A method for generating security design documents based on artificial intelligence

Abstract

This invention discloses an artificial intelligence-based method for generating security design documents, belonging to the field of document generation technology. It addresses the problem of low efficiency in writing security design documents by acquiring tenant identification information, detecting the number of public network open ports and encrypted volumes of their computing resources, calculating the degree of public network openness and encryption activation, generating tenant security dimensions and setting security levels, and determining whether to collect subnet communication information. Subsequently, it counts the number of cross-subnet communications, checks storage capacity, evaluates load scores, classifies tenants and generates type tags, retrieves corresponding fragments and weights from a security policy fragment library, adjusts and sorts the weights according to the security dimensions, rewrites the fragments using natural language, and generates security design documents for each tenant. This achieves automatic generation of cloud platform security design documents, improves policy formulation efficiency, reduces risks, and enhances the overall security level.

Description

Technical Field

[0001] This invention relates to the field of document generation technology, and more specifically, to a method for generating secure design documents based on artificial intelligence. Background Technology

[0002] With the rapid development of cloud computing, big data and artificial intelligence technologies, more and more enterprises are deploying their core business systems on cloud platforms to obtain advantages such as elastic resources, high reliability and low-cost maintenance. The number of cloud platform tenants is huge and the business types are complex. There are significant differences among tenants in terms of the openness of computing resources, encryption usage, subnet communication structure, data storage methods and business load.

[0003] The existing technology has the following shortcomings:

[0004] Currently, existing technologies lack a unified tenant security quantitative assessment mechanism, making it impossible to automatically analyze security risks based on tenant public network exposure characteristics, encryption activation status, and cross-subnet communication behavior. This makes it difficult to meet the needs of rapid generation and personalized matching of security policies in multi-tenant cloud environments, resulting in low efficiency and insufficient accuracy in writing security design documents, and making it difficult to achieve full-process auditability and traceability. Therefore, an artificial intelligence-based security design document generation method is proposed.

[0005] The information disclosed in the background section is only intended to enhance the understanding of the background of this disclosure, and therefore may include information that does not constitute prior art known to those skilled in the art. Summary of the Invention

[0006] To overcome the aforementioned deficiencies of the prior art, embodiments of the present invention provide an artificial intelligence-based method for generating security design documents, which solves the problems mentioned in the background art by employing tenant security feature quantitative modeling and policy fragment intelligent matching generation mechanism.

[0007] To achieve the above objectives, the present invention provides the following technical solution: a method for generating security design documents based on artificial intelligence, comprising the following steps:

[0008] Step S1: In the cloud platform interface, obtain the identification information of all tenants, detect the number of public network open ports and the number of encrypted volumes of each tenant's computing resources through the identification information, and calculate the degree of public network openness based on the number of public network open ports;

[0009] Step S2: Analyze the encryption activation level based on the number of encrypted volumes, generate the tenant's security dimension by combining the degree of public network openness and encryption activation level, and set the tenant's security level. Determine whether to collect the subnet communication information of the tenant's computing resources based on the security level.

[0010] Step S3: After collecting subnet communication information, count the number of cross-subnet communications, detect the storage capacity of tenant computing resources, evaluate the tenant's load score based on the number of cross-subnet communications, classify tenants based on the load score and generate type labels.

[0011] Step S4: Retrieve the policy fragments and fragment weights corresponding to the type tags from the security policy fragment library, correct the fragment weights using the security dimension, sort the policy fragments, and rewrite the policy fragments using natural language based on the sorting results to generate security design files for each tenant.

[0012] In a preferred embodiment, in step S1, the identification information of all tenants is obtained from the cloud platform interface. The identification information is a unique identity identifier assigned to each tenant by the cloud platform.

[0013] Read all computing resource objects bound to the tenant's identification information from the cloud platform's resource management service;

[0014] After jointly parsing the virtual machine network attributes and security group rules, all inbound ports that are allowed to be accessed from public network sources are filtered, and the number of ports in the open state is counted. The count results are used as the number of public network open ports of the corresponding tenant's computing resources.

[0015] In a preferred embodiment, in step S1, all data volume resources associated with the tenant are retrieved from the cloud platform storage service, and the encrypted status metadata of each data volume is read.

