Security rule adjusting method and security rule protection system

Abstract

The invention relates to a safety rule adjusting method and a safety rule protection system. The safety rule adjusting method comprises the steps of collecting original safety rules from a plurality of safety data sources in real time; wherein the security data source comprises security protection equipment and a security rule data source; regularized coding is carried out on the collected original security rules, optimized security rules are generated through machine learning, and threat level division is carried out on the optimized security rules; an ETCD mode is adopted to synchronize the optimized security rules and the corresponding threat levels to different security protection devices; based on the triggering conditions of the optimized security rules of different threat levels on the security protection equipment, evaluating the effectiveness of the optimized security rules to obtain an evaluation result; and dynamically adjusting and optimizing the threat level or state of the security rule according to an evaluation result. Through information collection, processing, issuing and dynamic adjustment of the security protection device and the security rule data source, the validity of the security rule is maintained.

Description

TECHNICAL FIELD

[0001] The present application relates to the technical field of network security rule management, in particular to a security rule adjustment method and a security rule protection system. BACKGROUND

[0002] In a network security protection system, security rule management is a core link for guaranteeing multi-device collaborative defense. As a "decision engine" of the protection system, security rules guide various security devices to identify and dispose malicious traffic and behavior, and the quality thereof directly determines the accuracy and effectiveness of the overall defense. With the widespread deployment of heterogeneous security devices and the continuous emergence of new threats such as zero-day vulnerabilities and multi-scene attacks, the dynamicity and adaptability of security rules have become key indicators for measuring the effectiveness of the protection system.

[0003] At present, in the related art, attack detection dependency libraries based on feature detection are often deployed on each security device to analyze security rule collision and count the security rule usage frequency of single-point devices, and then to determine the opening or closing of security rules. However, the processing rule mechanism of single-point devices cannot match zero-day vulnerabilities, and it is difficult to analyze different application scenarios of security rules according to big data application scenarios, making it difficult for security rules to be globally coordinated, resulting in the problem that security rules are easily invalid.

[0004] At present, there is no effective solution to the problem that security rules are easily invalid in the related art. SUMMARY

[0005] A security rule adjustment method and a security rule protection system are provided in the present embodiment to solve the problem that security rules are easily invalid in the related art.

[0006] In a first aspect, a security rule adjustment method is provided in the present embodiment, and the method comprises:

[0007] Real-time collection of original security rules from multiple security data sources; wherein the security data sources include security protection devices and security rule data sources;

[0008] Rule-based encoding of the collected original security rules, generation of optimized security rules through machine learning, and threat level division for the optimized security rules;

[0009] Synchronization of the optimized security rules and the corresponding threat levels to different security protection devices in an ETCD manner;

[0010] Based on the triggering of the optimized security rules of different threat levels on the security protection devices, the effectiveness of the optimized security rules is evaluated to obtain an evaluation result;

[0011] According to the evaluation result, the threat level or state of the optimized security rule is dynamically adjusted.

[0012] In some embodiments, the security protection device includes a website application level intrusion prevention system, a security gateway, a firewall, an intrusion detection system, and a distributed denial of service; and the security rule data source includes a zero-day vulnerability rule library and a global security rule library.

[0013] In some embodiments, the collected original security rules are regularized and coded, the optimized security rules are generated through machine learning, and the threat level of the optimized security rules is divided, including:

[0014] The security protection device and the security rule data source are assigned with a device unique identifier, and each security rule is assigned with a rule unique identifier;

[0015] Based on machine learning, the rule features of the original security rules are analyzed to generate optimized security rules;

[0016] According to different device types of the device unique identifier, the optimized security rules are converted into a rule format corresponding to the device type.

[0017] In some embodiments, the threat level division includes zero-day vulnerability, high threat level security rule, medium threat level security rule, and low threat level security rule.

