Edge computing-based internal and external network security service access method and system

Abstract

The application discloses an inner-outer network security service passing method and system based on edge computing and belongs to the technical field of network security, which comprises the following steps: obtaining multi-dimensional attribute information of an edge node, generating a security policy basic data set, simultaneously generating a traffic characteristic fingerprint and an adaptive environment adaptation fingerprint and calculating a fusion matching degree, combining a business scene adaptive threshold clustering to generate an edge security entity node, and further constructing a security policy meta-model with a security policy blueprint as the core; analyzing the security policy meta-model through a multi-modal semantic analysis engine, generating a dynamic security enhancement model and mapping to a hierarchical security control model; and based on the hierarchical model, outputting an edge node inner-outer network security passing configuration and a corresponding security passing account through a scene configuration generation algorithm. The application realizes adaptive generation, dynamic optimization and precise execution of a security policy, and effectively improves the security, automation level and operation and maintenance efficiency of inner-outer network passing in an edge computing environment.

Description

TECHNICAL FIELD

[0001] The application belongs to the technical field of network security, and particularly relates to an inner-outer network security service passing method and system based on edge computing. BACKGROUND

[0002] With the rapid development of the Internet of Things and 5G technology, edge computing, as a new computing mode of sinking computing and storage capacity to the network edge, has been widely applied. However, the characteristics of a large number of edge nodes, wide distribution, limited resources, and heterogeneous environment have brought great challenges to the traditional network security model based on border protection and centralized management. The traditional firewall and intrusion detection system cannot adapt to the dynamic changes of the edge environment, and the security policy is often static and rigid, which cannot be adaptively adjusted according to the real-time state of the edge node and the business scenario, resulting in problems such as protection lag, policy conflict, and complex operation and maintenance. Therefore, a new method capable of intelligently perceiving, dynamically generating, and cooperatively executing security policy is urgently needed to ensure the safe passing of edge nodes in a complex inner-outer network environment. SUMMARY

[0003] In view of the deficiencies of the prior art, the application provides an inner-outer network security service passing method and system based on edge computing, which acquires multi-dimensional attribute information of edge nodes, generates a security policy basic data set, simultaneously generates traffic feature fingerprints and adaptive environment adaptation fingerprints and calculates fusion matching degrees, combines business scenario adaptive threshold clustering to generate edge security entity nodes, and further constructs a security policy meta-model with a security policy blueprint as the core; a multi-modal semantic analysis engine is used to analyze the security policy meta-model, a dynamic security enhancement model is generated and mapped to a hierarchical security control model; based on the hierarchical model, an edge node inner-outer network security passing configuration and corresponding security passing account are output by a scene configuration generation algorithm. The application realizes adaptive generation, dynamic optimization, and precise execution of security policy, and effectively improves the security, automation level, and operation and maintenance efficiency of inner-outer network passing in an edge computing environment.

[0004] To achieve the above object, the application provides the following technical scheme.

[0005] The inner-outer network security service passing method based on edge computing comprises the following steps:

[0006] Multi-dimensional attribute information of edge nodes is acquired, and a security policy basic data set is generated through edge-side lightweight AI perception algorithm processing and distributed time sequence synchronization protocol synchronization;

[0007] Based on the security policy basic dataset, traffic feature fingerprints and adaptive environment adaptation fingerprints are generated. The fusion matching degree is calculated using an improved cosine similarity algorithm. Combined with business scenario adaptive threshold clustering, edge security entity nodes are generated and a security policy meta-model is constructed. The constructed security policy meta-model generates a security policy blueprint for each edge node.

[0008] The security policy meta-model is parsed using a multimodal semantic parsing engine, and a dynamic security enhancement model is generated through security rule conflict prediction and dynamic rule mapping.

[0009] The dynamic security enhancement model is mapped to a layered security control model that includes an inter-layer collaborative control mechanism and a dynamic protection strength adjustment module; the layered security control model includes an edge local protection layer, a link encryption layer, and a cloud audit layer.

[0010] Based on the hierarchical security control model, the security access configuration for the internal and external networks of the edge nodes is generated through a scenario-based configuration generation algorithm, and the security access ledger of the corresponding edge nodes is output synchronously.

[0011] Specifically, obtaining the multi-dimensional attribute information of the edge nodes includes:

[0012] A scan is performed on the local system directory of the edge node and the management information database of associated network devices to extract associated object data; the associated object data includes the port number and service type of the communication port of the intranet business system, the mapping rules and port range of the extranet service port, the routing topology of the network link redundancy path and the priority of the backup link;

[0013] The associated object data is recorded as edge node-network object dependency association metadata in a structured format of edge node identifier-network object type-dependency parameter;

[0014] The dependent metadata is matched and merged with the hardware architecture parameters, network access types and service traffic characteristics collected by the edge nodes to generate multi-dimensional attribute information of the edge nodes, and a timestamp and version identifier are added to it; the multi-dimensional attribute information is standardized and encapsulated to form an attribute information vector.

[0015] Specifically, the generated security policy base dataset includes:

[0016] The attribute information vector is input into a lightweight convolutional neural network model deployed at the edge. The lightweight convolutional neural network model is trained using knowledge distillation technology to extract abnormal features and safety baseline deviation values ​​from the multi-dimensional attribute information of the edge node, and outputs an initial security posture code that represents the instantaneous security state of the node.

[0017] The initial security posture codes output in parallel from multiple edge nodes are coordinated by a distributed synchronization protocol based on a logical clock to output a set of initial security posture codes after time synchronization; the distributed synchronization protocol based on a logical clock performs timestamp alignment and state consistency verification on all initial security posture codes.

[0018] The initial security posture encoding set after time synchronization is associated and integrated with the corresponding attribute information vector to form a standardized security policy data record;

[0019] All standardized security policy data records are aggregated to form the basic dataset of the security policy.

[0020] Specifically, the generated security policy meta-model includes:

[0021] Based on the security policy dataset, traffic feature fingerprints and adaptive environment fingerprints are generated.

[0022] A predetermined number of traffic record samples are uniformly sampled over time from the local logs corresponding to each edge node in the security policy basic dataset to form a traffic behavior dataset.

[0023] For each real-time traffic field in the traffic behavior dataset, a real-time feature vector is calculated; the real-time feature vector consists of the minimum, maximum, mean, and variance within the statistical period.

[0024] For each non-real-time traffic field in the traffic behavior dataset, a traffic behavior fingerprint is generated by statistically analyzing the frequency of a preset quantity interval and the proportion of abnormal traffic; the preset quantity interval frequency is the frequency of occurrence of a preset quantity interval selected in descending order of data volume frequency.

[0025] The real-time feature vector and the traffic behavior fingerprint are fused to form a fused feature fingerprint.

[0026] Specifically, the generated security policy meta-model further includes:

[0027] For any two edge nodes, calculate the Euclidean distance of the traffic feature fingerprint, the cosine similarity of the environment adaptation fingerprint, and the similarity of the fused feature fingerprint, and obtain the comprehensive matching score between nodes according to the preset weighting coefficient.

[0028] Based on the adaptive threshold of the business scenario, edge nodes with a comprehensive matching score not lower than the threshold are clustered and merged according to the strategy to form edge security entity nodes; each node in the edge security entity node represents a group of edge devices that can reuse the same security strategy.

[0029] Generate a security policy blueprint for each edge security entity node, and at the same time, build a mapping table to establish a mapping relationship between each edge security entity node and all the original edge nodes it contains;

[0030] A structured security policy meta-model is constructed based on the security policy blueprint and mapping relationship table, and stored as a structured model file.

[0031] Specifically, the generation of traffic feature fingerprints and adaptive environment-adaptive fingerprints based on the security policy foundation dataset includes:

[0032] Deep packet inspection and flow behavior analysis are performed on the network traffic data in the security policy basic dataset to extract features including protocol type, payload size, communication cycle, and source / destination IP port tuples. After hashing, a traffic feature fingerprint is generated. The traffic feature fingerprint is used to uniquely identify the service traffic pattern of the edge node.

[0033] The environmental attribute data in the security policy basic dataset is input into the pre-trained edge environment adaptation model. The edge environment adaptation model transforms the environmental attribute data into a standardized semantic vector, i.e., an adaptive environment adaptation fingerprint. The edge environment adaptation model is trained based on edge device scenario data. The environmental attribute data includes hardware architecture, network access type, and security level weights. The adaptive environment adaptation fingerprint is used to characterize the adaptive configuration capability of a node under the current network topology, resource constraints, and external threat environment.