[0016] After parsing the volume encryption status metadata, count the data volumes marked as having enabled encryption, and use the count result as the number of encrypted volumes for the corresponding tenant's computing resources;

[0017] If a data volume is mounted to multiple compute resource instances, the statistics are based on the ownership relationship between the data volume and the tenant.

[0018] The degree of public network openness is obtained by dividing the number of public network open ports by the maximum number of open ports of all tenants in the cloud platform.

[0019] In a preferred embodiment, in step S2, the total number of data volumes of the tenant is retrieved, and the number of encrypted volumes is divided by the total number of data volumes to obtain the encryption enable level.

[0020] The security dimension of a tenant is obtained by comprehensively calculating the degree of public network openness and encryption activation using a weighted summation method.

[0021] In a preferred embodiment, in step S2, the security dimension is compared with the level classification threshold:

[0022] When the security dimension is greater than or equal to the level classification threshold, the security level is determined to be high, and no subnet communication information of the tenant's computing resources is collected.

[0023] When the security dimension is less than the level classification threshold, the security level is determined to be low, and the subnet communication information of the tenant's computing resources is collected to further evaluate the computing resources of each tenant.

[0024] In a preferred embodiment, in step S3, a preset statistical period is set, and the subnet communication information of the tenant's computing resources is obtained through the stream log interface, including all data session records between different subnets for each computing resource;

[0025] Analyze all data session records of computing resources between different subnets, and count the number of all cross-subnet sessions within a preset statistical period to obtain the cross-subnet communication count;

[0026] The storage capacity of tenant computing resources is detected through the cloud monitoring interface;

[0027] The load score of a tenant is calculated after standardizing the number of cross-subnet communications and the storage capacity.

[0028] In a preferred embodiment, in step S3, tenants are categorized based on load scores and type labels are generated:

[0029] If the load score is greater than the preset load score threshold, the tenant is determined to be a high-load tenant, and a type label of high-load type is generated.

[0030] Conversely, if the tenant is identified as a low-load tenant, a type label of low-load type will be generated.

[0031] In a preferred embodiment, in step S4, the policy fragment corresponding to the type tag and the fragment weight corresponding to the policy fragment are retrieved from the security policy fragment library;

[0032] Among them, the policy fragment is a predefined sample of security control measures, and the fragment weight is the execution priority corresponding to the policy fragment;

[0033] After standardizing the tenant's security dimensions, the security dimension coefficients are obtained.

[0034] In a preferred embodiment, in step S4, the fragment weights are adjusted based on the security dimension coefficient to obtain the corrected fragment weights: ,in, To correct segment weights, For segment weights, For security dimension coefficients;

[0035] The strategy fragments are sorted in descending order according to the corrected fragment weights, and the strategy fragments are rewritten using natural language based on the sorting results.

[0036] Natural language rewriting process transforms the technical configurations, control measures, and constraints in each strategy fragment into readable and executable descriptions.

[0037] After rewriting the policy fragments using natural language, security design documents for each tenant are generated.

[0038] The technical effects and advantages of this invention are as follows:

[0039] This invention acquires the identification information of all tenants to detect the number of public network open ports and encrypted volumes of each tenant's computing resources, calculates the degree of public network openness and encryption activation, generates the tenant's security dimension, sets the tenant's security level, determines whether to collect the subnet communication information of the tenant's computing resources, then counts the number of cross-subnet communications, detects the storage capacity of the tenant's computing resources, evaluates the tenant's load score, classifies the tenants and generates type tags, retrieves the policy fragments and fragment weights corresponding to the type tags through a security policy fragment library, corrects the fragment weights using the security dimension, sorts the policy fragments and rewrites them using natural language, and generates the security design file for each tenant. This achieves automated generation of cloud platform tenant security design files, improves the efficiency of security policy formulation, and achieves precise and auditable security management by quantifying security dimensions and matching personalized policy fragments, reducing security risks and improving the overall security level of the cloud environment. Attached Figure Description

[0040] Figure 1 This is a flowchart illustrating the implementation of an artificial intelligence-based method for generating security design documents according to the present invention.