[0018] In some embodiments, the optimized security rules and the corresponding threat levels are synchronized to different security protection devices in an ETCD manner, including:

[0019] The optimized security rules after regularized coding and optimized learning are synchronized to different security protection devices in an ETCD manner.

[0020] In some embodiments, the effectiveness of the optimized security rules is evaluated based on the triggering situation of the optimized security rules on the security protection device according to different threat levels, and an evaluation result is obtained, including:

[0021] The different threat levels corresponding to the optimized security rules are respectively configured with threat coefficients;

[0022] The actual triggering times of the optimized security rules on each security protection device are collected in real time, and the triggering times are normalized by combining the preset threat threshold of the optimized security rules to obtain a standardized triggering value;

[0023] multiplying each of the standardized trigger value of the optimization security rule by the threat coefficient of the corresponding threat level to obtain a weighted risk contribution value;

[0024] accumulating all the weighted risk contribution values of the optimization security rules to obtain an effectiveness evaluation result of the optimization security rules.

[0025] In some embodiments, the dynamically adjusting the threat level or state of the optimization security rule according to the evaluation result comprises:

[0026] determining whether the threat level of the optimization security rule needs to be lowered or the optimization security rule needs to be removed directly according to the evaluation result.

[0027] In a second aspect, a security rule protection system is provided in the embodiments, which comprises a data processing module, a rule issuing module and a result evaluation module; wherein:

[0028] The data processing module is configured to collect original security rules from a plurality of security data sources in real time, wherein the security data sources comprise security protection devices and security rule data sources; to code the collected original security rules, to generate optimization security rules through machine learning, and to divide the optimization security rules into threat levels;

[0029] The rule issuing module is configured to synchronize the optimization security rules and the corresponding threat levels to different security protection devices in an ETCD manner.

[0030] The result evaluation module is configured to evaluate the effectiveness of the optimization security rules based on the triggering of the optimization security rules in different threat levels on the security protection devices to obtain an evaluation result, and to dynamically adjust the threat level or state of the optimization security rules according to the evaluation result.

[0031] In a third aspect, an electronic device is provided in the embodiments, which comprises a memory and a processor, the memory stores a computer program, and the processor is configured to run the computer program to execute the security rule adjustment method of the first aspect.

[0032] In a fourth aspect, a computer readable storage medium is provided in the embodiments, which stores a computer program, and the computer program is executed by a processor to implement the steps of the security rule adjustment method of the first aspect.

[0033] Compared with the related art, the adjustment method of the security rule and the security rule protection system are provided in the embodiment. In the method, firstly, raw security rules are collected in real time from a plurality of security data sources; wherein the security data sources include a security protection device and a security rule data source; secondly, the collected raw security rules are regularized and coded, optimized security rules are generated through machine learning, and the optimized security rules are classified according to threat levels; subsequently, the optimized security rules and the corresponding threat levels are synchronized to different security protection devices in an ETCD manner; further, the effectiveness of the optimized security rules is evaluated based on the triggering of the optimized security rules of different threat levels on the security protection devices, and an evaluation result is obtained; finally, the threat level or the state of the optimized security rules is dynamically adjusted according to the evaluation result. Through the information collection, processing, delivery and dynamic adjustment of the security protection device and the security rule data source, the invalidation problem of the security rules is solved, and the effectiveness of the security rules is maintained.

[0034] The details of one or more embodiments of the present application are presented in the following drawings and description to make other features, objects and advantages of the present application more apparent. BRIEF DESCRIPTION OF DRAWINGS

[0035] The drawings described herein are intended to provide further understanding of the present application, and constitute a part of the present application. The illustrative embodiments of the present application and their description serve to explain the present application, and do not constitute an improper limitation on the present application. In the drawings:

[0036] Figure 1 is a hardware structure block diagram of an industrial computer terminal of the adjustment method of the security rule of the embodiment of the present application;

[0037] Figure 2 is a flowchart of the adjustment method of the security rule of one of the embodiments of the present application;

[0038] Figure 3 is a component interaction diagram of the security rule analysis system of one of the embodiments of the present application;

[0039] Figure 4 is an evaluation logic diagram of the security rule level in the adjustment method of the security rule of one of the embodiments of the present application;

[0040] Figure 5 is a structure block diagram of the security rule protection system of one of the embodiments of the present application. DETAILED DESCRIPTION

[0041] In order to more clearly understand the purpose, technical scheme and advantages of the present application, the present application is described and explained below in combination with the drawings and embodiments.