[0034] Specifically, the generation of the dynamic security enhancement model includes:

[0035] The multimodal semantic parsing engine is used to parse the security policy blueprint in the security policy metamodel; the multimodal semantic parsing engine combines natural language processing and ontology knowledge graph technology to convert the policy description in the security policy blueprint into formal logical assertions and security constraints.

[0036] The parsed formal logical assertions and security constraints are logically reasoned and correlated with the basic security rules in the predefined global security knowledge base to detect whether there are permission conflicts, behavioral contradictions or security vulnerabilities between policies.

[0037] Security policies that are determined to be conflict-free after testing are marked as compliant.

[0038] For security policies that are determined to be conflicting after detection, dynamic adjustments and remapping are performed based on the conflict resolution principles in the global security knowledge base to generate a set of consistent and conflict-free intermediate security rules.

[0039] The intermediate security rule set is correlated and fused with real-time threat intelligence from external input, and then injected with proactive defense rules based on the latest threat intelligence to generate a complete set of security policies that include triggering conditions, execution actions, and scope of effectiveness, namely, the dynamic security enhancement model.

[0040] Specifically, when mapping the dynamic security enhancement model to a layered security control model containing inter-layer collaborative control mechanisms and dynamic protection strength adjustment modules, the policy rules in the dynamic security enhancement model are classified and mapped to the three levels of the layered security control model according to their protection scope and execution points, including:

[0041] The traffic update frequency of each original edge node constituting each edge security entity node is obtained in the most recent network communication cycle, and the fluctuation variance of the traffic update frequency of each original edge node is calculated by a variance calculation algorithm; the fluctuation variance is used to characterize the difference in traffic stability between nodes.

[0042] If the variance of traffic fluctuation of each original edge node within the same edge security entity node is greater than the preset tear threshold, it is determined that there are child nodes with significantly different traffic characteristics within the node. They are split into real-time traffic child nodes and regular traffic child nodes according to the traffic update frequency. The real-time traffic child nodes are mapped to the edge local protection layer of the layered security control model, and the regular traffic child nodes are mapped to the link encryption layer. A source layer reference pointer is established between the two child nodes.

[0043] If the traffic fluctuation variance is less than or equal to the preset tear threshold, it is determined that the traffic characteristics of each original edge node in the edge security entity node are consistent, and the node is directly mapped to the layered security control model according to the average traffic update frequency of the node. When the average traffic update frequency is higher than the frequency threshold, it is mapped to the edge local protection layer, and when it is lower than or equal to the frequency threshold, it is mapped to the link encryption layer.

[0044] The security policy execution logs of all edge security entity nodes are synchronized to the cloud audit layer. The security policy execution logs are standardized audit records generated by the edge local protection layer and link encryption layer after executing the set of security policies issued by the dynamic security enhancement model, which record the entire process and results of security policy execution.

[0045] Specifically, the scenario-based configuration generation algorithm takes the policies mapped in the layered security control model as input, and combines them with a predefined internal and external network access control matrix to automatically generate specific firewall rules, VPN configurations, and access control lists applicable to edge nodes, i.e., the secure access configuration.

[0046] The scenario-based configuration generation algorithm also incorporates digital twin technology, which simulates and verifies the generated secure access configuration on the digital twin of the target edge node before deployment.

[0047] The edge computing-based intranet and extranet security service access system includes: a data acquisition module, a security policy meta-modeling module, an enhancement engine module, a control execution module, and a scenario-based configuration module;

[0048] The data acquisition module is used to collect multi-dimensional attribute information from distributed edge nodes in real time, and perform preliminary intelligent processing and standardization to generate a basic dataset for security policies.

[0049] The security policy meta-modeling module is used to automatically identify groups of edge nodes with similar security needs based on the security policy basic dataset, through feature extraction, similarity calculation and cluster analysis, and generate a basic security policy blueprint for each entity to build the security policy meta-model of the entire system.

[0050] The enhancement engine module is used to parse, detect conflicts, and intelligently enhance the security policy metamodel, transforming the static blueprint into a dynamic security policy model.

[0051] The control execution module is used to receive the dynamic security enhancement model and distribute the security policies therein to security execution points at different levels.

[0052] The scenario-based configuration module is used to transform the hierarchical security control model into configuration instructions that can be executed by edge nodes, and to automatically generate and manage a logbook of all configuration changes.

[0053] Compared with the prior art, the beneficial effects of the present invention are:

[0054] 1. This invention proposes a method for secure service access between internal and external networks based on edge computing. Through lightweight AI, multi-fingerprint fusion clustering, and multimodal semantic parsing, it achieves full automation and intelligence of security policy from data collection and entity recognition to policy generation. This method can dynamically adapt to changes in the edge environment and business needs, accurately construct conflict-free security policy meta-models and enhancement models, and change the traditional policy management mode that relies on manual static configuration, thereby improving the efficiency, accuracy, and scenario adaptability of policy generation.

[0055] 2. This invention proposes a secure access method for internal and external networks based on edge computing. Through a layered security control model and scenario-based configuration algorithms, it achieves precise execution and closed-loop management of security policies. The inter-layer collaboration and dynamic adjustment mechanism contained in the model ensures the optimal balance between protection strength and resource consumption, while cloud auditing and access ledger provide global visibility and auditability. Ultimately, it constructs an intrinsic security system that integrates self-adaptation, collaborative linkage, and continuous optimization, improving the overall security protection strength and operational reliability of edge nodes in internal and external network access scenarios. Attached Figure Description

[0056] Figure 1 This is a flowchart illustrating the principle of the edge computing-based method for secure access to internal and external networks in this invention.

[0057] Figure 2 This is a flowchart illustrating the security policy metamodel construction process of the edge computing-based intranet and extranet security service access method of this invention.

[0058] Figure 3 This is a diagram of the internal and external network security service access system based on edge computing, as described in this invention. Detailed Implementation

[0059] Example 1:

[0060] Please see Figure 1 and Figure 2 The present invention provides an embodiment of a secure communication method for internal and external networks based on edge computing, applicable to communication between a court's internal and external networks, comprising the following steps:

[0061] Obtain multi-dimensional attribute information of edge nodes, process it through a lightweight AI perception algorithm on the edge side and synchronize it through a distributed time-series synchronization protocol to generate a basic dataset for security policies;

[0062] Furthermore, the multi-dimensional attribute information of the edge node includes static attribute information and dynamic operation information; the static attribute information includes hardware model, firmware version, and geographic coordinates; the dynamic operation information includes CPU load, memory usage, and network throughput.

[0063] Based on the security policy basic dataset, traffic feature fingerprints and adaptive environment adaptation fingerprints are generated. The fusion matching degree is calculated using an improved cosine similarity algorithm. Combined with business scenario adaptive threshold clustering, edge security entity nodes are generated and a security policy meta-model is constructed. The constructed security policy meta-model generates a security policy blueprint for each edge node.

[0064] Furthermore, the improved cosine similarity algorithm mainly assigns weight factors that are dynamically adjusted by the criticality level of the business scenario to the distance value of the traffic feature fingerprint and the similarity of the environment adaptation fingerprint, and then performs weighted fusion calculation to obtain the comprehensive matching score between nodes.

[0065] The security policy meta-model is parsed using a multimodal semantic parsing engine, and a dynamic security enhancement model is generated through security rule conflict prediction and dynamic rule mapping.

[0066] Furthermore, the dynamic security enhancement model can be understood as a framework or an object.

[0067] The dynamic security enhancement model is mapped to a layered security control model that includes an inter-layer collaborative control mechanism and a dynamic protection strength adjustment module; the layered security control model includes an edge local protection layer, a link encryption layer, and a cloud audit layer.

[0068] Furthermore, the inter-layer collaborative control mechanism specifically includes: establishing a control bus and information exchange interface between the three layers of the layered security control model; allowing the cloud audit layer to issue tracing instructions to the edge local protection layer based on a global view, or allowing the edge local protection layer to request the link encryption layer to increase the encryption strength of a specific data stream.

[0069] Based on the hierarchical security control model, the security access configuration for the internal and external networks of the edge nodes is generated through a scenario-based configuration generation algorithm, and the security access ledger of the corresponding edge nodes is output synchronously.

[0070] Furthermore, the synchronous output of the security access log for the corresponding edge node specifically includes: creating a detailed record for each configuration generation operation to form the security access log; the security access log includes at least the policy version number, target node identifier, configuration content, generation time, effective status, and digital twin test results.

[0071] Furthermore, the secure access log is stored in a distributed ledger to ensure its immutability and auditability.

[0072] Furthermore, the method is deployed in a heterogeneous distributed system consisting of edge nodes, gateway devices, and a cloud security center. All components interact through a secure communication channel and work together to complete the secure passage of internal and external network services.