[0041] Figure 2 This is a schematic diagram illustrating the steps of a method for generating security design documents based on artificial intelligence according to the present invention. Detailed Implementation

[0042] The technical solutions of the embodiments of the present invention will be clearly and completely described below with reference to the accompanying drawings. Obviously, the described embodiments are only some embodiments of the present invention, and not all embodiments. Based on the embodiments of the present invention, all other embodiments obtained by those skilled in the art without creative effort are within the scope of protection of the present invention.

[0043] This invention acquires the identification information of all tenants to detect the number of public network open ports and encrypted volumes of each tenant's computing resources, calculates the degree of public network openness and encryption activation, generates the tenant's security dimension, sets the tenant's security level, determines whether to collect the subnet communication information of the tenant's computing resources, then counts the number of cross-subnet communications, detects the storage capacity of the tenant's computing resources, evaluates the tenant's load score, classifies the tenants and generates type tags, retrieves the policy fragments and fragment weights corresponding to the type tags through a security policy fragment library, corrects the fragment weights using the security dimension, sorts the policy fragments and rewrites them using natural language, and generates the security design file for each tenant. This achieves automated generation of cloud platform tenant security design files, improves the efficiency of security policy formulation, and achieves precise and auditable security management by quantifying security dimensions and matching personalized policy fragments.

[0044] Example 1, such as Figures 1 to 2 As shown, a method for generating security design documents based on artificial intelligence includes the following steps:

[0045] Step S1: In the cloud platform interface, obtain the identification information of all tenants, detect the number of public network open ports and the number of encrypted volumes of each tenant's computing resources through the identification information, and calculate the degree of public network openness based on the number of public network open ports;

[0046] Step S2: Analyze the encryption activation level based on the number of encrypted volumes, generate the tenant's security dimension by combining the degree of public network openness and encryption activation level, and set the tenant's security level. Determine whether to collect the subnet communication information of the tenant's computing resources based on the security level.

[0047] Step S3: After collecting subnet communication information, count the number of cross-subnet communications, detect the storage capacity of tenant computing resources, evaluate the tenant's load score based on the number of cross-subnet communications, classify tenants based on the load score and generate type labels.

[0048] Step S4: Retrieve the policy fragments and fragment weights corresponding to the type tags from the security policy fragment library, correct the fragment weights using the security dimension, sort the policy fragments, and rewrite the policy fragments using natural language based on the sorting results to generate security design files for each tenant.

[0049] The specific implementation is as follows:

[0050] In step S1, the identification information of all tenants is obtained from the cloud platform interface. The identification information is a unique identity assigned to each tenant by the cloud platform, which is used to distinguish the computing resources and security configurations of different tenants in a multi-tenant environment.

[0051] Based on the identification information, the computing resources of each tenant are checked one by one. All computing resource objects bound to the tenant's identification information are read from the cloud platform's resource management service, and the number of public network open ports and encrypted volumes are extracted from the computing resource objects.

[0052] The number of publicly accessible ports refers to the number of ports of a computing resource that are open in a public network environment. This number is derived from the virtual machine network attributes and security group rules recorded by the cloud platform, reflecting the scope and extent to which the computing resource is exposed to the public network. In the specific detection process, the virtual machine network attributes recorded by the cloud platform are read, including the public IP address associated with the computing resource, the binding method, and the interface configuration related to public network access. Then, the security group rules associated with the corresponding computing resource are further read. The security group rules are maintained in real time by the cloud platform when resources are created and policies are changed, including the protocol type, port range, and access source address of each inbound rule. After jointly parsing the virtual machine network attributes and security group rules, all inbound ports that are allowed to access from public network source addresses are filtered, and the number of ports in an open state is counted. The statistical result is used as the number of publicly accessible ports of the corresponding tenant's computing resource.