[0042] Unless otherwise defined, technical terms and scientific terms used in the present application shall have the same meaning as those commonly understood by a person of ordinary skill in the art to which the present application belongs. The terms "one", "a", "an", "the", "these", and similar terms in the present application do not mean "only one" or "exactly one", but can mean "one or more" or "at least one". The terms "include", "contain", "have", and any variant thereof in the present application are intended to cover the non-exclusive inclusion; for example, a process, method, and system, product or device containing a series of steps or modules (units) are not limited to the listed steps or modules (units), but can include steps or modules (units) not listed, or can include other steps or modules (units) inherent to the process, method, product or device. The terms "connect", "connect", "couple" and the like in the present application are not limited to physical or mechanical connection, but can include electrical connection, whether direct or indirect. The term "multiple" in the present application means two or more. The term "and / or" describes the association between the associated objects, which means that there can be three relationships, for example, "A and / or B" can mean that A exists alone, A and B exist together, and B exists alone. Generally, the character " / " represents the relationship between the front and rear associated objects as "or". The terms "first", "second", "third" and the like in the present application are only used to distinguish similar objects, and do not represent a specific order of the objects.

[0043] The method embodiments provided in the present embodiment can be executed in an industrial computer terminal, a computer or the like electronic device with certain computing power. For example, the method embodiments are executed on an industrial computer terminal, Figure 1 is a hardware structure block diagram of the industrial computer terminal of the adjustment method of the safety rules of the present embodiment. As shown in Figure 1 , the industrial computer terminal can include one or more (only one is shown in Figure 1 ) processor 102 and memory 104 for storing data, wherein the processor 102 can include but not limited to processing devices such as microprocessor MCU or programmable logic device FPGA. The above-mentioned industrial computer terminal can also include transmission device 106 for communicating with various security protection devices and cloud intelligence sources, and input and output device 108. Those skilled in the art can understand that Figure 1 The structure shown is only schematic, which does not limit the structure of the above-mentioned industrial computer terminal. For example, the industrial computer terminal can also include more or less components than Figure 1 shown, or have a different configuration from Figure 1 shown.

[0044] The memory 104 can be used to store computer programs, such as software programs of application software and modules, such as the computer program corresponding to the adjustment method of the security rule in the embodiment. The processor 102 executes various functional applications and data processing, i.e., implements the method described above, by running the computer program stored in the memory 104. The memory 104 can include a high-speed random access memory, and can further include a non-volatile memory, such as one or more magnetic storage devices, flash memories, or other non-volatile solid-state memories. In some examples, the memory 104 can further include memories remotely arranged with respect to the processor 102, which can be connected to the industrial computer terminal through a network. Examples of the network include, but are not limited to, the Internet, an intranet, a local area network, a mobile communication network, and a combination thereof.

[0045] The transmission device 106 is used to receive or send data via a network. The network described above includes a wireless network provided by a communication provider of the industrial computer terminal. In one example, the transmission device 106 includes a network adapter (NIC) which can be connected to other network devices through a base station so as to communicate with the Internet. In one example, the transmission device 106 can be a radio frequency (RF) module which is used to communicate with the Internet in a wireless manner.

[0046] In the embodiment, an adjustment method of a security rule is provided, Figure 2 is a flowchart of the adjustment method of the security rule of the embodiment, as Figure 2 shown, the flow includes the following steps:

[0047] In step S210, raw security rules are collected in real time from a plurality of security data sources; wherein the security data sources include security protection devices and security rule data sources.

