Local area network device network security early warning method based on zero trust architecture

Abstract

The application discloses a local area network device network security early warning method based on a zero trust architecture, and relates to the technical field of network security.Through technical means such as access request interception and processing, dynamic identity authentication, terminal behavior analysis and device security index evaluation, real-time security monitoring and early warning of terminal devices in a local area network are realized; through a blocking module, access requests of the local area network are grouped and processed, and an access request sequence is constructed based on time, space and structural characteristics; then, a terminal device is subjected to multi-factor dynamic identity authentication by using a big data analysis module, and safe and reliable terminal devices are screened out in combination with device behavior baselines and matching degree calculation; next, the current device security index of the terminal device is evaluated by means of system logs and memory usage rate data in a backtracking period; finally, the access request is released or blocked according to a security index threshold, and corresponding early warning information is generated, thereby providing decision support for network security management.

Description

Technical Field

[0001] This invention belongs to the field of network security technology, specifically relating to a network security early warning method for local area network devices based on a zero-trust architecture. Background Technology

[0002] With the rapid development of information technology and the widespread use of network devices, local area networks (LANs) have become an important infrastructure for network connections for enterprises, institutions, and individuals. Against the backdrop of digital transformation, the complexity of network devices and the number of connections are growing exponentially, and security threats in the network environment are becoming increasingly diversified.

[0003] Existing technologies typically rely on traditional perimeter security models, such as firewalls and static access control lists. These methods assume that devices within the local area network are trustworthy, leading to significant shortcomings in dealing with internal threats and dynamic attacks. For example, existing technologies often use simple IP address or MAC address binding for device authentication, lacking continuous monitoring and contextual analysis of device behavior. This allows attackers to move freely laterally within the network once they breach the perimeter, making them difficult to detect and prevent. Furthermore, existing authentication mechanisms are mostly based on single factors, such as passwords or certificates, making them vulnerable to credential theft or man-in-the-middle attacks, and they cannot adapt to changes in device behavior, resulting in high false positive or false negative rates. In terms of access request processing, existing technologies often use coarse-grained first-come-first-served queue management, lacking intelligent grouping based on request type, time, or device characteristics. This causes processing delays and resource waste, and fails to prioritize high-risk requests. At the same time, existing methods often rely on static rules for risk assessment, resulting in incomplete security status assessments and delayed responses.

[0004] To address the aforementioned issues, this invention proposes a network security early warning method for local area network devices based on a zero-trust architecture. Summary of the Invention

[0005] To address the shortcomings of existing technologies, this invention provides a network security early warning method for local area network devices based on a zero-trust architecture, which solves the problems of poor adaptability, low efficiency, and insufficient security of existing technologies when facing complex threats in a zero-trust environment.

[0006] The objective of this invention can be achieved through the following technical solutions:

[0007] A network security early warning method for local area network devices based on a zero-trust architecture, the method comprising:

[0008] Step 1: Use the pre-built interception module to intercept access requests to the target local area network. Group the intercepted access requests based on the type of the access request and add the access requests in the same group to the access request waiting queue in chronological order.

[0009] Step 2: Based on the determined access request waiting queues, select any one of the access request waiting queues and serialize all access requests in this access request waiting queue to construct an access request sequence.

[0010] Based on a pre-built big data analysis module, the terminal devices associated with each access request in the access request sequence are obtained in real time. Multi-factor dynamic identity authentication is performed on each terminal device to obtain all authenticated terminal devices and their associated access requests, and to construct a refined terminal device sequence and a refined access request sequence.

[0011] Step 3: Within the preset backtracking period, obtain the system logs and memory usage associated with each terminal device in the refined terminal device sequence, and evaluate the current device security index of the terminal device.

[0012] Based on the current device security index of the terminal device, access requests from each terminal device are allowed or blocked, and warning information is generated for warning purposes.

[0013] As a further aspect of the present invention, the specific method for grouping the intercepted access requests based on the type of the access request in step one is as follows:

[0014] Determine the current time, and denote it as T0;

[0015] Get any access request Q obtained at the current time T0;

[0016] Get the source IP address of the terminal device associated with access request Q, and denote it as Q_IP;

[0017] Obtain the target IP address of the target local area network and record it as G_IP;

[0018] Calculate the absolute value of the difference between the last octet of Q_IP and the last octet of G_IP, and use it as the spatial feature of the access request Q, denoted as SP_Q;

[0019] Determine the number of minutes in the current time T0, and denote it as 0;

[0020] Divide the number of minutes o by the preset time granularity parameter u and round down to obtain the time characteristic of the access request Q, denoted as TE_Q;

[0021] Calculate the CRC32 checksum value of the entire data packet of access request Q excluding the Ethernet frame header, and perform a modulo 10 operation to obtain the structural characteristics of access request Q, denoted as ST_Q;

[0022] The GroupID associated with the access request Q is calculated using GP_ID=(SP_Q*P1 XOR TE_Q*P2 XOR ST_Q*P3) MOD N, where P1, P2, and P3 are preset coprime prime numbers, XOR is a bitwise XOR operation, MOD is a modulo operation, ensuring that GroupID∈[0,N-1], and N is the preset maximum number of groups;

[0023] Based on the group identifier GroupID of access request Q, access request Q is included in the corresponding group.

[0024] As a further aspect of the present invention, the grouping operation in step one also includes a predefined dynamic grouping mapping table;

[0025] The mapping relationship in the dynamic group mapping table is: group identifier — group — access request waiting queue;

[0026] The dynamic group mapping table is initially empty. After determining the group identifier GroupID of the access request Q, a query is performed in the dynamic group mapping table.

[0027] If the group identifier GroupID exists, the access request Q will be added to the access request waiting queue associated with the corresponding group in chronological order.