[0073] The acquisition of multi-dimensional attribute information of edge nodes includes:

[0074] A scan is performed on the local system directory of the edge node and the management information database of associated network devices to extract associated object data; the associated object data includes the port number and service type of the communication port of the intranet business system, the mapping rules and port range of the extranet service port, the routing topology of the network link redundancy path and the priority of the backup link;

[0075] The associated object data is recorded as edge node-network object dependency association metadata in a structured format of edge node identifier-network object type-dependency parameter;

[0076] The dependent metadata is matched and merged with the hardware architecture parameters, network access types and service traffic characteristics collected by the edge nodes to generate multi-dimensional attribute information of the edge nodes, and a timestamp and version identifier are added to it; the multi-dimensional attribute information is standardized and encapsulated to form an attribute information vector.

[0077] The basic dataset for generating security policies includes:

[0078] The attribute information vector is input into a lightweight convolutional neural network model deployed on the edge side; the lightweight convolutional neural network model is trained by knowledge distillation technology, which is used to extract abnormal features and security baseline deviation values ​​from the multi-dimensional attribute information of the edge node, and output an initial security situation code that represents the instantaneous security state of the node. The knowledge distillation technology is the prior art in this field and is not an inventive solution of this application, so it will not be described in detail here.

[0079] Furthermore, the initial security posture encoding is a low-dimensional and semantically rich vector that summarizes the instantaneous security state of the edge node at any given moment.

[0080] Furthermore, the training process for the lightweight convolutional neural network model includes:

[0081] (1) Select a complex, deep, and parameter-rich convolutional neural network in the cloud as the teacher model. The convolutional neural network is a prior art in this field and is not an inventive solution of this application. It will not be described in detail here.

[0082] (2) Collect historical and real-time edge node multi-dimensional attribute information data, and label them by an automated system to obtain a labeled dataset. The labels include not only normal categories, such as safe and general, but also labels of various abnormal types, such as CPU overload, memory leak, illegal connection, and their deviation from the preset safety baseline.

[0083] (3) The teacher model is trained using the labeled dataset mentioned above. The goal of the training is to enable the teacher model to learn to identify abnormal patterns from the input multidimensional attribute vector with extremely high accuracy and to quantify the deviation value from the safety baseline.

[0084] (4) Design a convolutional neural network with a simple structure, shallow layers, and few channels as the student model; the design goal of the student model is to simulate the behavior of the teacher model while minimizing the number of parameters and computation.

[0085] (5) Input the same edge node attribute information vector into the pre-trained teacher model and the student model to be trained at the same time. The teacher model will not only output a final classification result, i.e., a hard label, but also output a soft label, i.e. a softened softmax distribution containing the probability information of each category. For example, there is a 0.1% chance of being an A-class abnormality, a 99.7% chance of being a B-class abnormality, and a 0.2% chance of being normal.

[0086] (6) Calculate the cross-entropy loss between the student model output and the real hard label. The calculation formula for the cross-entropy loss is the prior art in this field and is not an inventive solution of this application. It will not be elaborated here.

[0087] (7) Calculate the KL divergence loss between the probability distribution output by the student model and the soft label probability distribution output by the teacher model. The KL divergence loss function forces the student model to learn the generalization thinking and internal knowledge of the teacher model, rather than just memorizing the final answer. The KL divergence loss function is existing technology in this field and is not an inventive solution of this application. It will not be elaborated here.

[0088] (8) By adjusting the importance of cross-entropy loss and KL divergence loss by adjusting a hyperparameter, the student model is finally trained by gradient descent algorithm. After training, the lightweight student model achieves performance similar to the teacher model and realizes knowledge distillation. The gradient descent algorithm is the existing technology in this field and is not the inventive solution of this application. It will not be described in detail here.

[0089] (9) The high-performance lightweight student model obtained through knowledge distillation training is converted into a format suitable for edge device inference, such as the ONNX format, and then deployed to various edge nodes.

[0090] Furthermore, the implementation process of initial security posture coding includes:

[0091] (1) Input the preprocessed attribute information vector into the deployed lightweight convolutional neural network model. The first part of the lightweight convolutional neural network model consists of multiple convolutional layers. Each convolutional layer uses multiple small convolutional kernels to perform one-dimensional convolution operations on the input vector. These convolutional kernels will automatically and hierarchically extract feature patterns from low to high level.

[0092] (2) After each convolution operation, apply a non-linear activation function, such as ReLU;

[0093] (3) A pooling layer is inserted between the convolutional layers. The pooling layer reduces the dimensionality of the feature map extracted by the convolution by taking the maximum or average value of the local region, thereby reducing the amount of data, while retaining the most significant features and giving the model a certain translation invariance.

[0094] (4) After a series of convolutions and pooling, the extracted high-level features are flattened and input into one or more fully connected layers. The role of the fully connected layers is to integrate all local features and perform global reasoning and judgment.

[0095] (5) The output layer is usually a linear layer with the number of neurons consistent with the dimension of the expected initial security posture encoding, resulting in an encoding vector; the encoding vector is a condensed representation of the deviation value between the abnormal features extracted by the lightweight convolutional neural network model and the security baseline. For example, a high value in a specific dimension of the encoding vector corresponds to a network scanning anomaly, and its magnitude represents the intensity of the abnormal activity, i.e., the deviation value.

[0096] The initial security posture codes output in parallel from multiple edge nodes are coordinated through a distributed synchronization protocol based on a logical clock, resulting in a set of initial security posture codes that have undergone time synchronization. The distributed synchronization protocol based on a logical clock performs timestamp alignment and state consistency verification on all initial security posture codes.

[0097] Furthermore, the initial security posture codes output in parallel by multiple edge nodes are coordinated through a distributed synchronization protocol based on a logical clock, resulting in a time-synchronized set of initial security posture codes, including:

[0098] (1) Start the protocol initialization process, assign a unique node identifier to each edge node participating in the collaboration, and at the same time, the node has a built-in logical clock module and completes the initial time value setting to ensure that the initial logical clock values ​​of all nodes are consistent. At the same time, a master coordinating node is designated in the network to be responsible for global synchronization coordination.

[0099] (2) After each edge node generates an initial security situation code, it triggers a local logical clock update mechanism, increments its own logical clock value according to a preset rule, forms a local timestamp corresponding to the initial security situation code, and then adds metadata information containing node identifiers and local timestamps to the code to complete the local marking of the code.

[0100] (3) Each edge node broadcasts the initial security posture encoding with metadata to all non-its own nodes in the network through network communication, and at the same time receives the encoded information from non-its own nodes. During the receiving process, the integrity of each encoded information is checked. If a data transmission error is found, the sender is requested to retransmit.

[0101] (4) The main coordinating node collects the initial security posture codes sent by all edge nodes, extracts the metadata information of each code, compares and analyzes the local timestamps of each code, and if there is a timestamp conflict, that is, the codes generated by different nodes have the same timestamp, the main coordinating node adjusts the timestamps of the conflicting codes according to the preset priority rules of the node identifier to ensure the uniqueness of the timestamps of all codes.

[0102] (5) The main coordinating node sorts all the codes that have undergone timestamp conflict processing according to the order of timestamps to form a preliminary time sequence. Then, it sends the preliminary time sequence and the corresponding timestamp adjustment information to each edge node. Each edge node updates the locally stored code timestamps according to the received information.

[0103] (6) After the timestamp alignment is completed, the main coordinating node starts the state consistency verification process, extracts the security situation feature information of each code in the time sequence, compares and analyzes the coding features of adjacent timestamps, judges the correlation and rationality of the state before and after, and marks the code as suspicious if a code with a sudden change in features is found that does not conform to the preset security situation evolution rules.

[0104] (7) For a marked suspicious code, the main coordinating node sends a verification request to the edge node that generated the code, requiring it to re-collect and generate a security status code. The edge node responds to the request and sends the newly generated code to the main coordinating node. The main coordinating node timestamps and verifies the status of the new code and replaces the original suspicious code.

[0105] (8) Repeat the state consistency verification and suspicious code replacement process until all codes in the time sequence pass the state rationality verification. The main coordinating node determines the final time sequence as the initial security situation code set after time synchronization and sends a synchronization completion notification to all edge nodes. Each node updates its local security situation database according to this set.

[0106] Furthermore, during the timestamp adjustment process, when a timestamp conflict occurs, the main coordinating node will assign a new timestamp to the node with lower priority. The value of the new timestamp is the current maximum timestamp plus one. In the state consistency verification, the rationality of the state is judged by calculating the similarity of adjacent coding features. If the similarity is lower than the preset threshold, it is marked as a suspicious code. The similarity is determined by comparing the degree of matching of feature items. The higher the proportion of matching items, the higher the similarity.