[0048] Raw security rules are captured from diverse and heterogeneous security data sources in real-time without any processing. These security data sources mainly include two categories: one is security devices that directly execute security policies, such as firewalls that provide their specific access control list (ACL) entries, intrusion detection systems (IDS) and intrusion prevention systems (IPS) that generate rules containing complete headers and detection options, and web application firewall (WAF) that uses complex instructions of rule syntax. The other is security rule data sources that centrally manage and generate policies, such as emergency detection and mitigation rules for newly disclosed zero-day vulnerabilities, and general attack pattern rules from global threat intelligence alliances that have been extensively verified in practice. Due to the different design manufacturers and functional purposes of various security data sources, the raw security rules have significant differences in syntax structure, field definition, and logical expression, showing high heterogeneity.

[0049] In step S220, the collected raw security rules are regularized and encoded, optimized security rules are generated through machine learning, and threat level classification is performed for the optimized security rules.

[0050] Regularization and encoding refer to the process of converting raw security rules with different formats and syntaxes into a unified structured data form that is machine-readable, understandable, and computable. This process aims to eliminate the syntax differences between different manufacturers and devices, extract the core semantic features of the rules (such as actions, protocols, targets, ports, and matching patterns), and convert them into a unified data format suitable for further computer processing through standardization, structuring, and digitization. Regularization and encoding mainly include parsing and feature extraction, standardization and structure conversion, and numerical and vectorization links, and the core purpose is to eliminate the heterogeneity of raw security rule data, providing high-quality, regular data basis for machine learning model analysis and optimization of raw security rules.

[0051] Among them, taking the security rules of the IDS device as an example, the security rule examples thereof include “regex”, “id”, “ruleid”, “idstype” and “cb”. Among them, “regex” is a regular expression, which defines that the security rule needs to find a specific string or pattern, and this part is the key of feature extraction; “id” is the internal rule unique identifier (Identity Document, ID) allocated to the security rule, which is used to uniquely identify the security rule in the system, and is used for the management of the security rule; “ruleid” is the security rule identifier in the original IDS security rule engine, which can be used to associate external knowledge base; “idstype” represents the type or classification of the security rule, which will be label encoded or one-hot encoded in the numerical stage, and converted into a numerical form that can be processed by the machine learning model; “cb” represents the action of the security rule, which can execute a callback function or a matching method, and the encoder will identify this field and standardize it into a unified action identifier.

[0052] Subsequently, the machine learning algorithm is used to analyze the encoded massive original security rule data, and an optimized security rule set is generated. The optimization direction includes redundant rule merging, contradictory rule elimination and invalid rule elimination in the existing security rule policy library. Among them, the security rule policy library refers to a database system specially used for storing and managing policy, rule and configuration information related to network security, data protection, access control and the like. Specifically, redundant rule merging is to identify and merge multiple security rules that are completely or highly repetitive in function from the existing security rule policy library. For example, security rules created by different administrators at different times but targeting the same threat but written slightly differently are identified and merged into one security rule. Contradictory rule elimination is to find mutually contradictory rules existing in the security rule policy library, such as a security rule allowing an Internet Protocol (IP) to access, while another security rule denying the same IP access. By analyzing the matching conditions and execution actions of the security rules, the policy ambiguity is solved, and it is ensured that the intention of the security rule can be accurately and consistently executed, avoiding security blind spots or accidental access blocking. Invalid rule elimination is to find invalid security rules that can never be triggered due to being permanently overridden by higher priority security rules in front of them through simulation reasoning or dependency analysis. Removing these security rules from the security rule policy library can further simplify the configuration and reduce unnecessary performance overhead.

[0053] Machine learning, as a core branch of artificial intelligence, aims to endow computer systems with the ability to "learn" from data without relying on explicit and fixed program instructions. By providing a large amount of data to an algorithm, the algorithm itself identifies patterns, rules and relationships from the data to build a model. Through machine learning, massive amounts of raw security rule data can be analyzed, and raw security rule features can be extracted to improve the efficiency of raw security rule analysis.