[0028] If the group identifier GroupID does not exist, a new access request waiting queue is created, and the GroupID is bound to the new access request waiting queue. The access request Q is then included in this access request waiting queue.

[0029] As a further aspect of the present invention, the specific method for constructing the access request sequence in step two is as follows:

[0030] Get any access request waiting queue, extract all access requests in this access request waiting queue, and sort them according to the order of the access request waiting queue to get Q1, Q2, ..., Qj, where j is the number of access requests;

[0031] Obtain the source IP addresses of the terminal devices for the j access requests in sequence, resulting in Q1_IP, Q2_IP, ..., Qj_IP;

[0032] Then, sort the j access requests in ascending order according to the value of the last eight bits of the source IP address of each terminal device to obtain the access request sequence Q1',Q2',...,Qj'.

[0033] As a further aspect of the present invention, the specific method for performing multi-factor dynamic identity authentication on each terminal device in step two is as follows:

[0034] Take the terminal devices of each of the j access requests in the access request sequence Q1', Q2', ..., Qj' in order to obtain the terminal device sequence M1, M2, ..., Mj, where Qi' corresponds to Mi, i is the counting index, 1≤i≤j;

[0035] Extract any one terminal device Mi from the terminal device sequence M1, M2, ..., Mj;

[0036] Based on the big data analysis module, the historical access records of terminal device Mi to the target local area network are obtained, and a baseline of device behavior of terminal device Mi is constructed.

[0037] The device behavior baseline includes the typical access time period, commonly used protocol types, and access frequency range of terminal device Mi in the past 24 hours.

[0038] Get the request time T_Qi', protocol type X_Qi', and time interval ΔT_Qi' between the access request Qi' and the previous access request;

[0039] The matching degree Score between access request Qi' and the device behavior baseline of terminal device Mi is calculated using Score=α×f(T_Qi')+β×g(X_Qi')+γ×h(ΔT_Qi').

[0040] Where α, β, and γ are preset weight coefficients, α+β+γ=1, and α, β, and γ are all greater than 0. f(T_Qi') is a time matching function, which returns 1 if T_Qi' is within a typical access time period, and 0 otherwise. g(X_Qi') is a protocol matching function, which returns 1 if X_Qi' is a common protocol type, and 0 otherwise. h(ΔT_Qi') is a frequency matching function, which returns 1 if ΔT_Qi' is within the access frequency range, and 0 otherwise.

[0041] Obtain the preset matching threshold θ. If Score ≥ θ, determine that the terminal device Mi has passed the identity authentication.

[0042] Conversely, if the authentication of the terminal device Mi fails, the authentication failure will be recorded in the system log of the terminal device Mi.

[0043] Similarly, multi-factor dynamic identity authentication is performed on the terminal devices associated with each access request in the access request sequence.

[0044] As a further aspect of the present invention, in step two, if it is determined that the terminal device Mi has failed authentication, the access request Qi' of the terminal device Mi is blocked.

[0045] As a further aspect of the present invention, the specific method for constructing the essence terminal device sequence and the essence access request sequence in step two is as follows:

[0046] Take all access requests associated with authenticated terminal devices in the terminal device sequence M1, M2, ..., Mj, sort them according to the order of the access request sequence to obtain the refined access request sequence Q1'', Q2'', ..., Qm'', where m is the counting index, representing the total number of access requests in the refined access request sequence, and 0≤m≤j;

[0047] The terminal devices that have passed authentication are sorted in the order of the access request sequence to obtain the terminal device sequence M1', M2', ..., Mm', where Qn'' corresponds to Mn', n is the counting index, and 1≤n≤m.

[0048] As a further aspect of the present invention, the specific method for evaluating the current device security index of the terminal device in step three is as follows:

[0049] Obtain the backtracking period T_re preset by the operator;

[0050] Starting from the current time T0, we trace back one back period T_re to obtain the start time of this back period T_re, which we denote as T1.

[0051] From start time T1 to current time T0, obtain the system log of any terminal device Mn' in the sequence of refined terminal devices, count the number of authentication failures in the system log, and denote the total number of authentication failures as k.

[0052] Arrange the k authentication failure behaviors in chronological order to obtain the authentication failure behavior sequence AF1, AF2, ..., AFk;

[0053] Obtain the time points of k authentication failures to obtain the time point sequence t1, t2, ..., tk;

[0054] Obtain the time interval preset by the operator, and use each time point in the time point sequence as the end time of a time interval to determine k time intervals, which are tp1, tp2, ..., tpk in chronological order;

[0055] Determine the memory usage rate of terminal device Mn' at each time point within k time intervals, and average the memory usage rate at each time point within the same time interval to determine the average memory usage rate for each time interval.

[0056] The resulting k average memory usage rates are denoted as the average memory usage rate sequence Ar1, Ar2, ..., Ark in the order of the time interval sequence;

[0057] For any authentication failure behavior AFv, the associated time decay factor W_time_v is calculated using W_time_v=exp(-λ× (T0-tv)).

[0058] λ is the attenuation coefficient preset by the operator, exp is the natural exponential function, and tv is any time point in the time sequence t1, t2, ..., tk;

[0059] Based on the average memory usage Arv of the authentication failure behavior AFv, determine the memory risk factor W_Arv associated with the authentication failure behavior AFv, where v is the counting index, 1≤v≤k;

[0060] Arv≤Ar_low, set the memory risk factor W_Arv=0;

[0061] Arv≥Ar_high, let the memory risk factor W_Arv=1;

[0062] Ar_low < Arv < Ar_high, let the memory risk factor W_Arv = (Arv - Ar_low) / (Ar_high - Ar_low);

[0063] Ar_low and Ar_high are preset memory usage thresholds, representing the upper limit of normal memory usage and the lower limit of abnormal memory usage, respectively.