[0107] The initial security posture encoding set after time synchronization is associated and integrated with the corresponding attribute information vector to form a standardized security policy data record;

[0108] All standardized security policy data records are aggregated to form the basic dataset of the security policy.

[0109] The generated security policy metamodel includes:

[0110] Based on the security policy dataset, traffic feature fingerprints and adaptive environment fingerprints are generated.

[0111] A predetermined number of traffic record samples are uniformly sampled over time from the local logs corresponding to each edge node in the security policy basic dataset to form a traffic behavior dataset.

[0112] For each real-time traffic field in the traffic behavior dataset, a real-time feature vector is calculated; the real-time feature vector consists of the minimum, maximum, mean, and variance within the statistical period.

[0113] Furthermore, for each real-time traffic field in the traffic behavior dataset, a real-time feature vector is calculated, including:

[0114] (1) Extract the real-time traffic fields in the traffic behavior dataset field by field, clarify the data source identifier and timestamp range of each field, and ensure that the extracted field data completely covers the preset statistical period. For each extracted real-time field data, perform outlier detection. By traversing all data points through a sliding window, mark the data that exceeds three times the standard deviation of the historical data of the field as outliers. Then, use linear interpolation to fill in the outliers based on the normal data points before and after the outliers to eliminate fluctuations caused by data collection errors. The linear interpolation method is the prior art in this field and is not an inventive solution of this application. It will not be described in detail here.

[0115] (2) After completing the data cleaning, the feature calculation stage is entered: For each real-time traffic field, first determine all valid data points within the statistical period, arrange them in chronological order, find the data point with the smallest value as the minimum value feature, similarly traverse all valid data points, select the data point with the largest value as the maximum value feature, calculate the arithmetic sum of all valid data points, and then divide by the number of data points to obtain the mean feature of the field. By dividing the sum of squared differences between each data point and the mean by the number of data points minus one, the variance feature representing the dispersion of the data is obtained.

[0116] (3) Arrange the calculated minimum, maximum, mean and variance in a fixed order to form the basic feature combination of the real-time flow field. At the same time, in order to enhance the temporal correlation of the features, a sliding window time-segmentation statistical mechanism is introduced to divide the entire statistical period into multiple continuous and non-overlapping sub-periods. The above four feature values ​​are repeatedly calculated in each sub-period. Then, the features of each sub-period are spliced ​​into the basic feature combination in chronological order to form a real-time feature vector with higher dimension.

[0117] (4) Standardize the generated real-time feature vectors, map each feature value to the range of zero to one, subtract the minimum value of the feature in the historical data from each feature value, and then divide by the difference between the maximum and minimum values ​​of the feature in the historical data to eliminate the impact of the difference in the data volume of different fields and ensure that each feature in the feature vector has the same weight ratio.

[0118] For each non-real-time traffic field in the traffic behavior dataset, a traffic behavior fingerprint is generated by statistically analyzing the frequency of a preset quantity interval and the proportion of abnormal traffic; the preset quantity interval frequency is the frequency of occurrence of a preset quantity interval selected in descending order of data volume frequency.

[0119] Furthermore, for each non-real-time traffic field in the traffic behavior dataset, a traffic behavior fingerprint is generated by statistically analyzing the frequency within a preset quantity range and the proportion of abnormal traffic, including:

[0120] (1) Extract all non-real-time traffic fields from the traffic behavior dataset. The data types corresponding to each field include, but are not limited to, discrete information such as protocol type, target network address range, and application identifier. Perform data format standardization processing on each field and convert the same attribute with different representation forms into a preset standard value.

[0121] (2) After data standardization is completed, the interval division stage begins. For each non-real-time field, the frequency of all possible values ​​appearing in the dataset is counted, and the values ​​are sorted in descending order of frequency. Based on the preset interval number requirement, several of the top-ranked values ​​are selected as core intervals, and each core interval corresponds to a specific field value.

[0122] (3) Traverse all data records of the non-real-time field, count the number of times each core interval and non-self interval appear in the traffic behavior dataset, divide the number of times each interval appears by the total number of data records of the field to obtain the frequency ratio of each interval, arrange the frequency ratios in the order of the core intervals and the fixed position of the non-self intervals to form the interval frequency feature sequence.

[0123] (4) Start the abnormal traffic identification process and call the preset abnormal feature library; the abnormal feature library contains abnormal judgment rules for non-real-time fields;

[0124] (5) Traverse all data records of the non-real-time field, mark data that meet any rule in the abnormal feature library as abnormal traffic, count the number of abnormal traffic records, divide by the total number of data records of the field, and get the percentage of abnormal traffic.

[0125] (6) Combine the interval frequency feature sequence with the abnormal traffic ratio to form the original feature set of this non-real-time traffic field;

[0126] (7) Integrate the original feature set according to a fixed structure to finally generate the traffic behavior fingerprint of the non-real-time traffic field.

[0127] The real-time feature vector and the traffic behavior fingerprint are fused to form a fused feature fingerprint;

[0128] For any two edge nodes, calculate the Euclidean distance of the traffic feature fingerprint, the cosine similarity of the environment adaptation fingerprint, and the similarity of the fused feature fingerprint, and obtain the comprehensive matching score between nodes according to the preset weighting coefficient. The Euclidean distance and similarity calculation formulas are existing technologies in this field and are not inventive solutions of this application, and will not be elaborated here.

[0129] Based on the adaptive threshold of the business scenario, edge nodes with a comprehensive matching score not lower than the threshold are clustered and merged according to the strategy to form edge security entity nodes; each node in the edge security entity node represents a group of edge devices that can reuse the same security strategy.

[0130] Furthermore, based on an adaptive threshold for the business scenario, edge nodes with a comprehensive matching score not lower than the threshold are clustered and merged according to a strategy to form edge security entity nodes, including:

[0131] (1) Extract features from the current business scenario and identify the scenario type, such as industrial control, intelligent transportation, and financial transactions. At the same time, collect key parameters under the scenario, including data transmission real-time requirements, security level settings, and equipment type composition. Compare these scenario features with the preset scenario feature library to determine the corresponding scenario category label. Each label is associated with a set of historical threshold ranges. The historical threshold ranges are generated based on the historical clustering effect of similar scenarios.

[0132] (2) Enter the threshold adaptive calculation stage, call the corresponding historical threshold range according to the scene category label, and dynamically adjust the threshold in combination with the real-time parameters of the current scene to finally determine the adaptive threshold of the current scene;

[0133] (3) After the threshold is determined, a node matching matrix is ​​constructed, including: traversing all edge nodes, comparing the comprehensive matching scores of any two nodes pairwise, marking the node pairs with scores not lower than the adaptive threshold as clusterable associations, and recording the number of associated nodes for each node to form a preliminary association network, where each node is a vertex in the network and clusterable associations are edges between vertices.

[0134] (4) Initiate the clustering and merging process, and use a greedy clustering algorithm to process the relationship network, including: first, select the edge node with the most associated nodes as the initial cluster center, and include all nodes that are clusterable with the center node into the same temporary cluster; then, select a new cluster center from the remaining un-clustered nodes, and repeat the above process until all nodes are assigned to the corresponding clusters; for nodes that are cross-cluster associated, that is, nodes that are clusterable with multiple cluster centers at the same time, judge according to the difference in the comprehensive matching degree scores between the node and each cluster center. If the difference exceeds the preset difference threshold, the node is assigned to the cluster with the higher score; if the difference is small, start a second evaluation and make a final assignment judgment based on the similarity of the node's business attributes.

[0135] (5) After clustering is completed, the cluster optimization stage is entered. The average comprehensive matching score of all nodes in each temporary cluster is calculated. If the average score is lower than 90% of the adaptive threshold, it is determined that there are low matching nodes in the cluster, which need to be split.

[0136] (6) By calculating the average matching degree between a node and other nodes in the cluster, nodes that are less than 80% of the cluster average are marked as outliers, removed from the original cluster, and re-participated in clustering.

[0137] (7) For the split small cluster, if the number of nodes is less than the preset minimum cluster size, it is merged with the most similar neighboring cluster to obtain the optimized cluster.

[0138] (8) The optimized cluster is materialized, each cluster is assigned a unique entity identifier, and the common attributes of all nodes in the optimized cluster, such as network environment characteristics and security policy requirements, are integrated to generate the basic attribute set of edge security entity nodes. At the same time, a mapping relationship table between entity nodes and original edge nodes is established to record the entity node identifier and matching degree information of each original node.