[0054] Since not all optimized security rules are equally important, based on multi-dimensional data, a dynamic threat level or risk score is assigned to each optimized security rule. The division of optimized security rules includes: rule source authority, asset value, historical trigger frequency and effectiveness, and associated threat intelligence freshness and confidence.

[0055] Step S230, the optimized security rules and corresponding threat levels are synchronized to different security protection devices using the ETCD method.

[0056] ETCD is a distributed, highly available, key-value pair storage database, mainly used to store key data in distributed systems. ETCD supports message publishing and subscription, allowing components in the system to obtain the latest messages in a timely manner. Its core is to securely store key system configuration data that needs to be shared in a distributed system and ensure that all nodes have a consistent view of these data. The optimized security rules generated by machine learning and the threat levels corresponding to the optimized security rules are published and stored in ETCD in real time. The security protection devices deployed on each node act as clients and continuously monitor the corresponding configuration directory through the listening mechanism provided by ETCD. When any optimized security rule is changed or updated, ETCD will actively and immediately push the new configuration to all listening clients, thereby achieving efficient and consistent synchronization and distribution of optimized security rules across the entire protection system.

[0057] Step S240, based on the triggering of optimized security rules with different threat levels on security protection devices, the effectiveness of optimized security rules is evaluated, and the evaluation result is obtained.

[0058] After the optimized security rules of different threat levels are deployed on the security protection device, comprehensive monitoring and multi-dimensional effectiveness evaluation are performed according to the triggering conditions of the optimized security rules of different threat levels. The evaluation mainly includes accuracy, recall rate, performance impact on the device and business, and actual security value and other core indicators. Through correlation analysis of the optimized security rule triggering log and the security events of the security data source, the system can quantify the actual protection effect of each optimized security rule and identify high false alarm rules or defense blind spots. The evaluation results obtained finally are directly used to guide the iterative optimization of the optimized security rules, including adjusting the threshold, calibrating the threat level of the security rule, and disabling the invalid security rule.

[0059] Step S250, dynamically adjusting the threat level or state of the optimized security rule according to the evaluation result.

[0060] The multi-dimensional quantitative evaluation results of the deployed optimized security rules realize the dynamic and automatic adjustment of the threat level and state of the optimized security rule. For example, when an optimized security rule continuously shows extremely low false alarm rate and successfully protects, its threat level is raised to ensure that the alarm obtains the highest priority; on the contrary, if a rule for an old vulnerability has not been triggered for a long time due to outdated intelligence, or its false alarm rate continuously exceeds the threshold, the system will lower its threat level, or even automatically switch its state from blocking to only recording or directly disable it to prevent alarm fatigue and optimize resource allocation. This data-driven adaptive mechanism can ensure that the security policy and the real-time risk situation are synchronized.

[0061] The above steps S210 to S250, real-time collection of original security rules from multiple security data sources; wherein the security data sources include security protection devices and security rule data sources; the collected original security rules are regularized and coded, the optimized security rules are generated through machine learning, and the threat level division is performed for the optimized security rules; the ETCD method is used to synchronize the optimized security rules and the corresponding threat levels to different security protection devices; based on the triggering conditions of the optimized security rules of different threat levels on the security protection device, the effectiveness of the optimized security rules is evaluated to obtain the evaluation results; and the threat level or state of the optimized security rule is dynamically adjusted according to the evaluation results. Through the information collection, processing, distribution and dynamic adjustment of the security protection device and the security rule data source, the problem of security rule invalidation is solved, and the effectiveness of the security rule is maintained.

[0062] Optionally, in an embodiment, the security protection device includes a website application level intrusion prevention system, a security gateway, a firewall, an intrusion detection system, and a distributed denial of service; and the security rule data source includes a zero-day vulnerability rule library and a global security rule library.