[0064] Extract the memory risk factor W_Arv and time decay factor W_time_v of the authentication failure behavior AFv, and calculate the risk value Risk_v of the authentication failure behavior AFv using Risk_v=W_time_v×W_Arv;

[0065] Using Total_Risk=∑ i=1 k Risk_v determines the total risk value Total_Risk for terminal device Mn';

[0066] The device security index DSI_Mn' of terminal device Mn' is calculated using DSI_Mn'=max(0,100-Total_Risk×Scale_Factor), where Scale_Factor is a preset scaling factor that maps the total risk value to the device security index, and DSI_Mn'∈[0,100].

[0067] Similarly, determine the device security index associated with each terminal device in the essence terminal device sequence.

[0068] As a further aspect of the present invention, the specific method for generating early warning information and issuing early warnings in step three is as follows:

[0069] Obtain the device security index DSI_Mn' of any terminal device Mn' and compare it with the preset device security index threshold DSI_yu;

[0070] If DSI_Mn' > DSI_yu, allow the terminal device Mn's access request Qn'';

[0071] Conversely, if the terminal device Mn's access request Qn'' is blocked, an early warning message associated with the terminal device Mn' is generated and the operator is alerted.

[0072] The beneficial effects of this invention are:

[0073] (1) This invention significantly improves the initiative and accuracy of network security by integrating interception, authentication and evaluation mechanisms through a network security early warning method for local area network devices based on zero trust architecture. First, the interception module is used to group and serialize access requests, and combined with the big data analysis module to realize multi-factor dynamic identity authentication, ensuring that only verified terminal devices can enter the core sequence, thereby effectively preventing unauthorized access and internal threats. Second, the device security index is evaluated by real-time monitoring of system logs and memory usage, dynamically deciding whether to allow or block access requests and generating early warning information. This not only enhances the real-time protection capability of the network environment, but also improves the speed and accuracy of threat response. Overall, the zero trust principle is applied in a comprehensive manner, reducing security risks, improving the overall resilience and operation and maintenance efficiency of the local area network, and reducing false alarms and false alarms, ensuring the continuity and reliability of network security management.

[0074] (2) This invention integrates time, space and structure three-dimensional features and introduces a dynamic mapping mechanism to realize intelligent and refined classification management of access requests. Its core advantage is that it uses composite features to calculate and generate unique group identifiers, which effectively avoids the collision and imbalance problems that may be caused by traditional single feature grouping, and significantly improves the accuracy and distinguishability of grouping operations. Secondly, the introduction of dynamic group mapping table enables the system to adaptively create and manage queues without pre-configuration, which greatly enhances the elasticity and scalability when facing new or unknown access requests. This refined and adaptive grouping strategy lays a high-quality data foundation for subsequent multi-factor authentication and security assessment, ensuring the timeliness and accuracy of security warnings, thereby optimizing the efficiency and reliability of network access control under the zero-trust architecture as a whole.

[0075] (3) This invention achieves a significant improvement in security and efficiency by sorting access requests by source IP address and combining multi-factor dynamic identity authentication based on device behavior baseline. Its core advantage is that the IP sorting strategy can centrally process device access requests from adjacent network segments, optimizing the data processing efficiency of the authentication module. Secondly, the authentication mechanism can accurately identify abnormal access behavior by quantitatively analyzing the matching degree between access time, protocol type, access frequency and behavior baseline, effectively preventing security risks such as credential theft. For requests that fail authentication, real-time blocking and early warning are generated to ensure timely response. The final "essence sequence" only contains accesses that have passed strict dynamic verification, improving the input quality of subsequent security assessment steps, thereby building an efficient and proactive security defense line with deep threat identification capabilities under the zero-trust architecture.

[0076] (4) This invention achieves accurate quantification and dynamic response to terminal device security risks by deeply integrating historical behavior and real-time resource status. Its core advantage lies in not only counting the number of authentication failures, but also innovatively introducing time decay factors and memory risk factors, so that recent abnormal behaviors accompanied by high resource consumption are given higher risk weights, thereby significantly improving the sensitivity and accuracy of identifying potential threats. By quantifying multi-dimensional risks into an intuitive device security index, it provides a clear and scientific basis for access control decisions, realizing the leap from simple "authentication passed" to continuous "trust assessment". This automatic release and blocking mechanism based on dynamic risk scoring can quickly respond to and warn of latent attacks and internal threats, improve the initiative and intelligence level of security protection under the zero trust architecture, and ensure the continuous security of network access and the principle of least privilege. Attached Figure Description

[0077] The invention will now be further described with reference to the accompanying drawings.

[0078] Figure 1 This is a flowchart illustrating the method described in this invention;

[0079] Figure 2 This is a flowchart illustrating the content described in Embodiment 2 of the present invention;

[0080] Figure 3 This is a flowchart illustrating the content described in Embodiment 3 of the present invention;

[0081] Figure 4 This is a flowchart illustrating the content described in Embodiment 4 of the present invention. Detailed Implementation

[0082] The technical solutions of the embodiments of the present invention will be clearly and completely described below with reference to the accompanying drawings. Obviously, the described embodiments are only some embodiments of the present invention, and not all embodiments. Based on the embodiments of the present invention, all other embodiments obtained by those skilled in the art without creative effort are within the scope of protection of the present invention.

[0083] Example 1

[0084] Network security early warning methods for LAN devices based on zero-trust architecture, such as Figure 1 As shown, this method includes the following:

[0085] This method is a network security early warning method for LAN devices based on zero-trust architecture. First, it captures LAN access requests through an interception module and then performs dynamic grouping and queuing management based on their spatial, temporal, and structural characteristics.