[0053] The encrypted volume count refers to the number of data volumes with encryption mechanisms enabled among the data volumes bound to computing resources. It originates from the cloud platform storage service's metadata regarding volume encryption status and reflects the tenant's encryption usage for data protection. Specifically, it retrieves all data volume resources associated with the tenant from the cloud platform storage service and reads the encryption attributes of each data volume. During this reading process, it accesses the volume encryption status metadata maintained by the cloud platform storage service. This metadata is automatically recorded by the cloud platform when a data volume is created, mounted, or its security attributes are changed. It includes information such as encryption enable identifiers, encryption methods, and key management configurations. After parsing the volume encryption status metadata, it counts the data volumes marked as having encryption mechanisms enabled and uses the count result as the encrypted volume count for the corresponding tenant's computing resources. During this detection process, if a data volume is mounted to multiple computing resource instances, the count is based on the relationship between the data volume and the tenant, ensuring that the encrypted volume count only reflects the tenant's overall data encryption usage.

[0054] It should be noted that a data volume is an independent persistent storage unit provided by the cloud platform for tenants, used to store system data, business data, or application files generated during the operation of computing resources.

[0055] After obtaining the number of public network open ports, the degree of public network openness is calculated based on the number of public network open ports. Specifically, the degree of public network openness is obtained by dividing the number of public network open ports by the maximum number of open ports of all tenants in the cloud platform, in order to measure the exposure of tenant computing resources on the public network.

[0056] Through the above processing, the basic identification of the public network exposure attributes and encrypted usage attributes of each tenant's computing resources based on tenant identification information is achieved, and the required quantitative parameter input is provided for subsequent steps.

[0057] In step S2, after obtaining the number of encrypted volumes, the encryption enablement is analyzed based on the number of encrypted volumes. Specifically, the total number of data volumes of the tenant is retrieved. The total number of data volumes also comes from the resource record in the cloud platform storage service that is bound to the tenant's identification information, which is used to indicate the range of data volumes that the tenant can be included in the encryption status assessment.

[0058] Dividing the number of encrypted volumes by the total number of data volumes yields the encryption enablement level, which quantifies the extent to which tenants employ encryption methods in data protection.

[0059] The security dimension of a tenant is calculated by comprehensively calculating the degree of public network openness and encryption activation using a weighted summation method. The calculation formula is as follows:

[0060] ;

[0061] in, For security reasons, For the degree of openness of the public network, To enable encryption, and These are the preset weighting coefficients.

[0062] The security dimension reflects the overall security posture of a tenant's computing resources in terms of access control and data protection. The higher the value, the higher the degree of exposure of the tenant's computing resources to the public network and the lower the degree of encryption protection coverage, thus indicating that the tenant's overall security risk level is higher. By quantifying the security dimension, the risk of public network exposure and data encryption coverage are assessed in a unified manner, providing a quantifiable basis for subsequent security level classification, subnet communication information collection, and security policy fragment matching.

[0063] It should be noted that the weighting coefficients are used to determine the relative impact of public network openness and encryption activation on the overall security index in the security dimension calculation. Both are non-negative real numbers and satisfy the following conditions: To ensure the normalization of security dimensions, the values ​​are quantitatively determined based on statistical analysis of historical security events. By collecting the frequency of security events within a certain period, the proportion of security incidents caused by public network exposure is used as the reference value for α, and the proportion of data leakage incidents caused by insufficient encryption is used as the reference value for β. On this basis, normalization is performed so that the sum of α and β is 1, thereby objectively reflecting the relative contribution of different security factors to the overall security risk of the tenant.

[0064] Based on the values ​​of the security dimensions, the security level of the tenant is set. The security level is a level label divided according to the range of the security dimensions, which is used to represent the overall security status of the tenant's computing resources.

[0065] The rules for setting security levels are determined by predefined level classification thresholds. Security dimensions are compared with these thresholds:

[0066] When the security dimension is greater than or equal to the level classification threshold, it indicates that the tenant's computing resources have low exposure to the public network or high encryption coverage, and the security level is judged as high. No subnet communication information of the tenant's computing resources will be collected.

[0067] If the security dimension is less than the level classification threshold, it indicates that the tenant's computing resources have a high degree of exposure to the public network or insufficient encryption coverage, and the security level is determined to be low. Subnet communication information of the tenant's computing resources will be collected to further evaluate the computing resources of each tenant so as to generate corresponding security design documents in the future.

[0068] It should be noted that the method for setting the level classification threshold is quantitatively determined through historical tenant security data and risk analysis. Specifically, the security dimensions of each tenant and the occurrence of their corresponding security events are collected within a certain period, the relationship between the frequency of security events and security dimensions is statistically analyzed, and security dimensions with a security event probability significantly lower than the preset risk level are used as the level classification threshold.