[0063] The security protection device includes a website application level intrusion prevention system, a security gateway, a firewall, an intrusion detection system, and a distributed denial of service. The website application level intrusion prevention system can provide security rule trigger data for network layer attacks. The security gateway is a collection of various security rules and can collect rich security rule trigger data from different functional modules. The firewall provides logs and events of basic network access control, and its security rule trigger situation reflects abnormal behavior at the network layer. The intrusion detection system can monitor network traffic through deep packet inspection and match with a security rule library to discover potential intrusion behavior and alarm. The distributed denial of service is specifically used to mitigate large-scale traffic type attacks or resource exhaustion type attacks.

[0064] The security rule data source includes a zero-day vulnerability rule library and a global security rule library. The zero-day vulnerability rule library is a collection of security rules specifically used to detect and defend against attacks using zero-day vulnerabilities. Through the network security company's own security research team, active vulnerability mining, analysis of attack tools, or through a honeypot system to capture the latest attack methods, then quickly write detection and defense rules for zero-day vulnerabilities, and finally form a zero-day vulnerability rule library. The global security rule library is a cloud centralized and continuously updated global threat intelligence source that provides rule updates for security devices deployed around the world. The global security rule library has a threat intelligence center that quickly aggregates, analyzes, and verifies massive data to form high-confidence threat indicators. Once it is confirmed that an IP is malicious, a security rule can be generated immediately and pushed to all security devices connected to the cloud within minutes, allowing global users to have the ability to block malicious IPs in a timely manner.

[0065] In addition, in one embodiment, the collected original security rules are regularized and encoded, optimized security rules are generated through machine learning, and threat level division is performed for the optimized security rules, including: assigning a device unique identifier to the security protection device and the security rule data source, and assigning a rule unique identifier to each security rule; based on machine learning, analyzing the rule features of the original security rules to generate optimized security rules; and converting the optimized security rules into a security rule format corresponding to the device type of the different devices according to the device unique identifier.

[0066] A global security device ID is assigned to each security protection device, including firewalls, WAFs, IDS devices, security gateways, and Distributed Denial of Service (DDoS) devices, as well as each security rule data source. A rule ID is also assigned to each collected raw security rule, thus building a governance foundation with end-to-end traceability. Based on this, deep analysis of the raw security rules is performed using machine learning. For example, for IDS devices, features such as rule ID, type, and rule characters (e.g., regular expressions) are extracted to evaluate the activity and matching patterns of raw security rules, identifying redundant, inefficient, or invalid rules. For DDoS devices, the triggering logic and behavioral characteristics of defense rules such as SQL injection rules, Hypertext Transfer Protocol (HTTP) flood attacks, and Slowloris attacks are extracted. Through centralized learning and joint optimization of these multi-source raw security rules, the system generates highly accurate and adaptable optimized security rules. Based on the device type metadata associated with the security device ID, the built-in rule translation engine dynamically compiles the platform's unified optimized security rules into a configuration format natively supported by the target device.

[0067] In one embodiment, the threat level classification includes: zero-day vulnerabilities, high-threat security rules, medium-threat security rules, and low-threat security rules.

[0068] To achieve precise allocation of security resources, security rules are prioritized based on the urgency, destructive potential, and widespread nature of the threats they address, from highest to lowest: zero-day vulnerabilities, high-threat security rules, medium-threat security rules, and low-threat security rules. Zero-day vulnerabilities are security vulnerabilities that have been discovered and exploited by attackers, but which software vendors are unaware of and have not yet released official patches for. Because vendors have "zero days" to respond, they are called zero-day vulnerabilities, and these vulnerabilities pose a very high threat. High-threat security rules are used to address known attacks that can cause serious damage and have rapid propagation capabilities, such as remote code execution, ransomware, key steps in advanced persistent threat attack chains, and attacks targeting critical infrastructure. Medium-threat security rules are used to address attacks that may cause information leakage, service disruption, or privilege escalation, but typically do not have the ability to spread rapidly and on a large scale. Examples include common cross-site scripting (XSS), cross-site request forgery (XPS), directory traversal, and certain types of scanning and probing activities. Low-threat security rules are used to address attack attempts with low malicious intent, limited impact, or near-impossible success. For example, scans from isolated network segments, attacks targeting non-existent services, or attacks exploiting outdated vulnerabilities that have been fully patched.

