory computer-readable medium. This computer program includes program code for executing the dynamic optimization method for firewall access control policies based on traffic parsing and a large language model, disclosed in this application. When this computer program is executed by a processing system, it can achieve the functions defined in the embodiments of this application.

[0087] While the foregoing discussion contains several specific implementation details, these details should not be construed as limiting the scope of this application. The above description is merely a preferred embodiment of this application and an explanation of the technical principles employed. Those skilled in the art should understand that the scope of this application is not limited to technical solutions formed by specific combinations of the above-described technical features. Furthermore, this application should also cover other technical solutions formed by any combination of the above-described technical features or their equivalents without departing from the foregoing disclosed concept.

[0088] Those skilled in the art should also understand that modifications can be made to the technical solutions described in the foregoing embodiments, or equivalent substitutions can be made to some of the technical features, without departing from the spirit and scope of the technical solutions of the embodiments of this application. These modifications or substitutions will not cause the essence of the corresponding technical solutions to deviate from the core spirit and scope of the technical solutions of the embodiments of this application.

Claims

1. A method for dynamically optimizing firewall access control policies based on the collaboration of traffic parsing and large language models, characterized in that, The method includes: S1: Collect network traffic and analyze communication behavior and rule hit status, extract traffic behavior characteristics and generate ACL rule hit logs; S2: Obtain the current Access Control List (ACL) policy set of the firewall and perform standardization processing, convert it into structured policy data and clean the comment text; S3: Use a large language model to perform semantic analysis on the standardized ACL policy and generate a policy semantic knowledge graph; S4: Integrate traffic behavior characteristics and policy semantic information to generate an optimized set of access control policies based on a dual-drive model; S5: Perform simulation verification and risk assessment on the access control policy optimization set generated in the previous step to determine the feasibility of the optimization strategy; S6: Deploy a validated set of optimized access control policies, monitor their operation and collect feedback information to achieve closed-loop dynamic optimization.

2. The method according to claim 1, characterized in that, Step S1 includes: S11: Deploy data plane probes in front of and behind core switches or firewalls to capture network traffic using eBPF / XDP technology; S12: Select sampling mode or full capture based on the characteristics of captured network traffic, supporting IPv4 / IPv6, TCP / UDP / ICMP protocol stack; S13: Parse the captured data packets and extract the basic 5-tuple, session-level features, behavioral features, and application layer identifiers; S14: Based on the firewall log interface or bypass mirror traffic comparison, record the matching time window, matching number and matching traffic characteristics of each ACL rule, and generate an ACL rule hit log containing rule ID, matching number and matching traffic characteristics.

3. The method according to claim 2, characterized in that, As described in step S13: The basic 5-tuple includes: source IP, destination IP, source port, destination port, and protocol type; Session-level characteristics include: connection time, duration, and number of bytes; Behavioral characteristics include: frequency of visits, suddenness, and periodicity; Application layer identifiers include: application types identified by DPI.

4. The method according to claim 1, characterized in that, Step S2 includes: S21: Collect ACL policies from network devices from multiple vendors via standardized APIs; S22: Map heterogeneous ACL policy fields to a standard structure, including rule ID, source IP / CIDR, destination IP, source port, destination port, protocol, action, priority, effective time, and description fields; S23: Clean the policy fields, separate technical parameters from business descriptions, extract keywords, and generate a structured, standardized ACL policy set JSON file.

5. The method according to claim 1, characterized in that, Step S3, which involves semantic analysis of the standardized ACL policy using a large language model, includes semantic analysis of the description fields and standard structure fields of the standardized policy, and performs the following tasks: (1) Intent recognition: Based on the policy description and field information, output business intent tags containing subject, object and action; (2) Entity normalization: Map IP addresses and port numbers to business entity names; (3) Semantic equivalence judgment: Identifying rules with high semantic similarity; (4) Construct a strategy semantic knowledge graph with "subject-action-object" as the core, which includes nodes and edges; wherein, the nodes include user groups, servers and services, and the edges include access relationships and dependency paths.

6. The method according to claim 1, characterized in that, Step S4 also includes: establishing a "behavior-semantic joint decision matrix", combining traffic behavior characteristics and semantic analysis results to determine the feasibility of optimization, and performing the following optimization operations: (1) Redundant rule merging: For rules with continuous / aggregable source IPs, the same destination port, consistent actions and semantics, the CIDR aggregation algorithm is used to merge IP segments; (2) Dead rules: Rules that have no matching records and no periodic characteristics within a specified period of time are marked as "to be frozen" and deleted after confirmation; (3) High-frequency rules are prioritized: The top rules are arranged in descending order of matching frequency and promoted to the front of the strategy. The priority logic is kept consistent through topological sorting. (4) Strategy grouping optimization: Automatically group by business system, insert grouping annotation headers and export as modular strategy templates.

7. The method according to claim 1, characterized in that, The simulation verification and risk assessment described in step S5 include: (1) Construct a lightweight strategy simulation sandbox, load the original strategy set and the optimized strategy set; input historical real traffic playback and synthetic boundary traffic; (2) Compare the decision results of each traffic flow under the original strategy and the optimized strategy, and calculate the decision difference rate (PDR). The PDR should not be greater than 0%. (3) Calculate key performance indicators before and after optimization, and generate a strategy change impact assessment report including functional consistency, performance improvement and risk level.

8. The method according to claim 1, characterized in that, Step S6 includes: S61: Adopts a canary release strategy, first deploying the optimization strategy in non-core areas, and then pushing it to the production environment after monitoring for a specified period without any anomalies; automatically backs up old strategies and supports one-click rollback. S62: Real-time monitoring of network device performance indicators and service availability; proactive collection of user complaint tickets and security log alerts; S63: Feeds deployment results, business feedback, and performance changes back to the large language model, updates optimization suggestion generation strategies, and forms a closed loop of "perception → optimization → verification → deployment → learning".

9. A dynamic optimization system for firewall access control policies based on the collaboration of traffic parsing and large language models, characterized in that, The system includes: The traffic collection and parsing module is used to collect network traffic, parse communication behavior and rule hit status, extract traffic behavior features, and generate ACL rule hit logs. The policy standardization module is used to obtain the current access control list (ACL) policy set of the firewall and perform standardization processing, converting it into structured policy data and cleaning the comment text; The semantic analysis module is used to perform semantic analysis on the standardized ACL policy using a large language model and generate a policy semantic knowledge graph. The optimization strategy generation module is used to integrate traffic behavior characteristics and policy semantic information to generate an optimized set of access control policies based on a dual-drive model. The verification and evaluation module is used to perform simulation verification and risk assessment on the optimized access control policy set to determine the feasibility of the optimization policy. The deployment feedback module is used to deploy a validated set of optimized access control policies, monitor their operation status, and collect feedback information to achieve closed-loop dynamic optimization.

10. An electronic device, characterized in that, include: Memory and processor; Memory: Used to store computer programs; Processor: Used to execute the computer program to implement the steps of the dynamic optimization method for firewall access control policies based on traffic parsing and large language model collaboration as described in any one of claims 1-8.

Images