[0139] Furthermore, the initial value of the adaptive threshold is the median of the historical threshold range of the scene; in the dynamic adjustment of the threshold in combination with the real-time parameters of the current scene, the adjustment amount of the real-time parameters is the median multiplied by a correction coefficient, and the magnitude of the correction coefficient is positively correlated with the degree to which the real-time parameters deviate from the historical mean; the average comprehensive matching degree of nodes in the cluster is the sum of the pairwise matching degree scores between all nodes in the cluster divided by the number of possible node pairs; the outlier determination threshold is the cluster mean multiplied by 80%, and nodes below this value are marked as outliers.

[0140] Generate a security policy blueprint for each edge security entity node, and at the same time, build a mapping table to establish a mapping relationship between each edge security entity node and all the original edge nodes it contains;

[0141] Furthermore, a security policy blueprint is generated for each edge security entity node, including:

[0142] (1) Extract the core attributes of each edge security entity node one by one, including the common features of all original edge nodes contained in the node, such as network access type, service traffic pattern, and security level requirements. At the same time, record the unique identifier of the entity node and the average comprehensive matching degree during clustering as the basic data for generating the security strategy blueprint.

[0143] (2) Match the preset strategy template library according to the core attributes of the entity node. After selecting the basic template in the strategy template, extract the differentiated requirements of all original edge nodes in the entity node, such as specific port opening requirements and encryption algorithm preferences. Integrate the extracted requirements as supplementary clauses into the basic template to form a preliminary strategy blueprint framework. The strategy template library is stored according to business scenarios and security levels.

[0144] (3) Parameterize each policy item in the preliminary policy blueprint framework to obtain the security policy blueprint, including: for access control policies, determine the IP address range and port list allowed for communication based on the business interaction scope of the entity node; for encryption policies, select the corresponding encryption algorithm and key update cycle according to the security level requirements; for audit policies, set the log fields to be recorded and the storage duration according to the traffic characteristics.

[0145] Furthermore, during the configuration process, if there are conflicting requirements among the original edge nodes, such as some nodes requiring the opening of any port while others prohibit it, a conflict arbitration mechanism is initiated. The security level of the entity node is used as the priority criterion, and higher-level requirements are retained first. At the same time, the conflict resolution results are recorded as policy notes.

[0146] (4) While generating the security policy blueprint, start the mapping relationship table construction process, including: creating a table structure containing four fields: entity node identifier, original node identifier, matching degree score, and addition time; traversing each edge security entity node, extracting the unique identifiers of all original edge nodes contained therein, recording them one by one into the corresponding original node identifier field in the table, and associating them with the corresponding entity node identifiers.

[0147] (5) For the matching score field in the mapping relationship table, fill in the comprehensive matching score between each original edge node and the center of the entity node to which it belongs, and add a time field to record the specific time when the original node was included in the entity node; the comprehensive matching score reflects the degree of fit between the original node and the entity node;

[0148] (6) After the initial construction is completed, the integrity of the mapping relationship table is checked to see if there are any unmapped original edge nodes or entity nodes without corresponding original nodes, to ensure that all original nodes have been correctly associated with entity nodes. At the same time, consistency is checked to verify whether the identifier of each original node uniquely corresponds to a current valid entity node in the table, so as to avoid the conflict situation where the same node belongs to multiple entity nodes at the same time.

[0149] (7) Associate the security policy blueprint with the mapping relationship table, add the corresponding mapping relationship table index in the security policy blueprint, and add the version number of the corresponding security policy blueprint in the mapping relationship table to realize bidirectional traceability between the two. At the same time, establish a regular update mechanism. When the original node in the entity node is added or removed or its attributes change, the revision process of the security policy blueprint and the update operation of the mapping relationship table are automatically triggered to ensure that the security policy blueprint and the mapping relationship remain accurate.

[0150] Furthermore, the compliance score of the security strategy blueprint is obtained by dividing the number of policy entries that meet the standards by the total number of entries, and the score must reach a preset threshold to pass the verification; the matching score between the original node and the entity node is the average of the comprehensive matching scores between the node and all other nodes within the entity node, which is used to evaluate the degree of adaptation of the node in the entity; the integrity index of the mapping relationship table is the number of mapped original nodes divided by the total number of original nodes, and it must reach 100% to pass the integrity verification.

[0151] A structured security policy meta-model is constructed based on the security policy blueprint and mapping relationship table, and stored as a structured model file.

[0152] The generation of traffic feature fingerprints and adaptive environment-adaptive fingerprints based on the security policy dataset includes:

[0153] Deep packet inspection and flow behavior analysis are performed on the network traffic data in the security policy basic dataset to extract features including protocol type, payload size, communication cycle, and source / destination IP port tuples. After hashing, a traffic feature fingerprint is generated. The traffic feature fingerprint is used to uniquely identify the service traffic pattern of the edge node.

[0154] Furthermore, deep packet inspection and flow behavior analysis are performed on the network traffic data in the security policy foundation dataset to extract features including protocol type, payload size, communication cycle, and source / destination IP port tuples. These features are then hashed to generate a traffic feature fingerprint, including:

[0155] (1) Extract the network traffic data to be analyzed from the security policy basic dataset, and divide the network traffic data into slices according to the time dimension with a fixed time window to obtain N data packets. In this invention, the fixed time window is set to five minutes.

[0156] (2) For a single data packet within each time window, initiate a deep packet inspection process, including: parsing the data link layer header of the data packet, extracting the source MAC address and destination MAC address, determining whether it is broadcast or multicast traffic, and initially screening out the unicast traffic that needs to be analyzed; then parsing the network layer header, identifying the network layer protocol type, such as Internet Protocol version 4 and Internet Protocol version 6, extracting the source Internet Protocol address and destination Internet Protocol address, recording the network segment to which the address belongs, such as the internal LAN network segment and the external public network segment, and distinguishing between internal and external network communication traffic; then parsing the transport layer header, determining the transport layer protocol type, such as Transmission Control Protocol, User Datagram Protocol, and Internet Control Message Protocol, extracting the source port number and destination port number, marking the service type corresponding to commonly used ports, such as the port corresponding to Hypertext Transfer Protocol service and the port corresponding to File Transfer Protocol service, and finally forming a complete protocol type chain for each data packet and associating it with the corresponding traffic entry;

[0157] (3) Based on deep packet inspection, traffic data is aggregated and analyzed according to the dimension of flow. The definition of flow is based on the five-tuple <source Internet Protocol address, destination Internet Protocol address, source port number, destination port number, transport layer protocol>, that is, data packets with the same five-tuple are classified as the same flow;

[0158] (4) Traverse all data packets within the same stream, calculate the payload data length of each data packet (i.e., the actual data length after removing the headers of each layer), calculate the payload characteristics of the stream, and distinguish between uplink and downlink traffic, and calculate the payload characteristics of uplink and downlink traffic respectively; the payload characteristics include the maximum payload length, minimum payload length, average payload length, and variance of the payload length of a single data packet; the uplink traffic is the traffic sent from the internal node to the external node; the downlink traffic is the traffic sent from the external node to the internal node;

[0159] (5) Record the timestamp of each data packet in the same stream, calculate the time interval between two adjacent data packets, form a time interval sequence, and extract communication periodic features based on the time interval sequence; the periodic features include the average time interval, the maximum time interval, the minimum time interval, and the coefficient of variation of the time interval; the coefficient of variation is the standard deviation divided by the average value, which reflects the stability of the communication frequency;

[0160] (6) For the same flow, identify the source tuple consisting of the source Internet Protocol address and the source port number, and the destination tuple consisting of the destination Internet Protocol address and the destination port number. Mark the attributes of each source tuple. For example, in the source tuple, determine whether the source Internet Protocol address is an internal server address or belongs to a specific business department network segment, and whether the source port number is a temporary port, such as the temporary port range of the Transmission Control Protocol. In the destination tuple, determine whether the destination Internet Protocol address is a known third-party service address, such as a cloud service provider address, and whether the destination port number is a high-risk port, such as a remote login service port or a database service port. At the same time, count the frequency of each source tuple in the current time window and the number of flows associated with the source tuple to reflect the activity level of the tuple.

[0161] (7) Normalize the payload characteristics, communication cycle characteristics, source tuple, and destination tuple;

[0162] (8) For protocol type and binary attribute annotation, the idea of ​​one-hot encoding is used to convert them into numerical features;

[0163] (9) After standardization, all features are spliced ​​and merged in the order of protocol type feature, payload size feature, communication cycle feature, source tuple feature, and destination tuple feature to form a standardized feature vector. Each feature vector uniquely corresponds to a stream, and each element in the vector is a standardized value to ensure the stability of subsequent hash operations.