[0069] In particular, in one embodiment, the ETCD mode is adopted to synchronize the optimized security rules and corresponding threat levels to different security protection devices, including: synchronizing the optimized security rules after rule coding and optimization learning to different security protection devices through the ETCD mode.

[0070] The ETCD synchronizes the optimized security rules and corresponding threat levels to the security protection device, which is a typical "publish-subscribe" mode. First, the machine learning engine generates the optimized security rules, and divides the threat levels of different optimized security rules, and writes the optimized security rules and corresponding threat levels into the ETCD cluster, wherein the security rule data is stored in a structured manner. Second, all security protection devices distributed in the network are connected to the ETCD cluster as clients when starting, and the started security protection device registers to listen to the ETCD. Subsequently, when new optimized security rules are written or old optimized security rules are updated, the listening mechanism of the ETCD is triggered immediately, at which time the ETCD cluster actively pushes the change event to all listening security protection devices. Further, after receiving the change notification, the built-in agent or client program of the security protection device parses the received data, and the security protection device immediately calls the API or configuration interface of itself according to the content of the optimized security rules and the threat level, applies the new optimized security rules to the local strategy, or adjusts the priority of the existing optimized security rules, and after the application is successful, the security protection device can send a confirmation signal to the ETCD.

[0071] In one embodiment, based on the triggering situation of the optimized security rules with different threat levels on the security protection device, the effectiveness of the optimized security rules is evaluated, and the evaluation result is obtained, including:

[0072] The threat coefficients are configured for different threat levels corresponding to the optimized security rules respectively; the actual triggering times of the optimized security rules on each security protection device are collected in real time, and the triggering times are normalized by combining the preset threat threshold of the optimized security rules, to obtain the standardized triggering value; the standardized triggering value of each optimized security rule is multiplied by the threat coefficient of the corresponding threat level to obtain the weighted risk contribution value; and the weighted risk contribution values of all optimized security rules are accumulated to obtain the effectiveness evaluation result of the optimized security rules.

[0073] Firstly, the system predefines differentiated threat coefficients for optimized security rules of different threat levels, for example, the threat coefficient of a zero-day vulnerability rule is set to 1.0, the threat coefficient of a high-threat rule is 0.7, the threat coefficient of a moderate-threat rule is 0.3, and the threat coefficient of a low-threat rule is 0.1, to reflect the differences in potential risk severity. Subsequently, the system collects the actual trigger times of each optimized security rule on each security protection device in real time, and combines the preset threat threshold to perform normalization processing, eliminating device heterogeneity and base difference, to generate a standardized trigger value. Then, the system multiplies the standardized trigger value of each optimized security rule by the threat coefficient corresponding to its threat level, to calculate a weighted risk contribution value that comprehensively reflects the frequency of rule triggering and the actual threat importance. Finally, the system accumulates and sums all the weighted risk contribution values of the optimized security rules, to generate an overall quantitative evaluation result, which not only objectively represents the actual protection effectiveness and risk coverage of the current security rule set, but also can be used for horizontal comparison of the effectiveness of different policy versions, to provide clear data-driven basis for continuous optimization of security policies.

[0074] In one embodiment, the security rules are dynamically adjusted according to the evaluation result, including: determining whether the threat level of the optimized security rule needs to be lowered or the optimized security rule needs to be removed directly according to the evaluation result.