[0086] The requests in the queue are then serialized, and big data analysis is used to compare the real-time behavior of the devices with historical baselines. Multi-factor dynamic identity authentication is then performed to filter out highly trustworthy "elite" devices and requests.

[0087] Finally, within a preset backtracking period, the system logs and memory usage of these certified devices are comprehensively evaluated to quantify their device security index. Based on this index, dynamic access requests are allowed, blocked, and risk warnings are issued, thereby achieving continuous trust assessment and adaptive security control of intranet terminals from identity to behavior.

[0088] This method mainly includes the following specific steps:

[0089] The first step is to use a pre-built interception module to intercept access requests to the target local area network. The intercepted access requests are grouped based on their type, and requests within the same group are added to an access request waiting queue in chronological order. Specifically:

[0090] The system uses pre-built interception modules (such as Wireshark or Fiddler) to intercept all access requests to the target local area network in real time. After interception, each access request is grouped to ensure the efficiency and targeting of subsequent processing. The grouping process is based on multiple dynamic features, including spatial features, temporal features and structural features.

[0091] This step also includes an automatically maintained dynamic packet mapping table that records the mapping relationship between packet identifiers and access request waiting queues. When a new access request's packet identifier does not exist, the system will create a new queue and bind the identifier; otherwise, the request will be added directly to the existing queue in chronological order. This mechanism ensures the adaptability and scalability of packets, enabling flexible responses to changes in network traffic.

[0092] Finally, the access requests in the same group after the grouping operation are added to the same access request waiting queue in chronological order.

[0093] The second step is to select any one of the determined access request waiting queues and serialize all access requests in this access request waiting queue to construct an access request sequence.

[0094] Based on a pre-built big data analytics module, the system acquires the terminal devices associated with each access request in the access request sequence in real time, performs multi-factor dynamic identity authentication on each terminal device, obtains all authenticated terminal devices and their associated access requests, and constructs a refined terminal device sequence and a refined access request sequence. Specifically:

[0095] Based on the first step, all access requests are extracted from any access request waiting queue (indicating that the access request is in a waiting state) and an access request sequence is constructed (indicating that the access request has entered the processing state). The serialization process first arranges the access requests in the queue according to their time order, and then sorts them in ascending order based on the last eight bits of the source IP address to optimize the efficiency of subsequent processing and data locality.

[0096] Next, using a pre-built big data analytics module, multi-factor dynamic identity authentication is performed on the terminal device associated with each access request in the access request sequence.

[0097] The big data analysis module includes various neural network models that utilize big data analysis technology. The authentication process is based on the historical behavior data of the terminal device to build a device behavior baseline, including typical access time periods, common protocol types, and access frequency ranges.

[0098] For each access request, the system extracts the request time, protocol type, and time interval between the previous access, and calculates the matching degree with the device behavior baseline using a weighted function. The matching degree comprehensively considers time, protocol, and frequency factors and uses a preset weight coefficient for balance. If the matching degree is lower than the threshold, the authentication is determined to be failed, and the access request is immediately blocked. At the same time, the failure behavior is recorded to the system log and an early warning message is generated; otherwise, the authentication is determined to be successful.

[0099] The terminal devices that have passed authentication (ensuring that only highly trusted terminal devices can enter the subsequent processing stage, thereby reducing security risks) and their access requests are extracted separately, and a refined terminal device sequence and a refined access request sequence are constructed according to the original sequence order.

[0100] The third step is to obtain the system logs and memory usage associated with each terminal device in the refined terminal device sequence within the preset backtracking period, and to evaluate the current device security index of the terminal device.

[0101] Based on the current device security index of each terminal device, access requests from each terminal device are allowed or blocked, and warning information is generated for alerting. Specifically:

[0102] Within a preset backtracking period, the system performs a security assessment on each terminal device in the sequence of refined terminal devices. The security assessment is mainly based on two key data sources: first, the authentication failure records in the system logs of the terminal devices; and second, the memory usage of the terminal devices.

[0103] First, count the number of authentication failures of the terminal device within the backtracking period and arrange them in chronological order. For each authentication failure, calculate its time decay factor and memory risk factor. Multiply these two factors to obtain the risk value of a single authentication failure. Then, sum the risk values ​​of all failures to obtain the total risk value of the terminal device.

[0104] Finally, by mapping the total risk value to a range of 0 to 100, the security index of each terminal device is displayed; the higher the device security index, the more secure the terminal device is; the preset scaling factor used in the mapping process ensures that the index reflects the actual risk level.

[0105] Based on the device security index, access control decisions are made: if the device security index is higher than a preset threshold, the access request for the terminal device is allowed; otherwise, the access request is blocked and an early warning message is generated to alert the operator of potential security threats.

[0106] Example 2

[0107] This embodiment further discloses the detailed steps involved in the first step based on embodiment 1, such as... Figure 2 As shown, it specifically includes the following:

[0108] The first step described in Example 1 mainly includes intercepting access requests using an interception module and grouping the intercepted access requests based on their type, as detailed below:

[0109] First, determine the current time and record it as T0. Then, determine any access request that the interception module intercepts at the current time T0 and record this access request as Q.

[0110] The access request Q can represent any access request, and the following steps are for example processing. All other access requests will be processed in the same way.

[0111] Next, obtain the source of the access request Q, that is, the terminal device associated with the access request Q, and further obtain the source IP address of this terminal device, and record it as Q_IP, which indicates that it is the source IP address of the terminal device associated with the access request Q.

[0112] Next, obtain the target IP address of the target local area network and denote it as G_IP;

[0113] Obtain the last octet of the source IP address Q_IP, then obtain the last octet of the destination IP address G_IP. Calculate the absolute value of the difference between the last octet of the destination IP address G_IP and the last octet of the source IP address Q_IP, and use the calculated absolute value of the difference as the spatial feature associated with the access request Q, denoted as SP_Q.