[0069] By determining whether to collect communication data based on security levels, conditional control over the scope of network behavior monitoring is achieved, ensuring that data collection is only performed when security risks reach a specified level, thereby maintaining the efficiency of system resource utilization and the relevance of analysis results.

[0070] In step S3, a statistical period is preset, and the subnet communication information of the tenant's computing resources is obtained through the flow log interface. The subnet communication information reflects the data flow direction and network structure complexity between different subnets within the tenant, including all data session records of each computing resource between different subnets.

[0071] Analyze all data session records of computing resources between different subnets, and count the number of all cross-subnet sessions within a preset statistical period to obtain the cross-subnet communication quantity. The cross-subnet communication quantity reflects the coupling degree of the tenant's internal network structure and the east-west traffic pressure.

[0072] A higher number of cross-subnet communications indicates a more dispersed distribution of service components, greater east-west bandwidth consumption, and a higher level of tenant network load; a lower number of cross-subnet communications indicates a higher concentration of services, relatively stable tenant load, and less pressure on resource scheduling.

[0073] By using the cloud monitoring interface to detect the storage capacity of tenant computing resources, the current resource stress and data write pressure of tenants can be reflected.

[0074] When the storage capacity is low, it indicates that the tenant is frequently writing data or running the business under high load; when the storage capacity is high, it indicates that the tenant's business scale is relatively stable and the load pressure is stable.

[0075] The baseline communication volume of tenant computing resources is obtained by using a historical performance database. The baseline communication volume is used as a reference value to measure the level of cross-subnet communication under normal tenant load. The baseline communication volume is obtained by statistically analyzing the number of cross-subnet communications of each tenant's computing resources in the historical statistical period.

[0076] After standardizing the number of cross-subnet communications and storage capacity, the tenant's load score is calculated: ,in, As the baseline communication volume, This represents the number of cross-subnet communications after standardization. This refers to the storage capacity after standardization. and These are the preset power coefficients. The result should be a very small positive number, avoiding a denominator of 0. Load scoring is applied. It should be explained that the preset power factor can be set based on tenant historical communication behavior, storage usage fluctuations, and load sensitivity requirements. For example, during peak communication demand, the preset power factor corresponding to the number of cross-subnet communications can be increased to enhance the weight of communication load.

[0077] Tenants are categorized based on load scores and type labels are generated:

[0078] If the load score is greater than the preset load score threshold, the tenant is determined to be a high-load tenant, and a type label of high-load type is generated.

[0079] Conversely, if the tenant is identified as a low-load tenant, a type label of low-load type will be generated.

[0080] It should be noted that the preset statistical period can be set according to the tenant's business fluctuation characteristics and the frequency of monitoring data collection; the flow log interface is a monitoring service interface used to collect network traffic and session information of each computing resource; the cloud monitoring interface is a monitoring service interface used to obtain the storage usage and remaining capacity of each computing resource; the historical performance database is used to store historical cross-subnet communication data and other records of each tenant's computing resources; the standardization processing methods include, but are not limited to, standard linear transformation based on interval scaling, statistical Z-Score standardization method, or normalization method based on nonlinear mapping function. The application methods of standardization processing will not be elaborated here; the preset load scoring threshold can be set according to the historical load scoring distribution of tenants and security policy requirements.

[0081] By acquiring and analyzing the subnet communication information and storage capacity of tenant computing resources, load scores are calculated and type labels are generated, providing an accurate assessment of tenant load characteristics and improving the accuracy of tenant security management and the efficiency of resource regulation.

[0082] In step S4, the policy fragments corresponding to the type tags and the fragment weights corresponding to the policy fragments are retrieved from the security policy fragment library;

[0083] Among them, the policy fragment is a sample of security control measures predefined based on tenant load characteristics, network communication behavior and storage usage, including technical configuration, control measures and constraints, etc., used to reflect the combination of security policies required by tenants of different types and labels; the fragment weight ranges from 0 to 1, reflecting the execution priority of the policy fragment in the overall security design, and can be modified according to security dimensions to achieve personalized security policy matching. The higher the fragment weight, the more critical the policy fragment is in tenant security management and the higher its priority.