[0164] (10) Convert the standardized feature vector into a string format. Specifically, convert each value in the standardized feature vector into a string by keeping six decimal places, and then concatenate all the strings into a complete feature string according to the feature concatenation order.

[0165] (11) Perform hash operation on the concatenated feature string, input the hash algorithm function, and through the iterative compression process inside the algorithm, such as 64 rounds of compression of SHA-256, convert the feature string of arbitrary length into a hash value of fixed length, such as SHA-256 outputting a 256-bit binary value; then perform format processing on the hash value, convert the binary value into a hexadecimal string, which is the flow feature fingerprint of the corresponding flow. In this invention, the hash algorithm used is SHA-256.

[0166] (12) Add metadata information to each traffic feature fingerprint, including the time window identifier, business scenario label, feature extraction timestamp, and hash algorithm version used to generate the fingerprint. Store the fingerprint and metadata together to form a complete traffic feature fingerprint library.

[0167] Furthermore, an index is constructed for the traffic feature fingerprint database, with indexes built according to business scenarios, time windows, and binary tuple dimensions. At the same time, a process log is recorded for each fingerprint generation, including the amount of original data, the amount of effective data, the time spent on feature extraction, the time spent on hashing operations, and the verification pass rate.

[0168] The environmental attribute data in the security policy basic dataset is input into the pre-trained edge environment adaptation model. The edge environment adaptation model transforms the environmental attribute data into a standardized semantic vector, i.e., an adaptive environment adaptation fingerprint. The edge environment adaptation model is trained based on edge device scenario data. The environmental attribute data includes hardware architecture, network access type, and security level weights. The adaptive environment adaptation fingerprint is used to characterize the adaptive configuration capability of a node under the current network topology, resource constraints, and external threat environment.

[0169] The generated dynamic security enhancement model includes:

[0170] The security policy blueprint in the security policy metamodel is parsed using the multimodal semantic parsing engine. The multimodal semantic parsing engine combines natural language processing and ontology knowledge graph technology to convert the policy description in the security policy blueprint into formal logical assertions and security constraints. Natural language processing and ontology knowledge graph technology are existing technologies in this field and are not the inventive solutions of this application, so they will not be described in detail here.

[0171] Furthermore, ontology is a form of information organization, an abstraction and description of domain knowledge specifications, and a method for expressing, sharing, and reusing knowledge, including classes, attributes, relationships, and instances as components.

[0172] The parsed formal logical assertions and security constraints are logically reasoned and correlated with the basic security rules in the predefined global security knowledge base to detect whether there are permission conflicts, behavioral contradictions or security vulnerabilities between policies.

[0173] Furthermore, the logical reasoning and correlation analysis process includes:

[0174] (1) Select basic security rules related to the current assertion and constraint from the predefined global security knowledge base; the basic security rules in the global security knowledge base are stored according to business scenarios and rule types. Locate the basic security rule subset by keyword matching, such as port 80 and database in the assertion; the rule types include access control, data encryption and audit logs.

[0175] (2) A rule-based reasoning engine is used to logically associate the preprocessed formal assertions with the matched basic security rules, including consistency verification and implicit conflict judgment. For example, the assertion that A is allowed to access all ports of B and the rule that A is prohibited from accessing port 22 of B are not directly contradictory, but all ports include port 22, which forms a behavioral contradiction. A and B are two different IPs.

[0176] Security policies that are determined to be conflict-free after testing are marked as compliant.

[0177] Furthermore, the compliance marking of security policies determined to be conflict-free after testing specifically includes: first, extracting and standardizing the metadata of conflict-free security policies; then, selecting applicable standards from the compliance standard library based on business scenarios and parsing them into check items; then, comparing each policy rule with the check item and marking the compliance of each rule; then, summarizing the results to calculate a comprehensive score and assess the compliance level; then, generating a compliance mark containing the level, score, and rectification suggestions, and storing it in association with the policy; finally, setting a dynamic update mechanism to re-verify and update the mark when standards are updated, policies are modified, or periodic checks are conducted.

[0178] For security policies that are determined to be conflicting after detection, dynamic adjustments and remapping are performed based on the conflict resolution principles in the global security knowledge base to generate a set of consistent and conflict-free intermediate security rules.

[0179] Furthermore, for security policies identified as conflicting after detection, dynamic adjustments and remapping are performed based on conflict resolution principles in the global security knowledge base to generate a consistent and conflict-free set of intermediate security rules, including:

[0180] (1) By comparing the rule content of the conflict strategy, distinguish between permission conflict, behavior contradiction and scope overlap conflict. At the same time, determine the scope of edge nodes involved in the conflict, business scenarios and time windows, and organize the conflict strategy and its associated metadata into a conflict analysis table.

[0181] (2) Extract conflict resolution principles corresponding to the current conflict type from the global security knowledge base. The principles in the global security knowledge base are classified according to the conflict type. For example, permission conflicts correspond to the priority principle and the least privilege principle, and scope overlap conflicts correspond to the scope refinement principle and the scenario adaptation principle.

[0182] (3) Filter the corresponding principles according to the information in the conflict analysis table. For example, for conflicts between high-priority rules and low-priority rules, match the priority principle; for conflicting rules with the same priority but different scenarios, match the scenario adaptation principle.

[0183] (4) Based on the selected conflict resolution principles, the conflict strategy is adjusted for the first time. If the priority principle applies, the high priority rules are retained and the parts of the low priority rules that conflict with the high priority rules are temporarily removed or disabled. If the least privilege principle applies, the conflicting permission rules are narrowed and only the necessary access permissions are retained. If the scope refinement principle applies, the overlapping scopes are split and non-conflicting rules are assigned to different sub-scopes.

[0184] (5) Remap the rule set that has passed the consistency check to the corresponding edge node or entity node to obtain a consistent and conflict-free intermediate security rule set. At the same time, record the rule adjustment trajectory, including the original rule content, the resolution principle on which the adjustment is based, the adjusted content and the node identifier of the remapped rule, to form a traceable adjustment log.

[0185] The intermediate security rule set is correlated and fused with real-time threat intelligence from external input, and then injected with proactive defense rules based on the latest threat intelligence to generate a complete set of security policies, including triggering conditions, execution actions, and scope of effectiveness—that is, a dynamic security enhancement model. The specific process includes:

[0186] (1) Standardize the real-time threat intelligence input from external sources, and classify the standardized threat intelligence according to threat type. Extract features from each type of intelligence to form a structured threat feature library. The threat intelligence includes threat type, attack source identifier, attack target features, threat level, intelligence generation time and credibility score.

[0187] (2) Perform multi-dimensional association matching between the intermediate security rule set and the structured threat feature library, including: extracting elements from the triggering conditions of the rule set, such as IP network segment, port number, and protocol type, comparing them with the corresponding features in the threat feature library, marking the rules that match the associated intelligence as rules to be enhanced, and marking the rules that do not match as basic rules to be retained.

[0188] (3) For entries marked as rules to be enhanced, perform fusion calculations in conjunction with associated threat intelligence;

[0189] (4) Determine the level of reinforcement based on the threat level;

[0190] (5) Design specific proactive defense actions based on threat characteristics. For example, for malicious IP intelligence, add the action of blocking all connections of the IP in the original access control rules; for DDoS attack intelligence, add the condition of triggering rate limiting when the number of concurrent connections of any IP exceeds the threshold in the flow control rules. At the same time, calculate the priority of the defense rules. The higher the threat level and the closer it is to the business, the higher the priority should be.

[0191] (6) Define the scope of effectiveness for the generated proactive defense rules, and clarify the edge nodes, network areas and time windows for the rule's effect by combining the attack target characteristics in the threat intelligence and the applicable node range of the intermediate rule set;

[0192] (7) Merge the proactive defense rules with the intermediate security rule set and the basic reserved rules, perform conflict verification, and check whether the new rules have permission conflicts or resource competition with the original rules. For example, if two rules set different rate limiting thresholds for the same port, if there is a conflict, coordinate according to the principle of threat priority and the principle of minimum impact, such as narrowing the effective time window of the basic rules to make way for the defense rules.

[0193] (8) Integrate all rules that pass the conflict verification into a dynamic security enhancement model, classify them according to rule type and scope of effect, and supplement each rule with the three complete elements: triggering condition, execution action, and scope of effect. At the same time, add metadata to the dynamic security enhancement model, including model version number, generation time, associated threat intelligence identifier, total number of rules and the proportion of each type of rule, to form a traceable model file.