[0114] For example: if the source IP address is 192.168.1.10 and the destination IP address is 192.168.1.200, then the absolute value of the difference = |10-200| = 190, which indicates the distance intention of the terminal device in sending the access request within this local area network;

[0115] Next, obtain the number of minutes of the current time T0 and record it as 0;

[0116] The minutes are explained as follows: if the current time T0 is 10:36, then the minutes o = 36; if T0 is 10:37, then the minutes o = 37, and so on.

[0117] Then divide the number of minutes o by the time granularity parameter u preset by the operator, and round down. Finally, record the calculated result as the time feature associated with the access request Q, denoted as TE_Q.

[0118] For example: if the number of minutes o=36 and the time granularity parameter u=5, then the time feature TE_Q=7.

[0119] Next, the CRC32 checksum value of the entire data packet of access request Q, excluding the Ethernet frame header, is calculated, and a modulo 10 operation is performed on this CRC32 checksum value. The final result is recorded as the structural feature associated with access request Q, denoted as ST_Q.

[0120] For example, the modulo 10 operation is as follows: ST_Q = CRC32(the entire data packet of access request Q) % 10.

[0121] Thus, the three parameters associated with the access request Q are: spatial feature SP_Q, temporal feature TE_Q, and structural feature ST_Q.

[0122] The GroupID associated with the access request Q is calculated by using: GP_ID=(SP_Q*P1 XOR TE_Q*P2 XOR ST_Q*P3) MOD N. Here, P1, P2, and P3 are coprime prime numbers preset by the operator to amplify the differences between different features and avoid collisions. XOR (⊕) represents the bitwise XOR operation, used to mix bits of different features. MOD is the modulo operation, ensuring that the calculated GroupID is within the range of 0 to N-1, where N is the maximum number of groups preset by the operator.

[0123] The calculation formula for the group identifier GroupID is essentially a custom hash function that maps three features to the group identifier, taking into account the spatial, temporal, and structural characteristics of the access request.

[0124] After determining the GroupID of the access request Q, the access request Q is included in the corresponding group according to the dynamic group mapping table predefined by the operator.

[0125] The mapping relationship in the dynamic group mapping table is: group identifier — group — access request waiting queue;

[0126] The dynamic group mapping table is initially empty. After the group identifier GroupID of the access request Q is determined, the group identifier GroupID is queried in the dynamic group mapping table.

[0127] If the group identifier GroupID already exists, the access request Q will be added to the access request waiting queue associated with the corresponding group in chronological order.

[0128] If the GroupID does not exist, a new access request waiting queue is created, and the GroupID is bound to the new access request waiting queue. Then, the access request Q is added to this access request waiting queue.

[0129] Example 3

[0130] This embodiment further discloses the specific steps involved in the second step based on embodiment 2, such as... Figure 3 As shown, it specifically includes the following:

[0131] Based on the content described in Example 2, several access request waiting queues can be obtained. Any one of the access request waiting queues can be extracted from the several access request waiting queues for example processing.

[0132] Retrieve all access requests in this access request waiting queue, and represent the retrieved access requests according to the order of the access request waiting queue to obtain: Q1, Q2, ..., Qj, where j is the number of access requests in this access request waiting queue.

[0133] Next, obtain the source IP addresses of the terminal devices for each of the j access requests: Q1, Q2, ..., Qj, and sort them according to the order of the j access requests Q1, Q2, ..., Qj, represented as: Q1_IP, Q2_IP, ..., Qj_IP;

[0134] Then, obtain the last octet of the source IP address of each of the j access requests, sort the j access requests in ascending order according to the value of the last octet, and record the sorted result as the access request sequence, represented as: Q1',Q2',...,Qj' (in this way, access requests from terminal devices with similar or identical source IP addresses will be arranged together for easy synchronous processing).

[0135] Next, obtain the terminal devices associated with each of the j access requests in the access request sequence Q1', Q2', ..., Qj', and sort them according to the order of the access request sequence Q1', Q2', ..., Qj'. This sorted sequence is denoted as M1, M2, ..., Mj, where access request Qi' corresponds to terminal device Mi, and i is the counting index, with a value range from 1 to j.

[0136] Next, any terminal device Mi is extracted from the terminal device sequence M1, M2, ..., Mj. The historical access records of terminal device Mi to the target local area network are obtained using the pre-built big data analysis module, and a device behavior baseline of terminal device Mi is constructed.

[0137] It should be explained that the device behavior baseline of terminal device Mi includes the typical access time period, commonly used protocol types, and access frequency range of terminal device Mi in the past 24 hours (i.e., the lowest access frequency and the highest access frequency per unit time).

[0138] Then, obtain the request time T_Qi', protocol type X_Qi', and time interval ΔT_Qi' between the current access request Qi' associated with terminal device Mi and the previous access request for terminal device Mi;

[0139] Next, the matching degree Score between access request Qi' and the device behavior baseline of terminal device Mi is calculated using Score=α×f(T_Qi')+β×g(X_Qi')+γ×h(ΔT_Qi'), where α, β and γ are all preset weight coefficients of the operation, and α+β+γ=1, and α, β and γ are all greater than 0.

[0140] f(T_Qi') is a time matching function. It returns 1 if T_Qi' is within a typical access time period, and 0 otherwise. g(X_Qi') is a protocol matching function. It returns 1 if X_Qi' is a common protocol type, and 0 otherwise. h(ΔT_Qi') is a frequency matching function. It returns 1 if ΔT_Qi' is within the access frequency range, and 0 otherwise.