[0084] After standardizing the tenant's security dimensions, security dimension coefficients are obtained. Based on these security dimension coefficients, the segment weights are adjusted to obtain corrected segment weights. ,in, To correct segment weights, For segment weights, For security dimension coefficients;

[0085] The higher the security dimension coefficient, the higher the tenant's security level, the stricter the requirements for security policies, and the greater the weight of the correction fragment, so that tenants with high security dimensions will prioritize the application of more critical policy fragments.

[0086] The policy fragments are sorted in descending order according to their correction fragment weights, with the policy fragments with larger correction fragment weights placed first, to ensure that high-priority policy fragments are read and executed first in the generated security design file;

[0087] The strategy fragments are rewritten using natural language based on the ranking results. This process converts the technical configurations, control measures, and constraints in each strategy fragment into readable and executable descriptions. The ranking results of the strategy fragments are then transformed into executable and personalized security design documents through natural language rewriting.

[0088] It should be noted that the security policy fragment library refers to a pre-established collection of policy fragment templates used to store samples of security control measures for tenants with different types of tags; natural language rewriting refers to the process of converting policy fragments into logically clear, readable and executable text descriptions.

[0089] By retrieving policy fragments and correcting their corresponding weights, the policy fragments are rewritten using natural language. This transforms the quantified policy fragments and tenant security dimensions into logically clear, personalized, and executable security design documents. This enables the priority presentation of key policy fragments, readable and executable policy content, and targeted security management, thereby improving the accuracy and efficiency of tenant security control. The quantified security profile is dynamically coupled with the policy fragment library to form a personalized security policy matching mechanism. Furthermore, natural language generation enables a closed-loop automation from data to document.

[0090] Finally, it should be noted that in this paper, relational terms such as first and second are used only to distinguish one entity or operation from another entity or operation, and do not necessarily require or imply any such actual relationship or order between these entities or operations.

[0091] Furthermore, the terms "comprising," "including," or any other variations thereof are intended to cover non-exclusive inclusion, such that a process, method, article, or apparatus that comprises a list of elements includes not only those elements but also other elements not expressly listed, or elements inherent to such a process, method, article, or apparatus. Without further limitation, an element defined by the phrase "comprising one..." does not exclude the presence of other identical elements in the process, method, article, or apparatus that includes said element.

[0092] In this document, the singular forms “a,” “an,” and “the” may also include the plural forms unless the context clearly indicates otherwise. It should also be understood that terms such as “comprising / including” or “having” specify the presence of the stated features, integrals, steps, operations, components, parts, or combinations thereof, but do not preclude the possibility of the presence or addition of one or more other features, integrals, steps, operations, components, parts, or combinations thereof. Meanwhile, the term “and / or” as used in this specification includes any and all combinations of the associated listed items.

[0093] The various embodiments in this specification are described in a progressive manner. Each embodiment focuses on the differences from other embodiments. The various embodiments can be combined as needed, and the same or similar parts can be referred to each other.

[0094] The above description of the disclosed embodiments will enable those skilled in the art to make or use various modifications to these embodiments. It will be readily apparent to those skilled in the art that the general principles defined herein may be implemented in other embodiments without departing from the spirit or scope of this application. Therefore, this application is not to be limited to the embodiments shown herein, but is to be accorded the widest scope consistent with the principles and novel features disclosed herein.