[0194] When mapping a dynamic security enhancement model to a layered security control model containing inter-layer collaborative control mechanisms and dynamic protection strength adjustment modules, the policy rules in the dynamic security enhancement model are classified and mapped to the three levels of the layered security control model according to their protection scope and execution points, including:

[0195] The traffic update frequency of each original edge node constituting each edge security entity node in the most recent network communication cycle is obtained, and the fluctuation variance of the traffic update frequency of each original edge node is calculated by a variance calculation algorithm. The fluctuation variance is used to characterize the difference in traffic stability between nodes. The variance calculation algorithm is the prior art in this field and is not an inventive solution of this application, so it will not be described in detail here.

[0196] If the variance of traffic fluctuation of each original edge node within the same edge security entity node is greater than the preset tear threshold, it is determined that there are child nodes with significantly different traffic characteristics within the node. They are split into real-time traffic child nodes and regular traffic child nodes according to the traffic update frequency. The real-time traffic child nodes are mapped to the edge local protection layer of the layered security control model, and the regular traffic child nodes are mapped to the link encryption layer. A source layer reference pointer is established between the two child nodes.

[0197] If the traffic fluctuation variance is less than or equal to the preset tear threshold, it is determined that the traffic characteristics of each original edge node in the edge security entity node are consistent, and the node is directly mapped to the layered security control model according to the average traffic update frequency of the node. When the average traffic update frequency is higher than the frequency threshold, it is mapped to the edge local protection layer, and when it is lower than or equal to the frequency threshold, it is mapped to the link encryption layer.

[0198] The security policy execution logs of all edge security entity nodes are synchronized to the cloud audit layer. The security policy execution logs are standardized audit records generated by the edge local protection layer and link encryption layer after executing the set of security policies issued by the dynamic security enhancement model, which record the entire process and results of security policy execution.

[0199] Furthermore, the edge local protection layer specifically implements the following: a lightweight security agent is deployed locally on the edge node, which is responsible for receiving and executing the policies mapped to this layer. Its functions include at least micro-segmentation, file integrity monitoring, system call interception, and local malicious code detection.

[0200] Furthermore, the link encryption layer specifically performs the following: on the communication link between the edge node and the external network, including the intranet and the extranet, the encryption algorithm and key negotiation protocol are dynamically selected according to the mapping strategy to provide differentiated transmission encryption protection for data streams with different security levels.

[0201] Furthermore, the cloud audit layer specifically performs the following: at the security cloud service center, it receives security logs and metadata from edge nodes, uses a big data analysis platform to perform correlation analysis, anomaly detection and threat hunting, and generates a global security posture report to be fed back to the dynamic security enhancement model.

[0202] The scenario-based configuration generation algorithm takes the policies mapped in the layered security control model as input and combines them with the predefined internal and external network access control matrix to automatically generate specific firewall rules, VPN configurations, and access control lists applicable to edge nodes, i.e., the secure access configuration.

[0203] The scenario-based configuration generation algorithm also incorporates digital twin technology, which simulates and verifies the generated secure access configuration on the digital twin of the target edge node before deployment.

[0204] Furthermore, the predefined internal and external network access control matrix is ​​a set of access permission management rules that are pre-set and structured in matrix form. Its core function is to clearly define the access permission boundaries between various access subjects and various access objects between the internal network and the external network. The access subjects include users, devices, and applications; the access objects include servers, databases, files, and network ports.

[0205] Furthermore, the predefined internal and external network access control matrix contains three core dimensions: access subject, access object, and access permission rules.

[0206] Example 2:

[0207] Please see Figure 3 Another embodiment of the present invention provides: an edge computing-based intranet and extranet security service access system, comprising:

[0208] Data acquisition module, security policy meta-modeling module, enhancement engine module, control execution module, and scenario-based configuration module;

[0209] The data acquisition module is used to collect multi-dimensional attribute information from distributed edge nodes in real time, and perform preliminary intelligent processing and standardization to generate a basic dataset for security policies.

[0210] The security policy meta-modeling module is used to automatically identify groups of edge nodes with similar security needs based on the security policy basic dataset through feature extraction, similarity calculation and cluster analysis, and generate a basic security policy blueprint for each entity to build the security policy meta-model of the entire system.

[0211] The enhancement engine module is used for deep analysis, conflict detection, and intelligent enhancement of the metamodel, transforming static blueprints into executable, conflict-free, and dynamic security policy models that can respond to real-time threats.

[0212] The control execution module is used to receive the dynamic security enhancement model, accurately distribute the policies in it to security execution points at different levels, coordinate the collaborative work of each level, and provide dynamic intensity adjustment capabilities.

[0213] The scenario-based configuration module is used to transform the layered security control model into specific configuration instructions that can be executed by edge nodes, and to automatically generate and manage a logbook of all configuration changes, thereby achieving automated and auditable operation and maintenance.

[0214] The data acquisition module includes: an acquisition unit, a lightweight AI sensing unit, and a time-series synchronization unit;

[0215] The data acquisition unit, deployed at edge nodes, is used to collect multi-dimensional attribute information;

[0216] The lightweight AI perception unit, with an embedded lightweight convolutional neural network model, is used to receive multi-dimensional attribute information, extract abnormal features and security baseline deviation values, and output the initial security posture code.

[0217] The timing synchronization unit is used for synchronization protocols based on logical clocks to perform timestamp alignment and state consistency verification on the initial security posture codes from different nodes, eliminating spatiotemporal deviations.

[0218] The security policy meta-modeling module includes: fingerprint generation unit, matching degree calculation unit, adaptive clustering unit, and policy blueprint generation unit;

[0219] The fingerprint generation unit is used to generate traffic feature fingerprints and adaptive environment fingerprints.

[0220] The matching degree calculation unit is used to calculate the weighted fusion matching degree score of traffic characteristics and environmental adaptation characteristics between any two nodes using an improved cosine similarity algorithm.

[0221] The adaptive clustering unit is used to dynamically adjust the similarity threshold according to the business scenario, cluster nodes with high matching degree, and generate edge security entity nodes.

[0222] The policy blueprint generation unit is used to generate a machine-readable security policy blueprint for each edge security entity node, defining its permitted behaviors, access permissions, and response actions. All blueprints together constitute the security policy metamodel.

[0223] The control execution module includes: a strategy mapping and distribution unit, an inter-layer collaborative control unit, and an adjustment unit;

[0224] The policy mapping and distribution unit is used to map the policy rules in the dynamic security enhancement model to the edge local protection layer, the link encryption layer, and the cloud audit layer, respectively, according to their type and scope.

[0225] The inter-layer collaborative control unit, as the central nervous system of the hierarchical model, establishes a control bus and information exchange interface between the three layers to achieve cross-level collaborative linkage.

[0226] The adjustment unit, acting as a feedback controller, dynamically adjusts the protection strength of each level based on real-time security events and resource consumption indicators, thereby achieving a balance between security and efficiency.

[0227] The embodiments of the present invention have been described above with reference to the accompanying drawings. However, the present invention is not limited to the specific embodiments described above. The specific embodiments described above are merely illustrative and not restrictive. Those skilled in the art can make changes, modifications, substitutions and variations to the above embodiments under the guidance of the present invention without departing from the spirit and scope of the present invention. All of these variations are within the protection scope of the present invention.

Claims

1. A method for secure access to internal and external networks based on edge computing, characterized in that, include: Obtain multi-dimensional attribute information of edge nodes, process it through a lightweight AI perception algorithm on the edge side and synchronize it through a distributed time-series synchronization protocol to generate a basic dataset for security policies; Based on the security policy basic dataset, traffic feature fingerprints and adaptive environment adaptation fingerprints are generated. An improved cosine similarity algorithm is used to calculate the weighted fusion matching score between any two nodes' traffic feature fingerprints and adaptive environment adaptation fingerprints. Combined with adaptive threshold clustering based on business scenarios, nodes with high matching scores are clustered as edge security entity nodes. A security policy blueprint is generated for each edge security entity node. All security policy blueprints are combined to form a security policy meta-model. The security policy meta-model is parsed using a multimodal semantic parsing engine, and a dynamic security enhancement model is generated through security rule conflict prediction and dynamic rule mapping. Map the policy rules in the dynamic security enhancement model to the hierarchical security control model according to their type and scope. The layered security control model includes an edge-local protection layer, a link encryption layer, and a cloud audit layer; Based on the hierarchical security control model, the security access configuration for the internal and external networks of the edge nodes is generated through a scenario-based configuration generation algorithm, and the security access ledger of the corresponding edge nodes is output synchronously.