[0141] The matching score is calculated based on a weighted scoring model. By combining three key factors—time, protocol, and frequency—it comprehensively evaluates the consistency between the current request and historical behavior patterns. Identity authentication is decomposed into three independent but complementary factors: time matching (f(T_Qi')), protocol matching (g(X_Qi')), and frequency matching (h(ΔT_Qi')). By comprehensively considering static and dynamic behavior patterns, it can effectively identify abnormal access and improve the security of the local area network.

[0142] Next, the operator's preset matching threshold θ is obtained, and the calculated matching score is compared with this matching threshold θ.

[0143] If the matching score is greater than or equal to the matching threshold θ, then the terminal device Mi and its associated access request Qi' are determined to have passed the authentication.

[0144] If the matching score is less than the matching threshold θ, it is determined that the terminal device Mi and its associated access request Qi' have failed authentication, i.e., authentication has failed, and the authentication failure behavior is recorded in the system log of the terminal device Mi.

[0145] Repeat the above steps to perform multi-factor dynamic identity authentication on the terminal devices associated with each access request in the access request sequence Q1', Q2', ..., Qj'.

[0146] When terminal device Mi fails authentication, the access request Qi' associated with terminal device Mi is directly blocked.

[0147] Through the above steps, multi-factor dynamic identity authentication can be performed on the terminal devices associated with each access request in the access request sequence Q1',Q2',...,Qj'. Then, all access requests associated with the terminal devices that have passed the identity authentication are obtained and sorted according to the order of the access request sequence Q1',Q2',...,Qj' to obtain the refined access request sequence, represented as: Q1'',Q2'',...,Qm'', where m is the counting index, representing the total number of access requests in the refined access request sequence, and m is less than or equal to j;

[0148] Then, obtain the terminal devices associated with all access requests in the refined access request sequence Q1'', Q2'', ..., Qm'', and sort them according to the order of the refined access request sequence Q1'', Q2'', ..., Qm'' to obtain the refined terminal device sequence, represented as: M1', M2', ..., Mm', where any access request Qn'' corresponds to terminal device Mn', and n is the counting index, with a value range from 1 to m.

[0149] Example 4

[0150] This embodiment further discloses the specific steps involved in the third step based on embodiment 3, such as... Figure 4 As shown, it specifically includes the following:

[0151] The third step described in Example 1 can be summarized as: assessing the current security index of the terminal device and generating early warning information for terminal devices with potential threats, specifically including the following:

[0152] First, obtain the backtracking period T_re preset by the operator. The backtracking period T_re is a time period, including the start time and the end time.

[0153] Obtain the determined current time T0, and use the current time T0 as the end time of a backtracking period T_re. Backtrack one backtracking period T_re to obtain the start time of a backtracking period T_re, and record this start time as T1. The end time is the current time T0.

[0154] Then, within the period from the start time T1 of the determined backtracking period T_re to the current time T0, the system log associated with any terminal device Mn' in the refined terminal device sequence is obtained, and the number of authentication failure behaviors of terminal device Mn' in the obtained system log is determined, which is recorded as the total number of authentication failure behaviors associated with terminal device Mn' k.

[0155] Next, the k authentication failure behaviors of the acquired terminal device Mn' are sorted in chronological order to obtain the authentication failure behavior sequence, denoted as: AF1, AF2, ..., AFk.

[0156] Next, obtain the time point of each authentication failure behavior in the authentication failure behavior sequence AF1, AF2, ..., AFk, resulting in a total of k time points. Sort the k time points in chronological order to obtain the time point sequence, represented as: t1, t2, ..., tk.

[0157] Next, obtain the time interval preset by the operator, and take each time point in the time point sequence t1, t2, ..., tk as the end time of a time interval, thereby determining the start time of a time interval. Combined with the determined end time, a clear time interval is obtained.

[0158] Finally, we can obtain k time intervals corresponding to k time points, and sort them according to the time point sequence t1, t2, ..., tk to obtain the time interval sequence, represented as: tp1, tp2, ..., tpk.

[0159] Obtain the memory usage rate of terminal device Mn' at each moment within each time interval of the time interval sequence tp1, tp2, ..., tpk, and average the memory usage rate of all moments within the same time interval to obtain the average memory usage rate associated with each time interval. Sort the k average memory usage rates corresponding to the k time intervals according to the order of the time interval sequence to obtain the average memory usage rate sequence, denoted as: Ar1, Ar2, ..., Ark;

[0160] Obtain any authentication failure behavior from the sequence AF1, AF2, ..., AFk, denoted as AFv, and perform example processing on authentication failure behavior AFv:

[0161] The time decay factor W_time_v associated with the authentication failure behavior AFv is calculated using the formula: W_time_v=exp(-λ× (T0-tv)), where λ is the decay coefficient preset by the operator to adjust the rate of time decay, exp is the natural exponential function, and tv is any time point in the time sequence t1, t2, ..., tk.

[0162] After determining the time decay factor W_time_v associated with the authentication failure behavior AFv, the average memory utilization rate Arv associated with the authentication failure behavior AFv is obtained to calculate the memory risk factor W_Arv associated with the authentication failure behavior AFv, where v is the counting index, and the value range is from 1 to k.

[0163] Obtain the memory usage thresholds preset by the operator, including the upper limit of normal memory usage Ar_low and the lower limit of abnormal memory usage Ar_high;

[0164] If the average memory usage Arv associated with the authentication failure behavior AFv is less than or equal to Ar_low, then the memory risk factor W_Arv is set to 0.

[0165] If the average memory usage Arv associated with the authentication failure behavior AFv is greater than or equal to Ar_high, then the memory risk factor W_Arv is assigned a value of 1.

[0166] If the average memory usage Arv associated with the authentication failure behavior AFv is greater than Ar_low and less than Ar_high, then let the memory risk factor W_Arv = (Arv - Ar_low) / (Ar_high - Ar_low).