Claims

1. A method for generating security design documents based on artificial intelligence, characterized in that: Includes the following steps: Step S1: In the cloud platform interface, obtain the identification information of all tenants, detect the number of public network open ports and the number of encrypted volumes of each tenant's computing resources through the identification information, and calculate the degree of public network openness based on the number of public network open ports; Step S2: Analyze the encryption activation level based on the number of encrypted volumes, generate the tenant's security dimension by combining the degree of public network openness and encryption activation level, and set the tenant's security level. Determine whether to collect the subnet communication information of the tenant's computing resources based on the security level. Step S3: After collecting subnet communication information, count the number of cross-subnet communications, detect the storage capacity of tenant computing resources, evaluate the tenant's load score based on the number of cross-subnet communications, classify tenants based on the load score and generate type labels. In step S3, tenants are categorized based on load scores and type labels are generated: If the load score is greater than the preset load score threshold, the tenant is determined to be a high-load tenant, and a type label of high-load type is generated. Conversely, if the tenant is determined to be a low-load tenant, a type label of low-load type will be generated. Step S4: Retrieve the policy fragments and fragment weights corresponding to the type tags through the security policy fragment library, correct the fragment weights using the security dimension and sort the policy fragments, rewrite the policy fragments using natural language based on the sorting results, and generate security design files for each tenant. In step S4, the policy fragments corresponding to the type tags and the fragment weights corresponding to the policy fragments are retrieved from the security policy fragment library; Among them, the policy fragment is a predefined sample of security control measures, and the fragment weight is the execution priority corresponding to the policy fragment; After standardizing the tenant's security dimension, the security dimension coefficient is obtained. The standardization methods include standard linear transformation based on interval scaling, Z-Score standardization based on statistics, or normalization method based on nonlinear mapping function. In step S4, the segment weights are adjusted based on the security dimension coefficient to obtain the corrected segment weights: ,in, To correct segment weights, For segment weights, For security dimension coefficients; The strategy fragments are sorted in descending order according to the corrected fragment weights, and the strategy fragments are rewritten using natural language based on the sorting results. Natural language rewriting process transforms the technical configurations, control measures, and constraints in each strategy fragment into readable and executable descriptions. After rewriting the policy fragments using natural language, security design documents for each tenant are generated.

2. The method for generating security design documents based on artificial intelligence according to claim 1, characterized in that: In step S1, the identification information of all tenants is obtained from the cloud platform interface. The identification information is a unique identity identifier assigned to each tenant by the cloud platform. Read all computing resource objects bound to the tenant's identification information from the cloud platform's resource management service; After jointly parsing the virtual machine network attributes and security group rules, all inbound ports that are allowed to be accessed from public network sources are filtered, and the number of ports in the open state is counted. The count results are used as the number of public network open ports of the corresponding tenant's computing resources.

3. The method for generating security design documents based on artificial intelligence according to claim 1, characterized in that: In step S1, all data volume resources associated with the tenant are retrieved from the cloud platform storage service, and the encrypted status metadata of each data volume is read. After parsing the volume encryption status metadata, count the data volumes marked as having enabled encryption, and use the count result as the number of encrypted volumes for the corresponding tenant's computing resources; If a data volume is mounted to multiple compute resource instances, the statistics are based on the ownership relationship between the data volume and the tenant. The degree of public network openness is obtained by dividing the number of public network open ports by the maximum number of open ports of all tenants in the cloud platform.

4. The method for generating security design documents based on artificial intelligence according to claim 1, characterized in that: In step S2, the total number of data volumes of the tenant is retrieved, and the number of encrypted volumes is divided by the total number of data volumes to obtain the encryption enable level; The security dimension of a tenant is calculated by comprehensively calculating the degree of public network openness and encryption activation using a weighted summation method. The calculation formula is as follows: ； in, For security reasons, For the degree of openness of the public network, To enable encryption, and These are the preset weighting coefficients.

5. The method for generating security design documents based on artificial intelligence according to claim 4, characterized in that: In step S2, the security dimension is compared with the level classification threshold: When the security dimension is greater than or equal to the level classification threshold, the security level is determined to be high, and no subnet communication information of the tenant's computing resources is collected. When the security dimension is less than the level classification threshold, the security level is determined to be low, and the subnet communication information of the tenant's computing resources is collected to further evaluate the computing resources of each tenant.

6. The method for generating security design documents based on artificial intelligence according to claim 1, characterized in that: In step S3, a preset statistical period is set, and the subnet communication information of the tenant's computing resources is obtained through the stream log interface, including all data session records between different subnets for each computing resource; Analyze all data session records of computing resources between different subnets, and count the number of all cross-subnet sessions within a preset statistical period to obtain the cross-subnet communication count; The storage capacity of tenant computing resources is detected through the cloud monitoring interface; The load score of a tenant is calculated after standardizing the number of cross-subnet communications and the storage capacity.

Images