2. The method for secure access to internal and external networks based on edge computing as described in claim 1, characterized in that, The acquisition of multi-dimensional attribute information of edge nodes includes: A scan is performed on the local system directory of the edge node and the management information database of associated network devices to extract associated object data; the associated object data includes the port number and service type of the communication port of the intranet business system, the mapping rules and port range of the extranet service port, the routing topology of the network link redundancy path and the priority of the backup link; The associated object data is recorded as edge node-network object dependency association metadata in a structured format of edge node identifier-network object type-dependency parameter; The dependent metadata is matched and merged with the hardware architecture parameters, network access types and service traffic characteristics collected by the edge nodes to generate multi-dimensional attribute information of the edge nodes, and a timestamp and version identifier are added to it; the multi-dimensional attribute information is standardized and encapsulated to form an attribute information vector.

3. The method for secure access to internal and external networks based on edge computing as described in claim 2, characterized in that, The basic dataset for generating security policies includes: The attribute information vector is input into a lightweight convolutional neural network model deployed at the edge. The lightweight convolutional neural network model is trained using knowledge distillation technology to extract abnormal features and safety baseline deviation values ​​from the multi-dimensional attribute information of the edge node, and outputs an initial security posture code that represents the instantaneous security state of the node. The initial security posture codes output in parallel from multiple edge nodes are coordinated by a distributed synchronization protocol based on a logical clock to output a set of initial security posture codes after time synchronization; the distributed synchronization protocol based on a logical clock performs timestamp alignment and state consistency verification on all initial security posture codes. The initial security posture encoding set after time synchronization is associated and integrated with the corresponding attribute information vector to form a standardized security policy data record; All standardized security policy data records are aggregated to form the basic dataset of the security policy.

4. The method for secure access to internal and external networks based on edge computing as described in claim 3, characterized in that, The generated security policy metamodel includes: Based on the security policy dataset, traffic feature fingerprints and adaptive environment fingerprints are generated. A predetermined number of traffic record samples are uniformly sampled over time from the local logs corresponding to each edge node in the security policy basic dataset to form a traffic behavior dataset. For each real-time traffic field in the traffic behavior dataset, a real-time feature vector is calculated; the real-time feature vector consists of the minimum, maximum, mean, and variance within the statistical period. For each non-real-time traffic field in the traffic behavior dataset, a traffic behavior fingerprint is generated by statistically analyzing the frequency of a preset quantity interval and the proportion of abnormal traffic; the preset quantity interval frequency is the frequency of occurrence of a preset quantity interval selected in descending order of data volume frequency. The real-time feature vector and the traffic behavior fingerprint are fused to form a fused feature fingerprint.

5. The method for secure access to internal and external networks based on edge computing as described in claim 4, characterized in that, The generated security policy metamodel also includes: For any two edge nodes, calculate the Euclidean distance of the traffic feature fingerprint, the cosine similarity of the environment adaptation fingerprint, and the similarity of the fused feature fingerprint, and obtain the comprehensive matching score between nodes according to the preset weighting coefficient. Based on the adaptive threshold of the business scenario, edge nodes with a comprehensive matching score not lower than the threshold are clustered and merged according to the strategy to form edge security entity nodes; each node in the edge security entity node represents a group of edge devices that can reuse the same security strategy. Generate a security policy blueprint for each edge security entity node, and at the same time, build a mapping table to establish a mapping relationship between each edge security entity node and all the original edge nodes it contains; A structured security policy meta-model is constructed based on the security policy blueprint and mapping relationship table, and stored as a structured model file.

6. The method for secure access to internal and external networks based on edge computing as described in claim 5, characterized in that, The generation of traffic feature fingerprints and adaptive environment-adaptive fingerprints based on the security policy dataset includes: Deep packet inspection and flow behavior analysis are performed on the network traffic data in the security policy basic dataset to extract features including protocol type, payload size, communication cycle, and source / destination IP port tuples. After hashing, a traffic feature fingerprint is generated. The traffic feature fingerprint is used to uniquely identify the service traffic pattern of the edge node. The environmental attribute data in the security policy basic dataset is input into the pre-trained edge environment adaptation model. The edge environment adaptation model transforms the environmental attribute data into a standardized semantic vector, i.e., an adaptive environment adaptation fingerprint. The edge environment adaptation model is trained based on edge device scenario data. The environmental attribute data includes hardware architecture, network access type, and security level weights. The adaptive environment adaptation fingerprint is used to characterize the adaptive configuration capability of a node under the current network topology, resource constraints, and external threat environment.

7. The method for secure access to internal and external networks based on edge computing as described in claim 6, characterized in that, The generated dynamic security enhancement model includes: The multimodal semantic parsing engine is used to parse the security policy blueprint in the security policy metamodel; the multimodal semantic parsing engine combines natural language processing and ontology knowledge graph technology to convert the policy description in the security policy blueprint into formal logical assertions and security constraints. The parsed formal logical assertions and security constraints are logically reasoned and correlated with the basic security rules in the predefined global security knowledge base to detect whether there are permission conflicts, behavioral contradictions or security vulnerabilities between policies. Security policies that are determined to be conflict-free after testing are marked as compliant. For security policies that are determined to be conflicting after detection, dynamic adjustments and remapping are performed based on the conflict resolution principles in the global security knowledge base to generate a set of consistent and conflict-free intermediate security rules. The intermediate security rule set is correlated and fused with real-time threat intelligence from external input, and then injected with proactive defense rules based on the latest threat intelligence to generate a complete set of security policies that include triggering conditions, execution actions, and scope of effectiveness, namely, the dynamic security enhancement model.

8. The method for secure access to internal and external networks based on edge computing as described in claim 7, characterized in that, When mapping policy rules in the dynamic security enhancement model to the layered security control model according to their type and scope, the policy rules in the dynamic security enhancement model are classified and mapped to the three levels of the layered security control model according to their protection scope and execution point, including: The traffic update frequency of each original edge node constituting each edge security entity node is obtained in the most recent network communication cycle, and the fluctuation variance of the traffic update frequency of each original edge node is calculated by a variance calculation algorithm; the fluctuation variance is used to characterize the difference in traffic stability between nodes. If the variance of traffic fluctuation of each original edge node within the same edge security entity node is greater than the preset tear threshold, it is determined that there are child nodes with significantly different traffic characteristics within the node. They are split into real-time traffic child nodes and regular traffic child nodes according to the traffic update frequency. The real-time traffic child nodes are mapped to the edge local protection layer of the layered security control model, and the regular traffic child nodes are mapped to the link encryption layer. A source layer reference pointer is established between the two child nodes. If the traffic fluctuation variance is less than or equal to the preset tear threshold, it is determined that the traffic characteristics of each original edge node in the edge security entity node are consistent, and the node is directly mapped to the layered security control model according to the average traffic update frequency of the node. When the average traffic update frequency is higher than the frequency threshold, it is mapped to the edge local protection layer, and when it is lower than or equal to the frequency threshold, it is mapped to the link encryption layer. The security policy execution logs of all edge security entity nodes are synchronized to the cloud audit layer. The security policy execution logs are standardized audit records generated by the edge local protection layer and link encryption layer after executing the set of security policies issued by the dynamic security enhancement model, which record the entire process and results of security policy execution.

9. The method for secure access to internal and external networks based on edge computing as described in claim 8, characterized in that, The scenario-based configuration generation algorithm takes the policies mapped in the layered security control model as input and combines them with the predefined internal and external network access control matrix to automatically generate specific firewall rules, VPN configurations, and access control lists applicable to edge nodes, i.e., the secure access configuration. The scenario-based configuration generation algorithm also incorporates digital twin technology, which simulates and verifies the generated secure access configuration on the digital twin of the target edge node before deployment.

10. An edge computing-based intranet and extranet security service access system, used to implement the edge computing-based intranet and extranet security service access method according to any one of claims 1-9, characterized in that, include: Data acquisition module, security policy meta-modeling module, enhancement engine module, control execution module, and scenario-based configuration module; The data acquisition module is used to collect multi-dimensional attribute information from distributed edge nodes in real time, and perform preliminary intelligent processing and standardization to generate a basic dataset for security policies. The security policy meta-modeling module is used to automatically identify groups of edge nodes with similar security needs based on the security policy basic dataset, through feature extraction, similarity calculation and cluster analysis, and generate a basic security policy blueprint for each entity to build the security policy meta-model of the entire system. The enhancement engine module is used to parse, detect conflicts, and intelligently enhance the security policy metamodel, transforming the static blueprint into a dynamic security policy model. The control execution module is used to receive the dynamic security enhancement model and distribute the security policies therein to security execution points at different levels. The scenario-based configuration module is used to transform the hierarchical security control model into configuration instructions that can be executed by edge nodes, and to automatically generate and manage a logbook of all configuration changes.

Images