[0167] Next, the memory risk factor W_Arv and time decay factor W_time_v of the authentication failure behavior AFv determined in the above steps are extracted, and the risk value Risk_v of the authentication failure behavior AFv is calculated by using: Risk_v=W_time_v×W_Arv (taking into account both the time decay factor and the memory risk factor).

[0168] Then use Total_Risk=∑ i=1 k Risk_v (which represents the sum of the risk values ​​of all authentication failure behaviors of terminal device Mn' within the same backtracking period) calculates the total risk value Total_Risk of terminal device Mn'.

[0169] Finally, the device safety index DSI_Mn' of terminal device Mn' is calculated using the formula: DSI_Mn'=max(0,100-Total_Risk×Scale_Factor), where Scale_Factor is a scaling factor preset by the operator to map the total risk value to the device safety index, and DSI_Mn'∈[0,100].

[0170] By repeating the above steps, the device security index associated with each terminal device in the refined terminal device sequence M1', M2', ..., Mm' can be determined synchronously.

[0171] Once the device security index DSI_Mn' of any terminal device Mn' is determined, the device security index DSI_Mn' of terminal device Mn' is compared with the device security index threshold DSI_yu preset by the operator;

[0172] If the device security index DSI_Mn' of terminal device Mn' is greater than the device security index threshold DSI_yu, then the access request Qn'' of terminal device Mn' is allowed.

[0173] If the device security index DSI_Mn' of terminal device Mn' is less than or equal to the device security index threshold DSI_yu, then the access request Qn'' of terminal device Mn' is blocked, and an early warning message associated with terminal device Mn' is generated simultaneously to warn the operator.

[0174] All data in the formulas described above are numerical calculations performed with dimensions removed. Furthermore, any content not described in detail in this specification is existing technology known to those skilled in the art.

[0175] The above description is merely an example and illustration of the present invention. Those skilled in the art can make various modifications or additions to the specific embodiments described, or use similar methods to replace them, as long as they do not deviate from the invention or exceed the scope defined in the claims, all of which should fall within the protection scope of the present invention.

[0176] It should be stated that all user data collected in this application was collected with the user's consent and authorization. Furthermore, the uses of user data are legal and compliant, and the use and processing of user data comply with the relevant laws, regulations, and standards of the relevant regions.

Claims

1. A network security early warning method for local area network devices based on a zero-trust architecture, characterized in that, The method includes: Step one: Use a pre-built interception module to intercept access requests to the target local area network. The specific method for grouping the intercepted access requests based on the type of the access request is as follows: Determine the current time, and denote it as T0; Get any access request Q obtained at the current time T0; Get the source IP address of the terminal device associated with access request Q, and denote it as Q_IP; Obtain the target IP address of the target local area network and record it as G_IP; Calculate the absolute value of the difference between the last octet of Q_IP and the last octet of G_IP, and use it as the spatial feature of the access request Q, denoted as SP_Q; Determine the number of minutes in the current time T0, and denote it as 0; Divide the number of minutes o by the preset time granularity parameter u and round down to obtain the time characteristic of the access request Q, denoted as TE_Q; Calculate the CRC32 checksum value of the entire data packet of access request Q excluding the Ethernet frame header, and perform a modulo 10 operation to obtain the structural characteristics of access request Q, denoted as ST_Q; The GroupID associated with the access request Q is calculated using GP_ID=(SP_Q*P1 XOR TE_Q*P2 XOR ST_Q*P3) MOD N, where P1, P2, and P3 are preset coprime prime numbers, XOR is a bitwise XOR operation, MOD is a modulo operation, ensuring that GroupID∈[0,N-1], and N is the preset maximum number of groups; Based on the group identifier GroupID of access request Q, access request Q is included in the corresponding group, and access requests in the same group are included in the access request waiting queue in chronological order. Step 2: Based on the determined access request waiting queues, select any one of the access request waiting queues and serialize all access requests in this access request waiting queue to construct an access request sequence. Based on a pre-built big data analysis module, the terminal devices associated with each access request in the access request sequence are obtained in real time. Multi-factor dynamic identity authentication is performed on each terminal device to obtain all authenticated terminal devices and their associated access requests, and to construct a refined terminal device sequence and a refined access request sequence. Step 3: Within the preset backtracking period, obtain the system logs and memory usage associated with each terminal device in the refined terminal device sequence, and evaluate the current device security index of the terminal device. Based on the current device security index of the terminal device, access requests from each terminal device are allowed or blocked, and warning information is generated for early warning.

2. The method according to claim 1, characterized in that, The grouping operation in step one also includes a predefined dynamic grouping mapping table; The mapping relationship in the dynamic group mapping table is: group identifier — group — access request waiting queue; The dynamic group mapping table is initially empty. After determining the group identifier GroupID of the access request Q, a query is performed in the dynamic group mapping table. If the group identifier GroupID exists, the access request Q will be added to the access request waiting queue associated with the corresponding group in chronological order. If the group identifier GroupID does not exist, a new access request waiting queue is created, and the GroupID is bound to the new access request waiting queue. The access request Q is then included in this access request waiting queue.

3. The method according to claim 2, characterized in that, In step two, the specific method for constructing the access request sequence is as follows: Get any access request waiting queue, extract all access requests in this access request waiting queue, and sort them according to the order of the access request waiting queue to get Q1, Q2, ..., Qj, where j is the number of access requests; Obtain the source IP addresses of the terminal devices for the j access requests in sequence, resulting in Q1_IP, Q2_IP, ..., Qj_IP; Then, sort the j access requests in ascending order according to the value of the last eight bits of the source IP address of each terminal device to obtain the access request sequence Q1',Q2',...,Qj'.

4. The method according to claim 3, characterized in that, In step two, the specific method for performing multi-factor dynamic identity authentication on each terminal device is as follows: Take the terminal devices of each of the j access requests in the access request sequence Q1', Q2', ..., Qj' in order to obtain the terminal device sequence M1, M2, ..., Mj, where Qi' corresponds to Mi, i is the counting index, 1≤i≤j; Extract any one terminal device Mi from the terminal device sequence M1, M2, ..., Mj; Based on the big data analysis module, the historical access records of terminal device Mi to the target local area network are obtained, and a device behavior baseline of terminal device Mi is constructed. The device behavior baseline includes the typical access time period, commonly used protocol types, and access frequency range of terminal device Mi in the past 24 hours. Get the request time T_Qi', protocol type X_Qi', and time interval ΔT_Qi' between the access request Qi' and the previous access request; The matching degree Score between access request Qi' and the device behavior baseline of terminal device Mi is calculated using Score=α×f(T_Qi')+β×g(X_Qi')+γ×h(ΔT_Qi'). Where α, β, and γ are preset weight coefficients, α+β+γ=1, and α, β, and γ are all greater than 0. f(T_Qi') is a time matching function, which returns 1 if T_Qi' is within a typical access time period, and 0 otherwise. g(X_Qi') is a protocol matching function, which returns 1 if X_Qi' is a common protocol type, and 0 otherwise. h(ΔT_Qi') is a frequency matching function, which returns 1 if ΔT_Qi' is within the access frequency range, and 0 otherwise. Obtain the preset matching threshold θ. If Score ≥ θ, determine that the terminal device Mi has passed the identity authentication. Conversely, if the authentication of the terminal device Mi fails, the authentication failure will be recorded in the system log of the terminal device Mi. Similarly, multi-factor dynamic identity authentication is performed on the terminal devices associated with each access request in the access request sequence.

5. The method according to claim 4, characterized in that, In step two, if it is determined that the terminal device Mi has failed authentication, the access request Qi' of the terminal device Mi is blocked.

6. The method according to claim 4, characterized in that, In step two, the specific method for constructing the essence terminal device sequence and the essence access request sequence is as follows: Take all access requests associated with authenticated terminal devices in the terminal device sequence M1, M2, ..., Mj, sort them according to the order of the access request sequence to obtain the refined access request sequence Q1'', Q2'', ..., Qm'', where m is the counting index, representing the total number of access requests in the refined access request sequence, and 0≤m≤j; The terminal devices that have passed authentication are sorted in the order of the access request sequence to obtain the terminal device sequence M1', M2', ..., Mm', where Qn'' corresponds to Mn', n is the counting index, and 1≤n≤m.

7. The method according to claim 6, characterized in that, In step three, the specific method for assessing the current device security index of the terminal device is as follows: Obtain the backtracking period T_re preset by the operator; Starting from the current time T0, we trace back one back period T_re to obtain the start time of this back period T_re, which we denote as T1. From start time T1 to current time T0, obtain the system log of any terminal device Mn' in the sequence of refined terminal devices, count the number of authentication failures in the system log, and denote the total number of authentication failures as k. Arrange the k authentication failure behaviors in chronological order to obtain the authentication failure behavior sequence AF1, AF2, ..., AFk; Obtain the time points of k authentication failures to obtain the time point sequence t1, t2, ..., tk; Obtain the time interval preset by the operator, and use each time point in the time point sequence as the end time of a time interval to determine k time intervals, which are tp1, tp2, ..., tpk in chronological order; Determine the memory usage rate of terminal device Mn' at each time point within k time intervals, and average the memory usage rate at each time point within the same time interval to determine the average memory usage rate for each time interval. The resulting k average memory usage rates are denoted as the average memory usage rate sequence Ar1, Ar2, ..., Ark in the order of the time interval sequence; For any authentication failure behavior AFv, the associated time decay factor W_time_v is calculated using W_time_v=exp(-λ× (T0-tv)). λ is the attenuation coefficient preset by the operator, exp is the natural exponential function, and tv is any time point in the time sequence t1, t2, ..., tk; Based on the average memory usage Arv of the authentication failure behavior AFv, determine the memory risk factor W_Arv associated with the authentication failure behavior AFv, where v is the counting index, 1≤v≤k; Arv≤Ar_low, set the memory risk factor W_Arv=0; Arv≥Ar_high, let the memory risk factor W_Arv=1; Ar_low < Arv < Ar_high, let the memory risk factor W_Arv = (Arv - Ar_low) / (Ar_high - Ar_low); Ar_low and Ar_high are preset memory usage thresholds, representing the upper limit of normal memory usage and the lower limit of abnormal memory usage, respectively. Extract the memory risk factor W_Arv and time decay factor W_time_v of the authentication failure behavior AFv, and calculate the risk value Risk_v of the authentication failure behavior AFv using Risk_v=W_time_v×W_Arv; Using Total_Risk=∑ i=1 k Risk_v determines the total risk value Total_Risk for terminal device Mn'; The device security index DSI_Mn' of terminal device Mn' is calculated using DSI_Mn'=max(0,100-Total_Risk×Scale_Factor), where Scale_Factor is a preset scaling factor that maps the total risk value to the device security index, and DSI_Mn'∈[0,100]. Similarly, determine the device security index associated with each terminal device in the essence terminal device sequence.

8. The method according to claim 7, characterized in that, In step three, the specific method for generating early warning information and issuing early warnings is as follows: Obtain the device security index DSI_Mn' of any terminal device Mn' and compare it with the preset device security index threshold DSI_yu; If DSI_Mn' > DSI_yu, allow the terminal device Mn's access request Qn''; Conversely, if the terminal device Mn's access request Qn'' is blocked, an early warning message associated with the terminal device Mn' is generated and the operator is alerted.

Images