[0075] Based on the evaluation result of the effectiveness of the optimized security rules, it is determined whether the optimized security rules need to be downgraded or removed. When a certain optimized security rule continuously presents a high false positive rate, the threat activity it is aimed at significantly decreases, or the asset value it protects is low, the system will automatically trigger a downgrade process, for example, downgrading the threat level from a high-threat level security rule to a moderate-threat level security rule, to reduce its alarm priority and reduce interference. For rules that have been confirmed to be completely ineffective, have serious redundancy, or still cause business failures and extremely high false positives after repeated optimization, a removal operation is performed to exclude them from the optimized security rules, to avoid unnecessary performance overhead and potential business risks.

[0076] Figure 3 is a component interaction diagram of a security rule analysis system according to one embodiment of the present application. As shown in Figure 3As shown, the security rule analysis system consists of the following parts: security rule analysis system 310, zero-day vulnerability rule library and global security rule library 320, website application level intrusion prevention system 330, distributed denial of service device 340, firewall 350, security gateway 360, and intrusion detection system device 370. Among them, ETCD as a cluster of distributed key-value storage, is responsible for unified storage and management of all security rules, and serves as the only trusted source. Lightweight program agents are deployed on the execution terminals of website application level intrusion prevention system 330, distributed denial of service device 340, firewall 350, security gateway 360, and intrusion detection system device 370, as a bridge between the ETCD cluster and the execution terminals of the devices, responsible for optimizing the synchronization and conversion of security rules.

[0077] First, the zero-day vulnerability rule library and the global security rule library 320 serve as the security rule input source of the security rule analysis system 310, providing the latest external threat intelligence and original security rules. At the same time, website application level intrusion prevention system 330, distributed denial of service device 340, firewall 350, security gateway 360, and intrusion detection system device 370 also upload the original security rules of each device to the security rule analysis system 310. Subsequently, the security rule analysis system 310 processes and optimizes the obtained original security rules, and writes the processed optimized security rules to the ETCD cluster. Then, the ETCD cluster uses its listening mechanism to actively and real-time push the optimized security rule change events to all device agents that subscribe to this information. After receiving the notification, the agent of each device pulls the complete rule configuration from the ETCD cluster, converts it to the language format supported by the device natively, and calls the device interface to load the rules, finally realizing the effectiveness of the optimized security rules.

[0078] Figure 4 is the evaluation logic diagram of the security rule level in the adjustment method of the security rule of one of the embodiments of the present application. As shown in Figure 4 The logical framework builds an automated evaluation system based on multiple threshold levels and dynamic triggering.

[0079] Among them, the security rules are divided into four levels according to the severity: zero-day vulnerability, high threat level security rule, medium threat level security rule and low threat level security rule. And the evaluation threshold of the high threat level security rule is configured as threshold 1, the evaluation threshold of the medium threat level security rule is configured as threshold 2, and the evaluation threshold of the low threat level security rule is configured as threshold 3. The specific meaning of the threshold here is that the maximum number of triggers allowed by the security rule within a certain time window. For example, when the threshold 1 value corresponding to the high threat level security rule is set to 15, within a certain time, when the number of triggers of the high threat level security rule exceeds 15, it means that the high threat level security rule is abnormally active, at which time a high-risk alarm will be generated to remind the security rule administrator. Therefore, in the evaluation of different levels of security rules, the accuracy and timeliness of different security rules are evaluated according to the security rule level and the global trigger level of the live network.

[0080] In particular, the zero-day vulnerability is not configured with a corresponding evaluation threshold, because any trigger of the zero-day vulnerability is extremely likely to be a real and extremely destructive attack. Therefore, once the zero-day vulnerability is triggered, the highest alarm is directly sounded, and the security rule administrator needs to be directly reminded. At this time, the evaluation of the zero-day vulnerability in the evaluation of different levels of security rules is no longer a regular periodic performance statistics, but requires an immediate response to the zero-day vulnerability and effective verification afterwards.

[0081] Figure 5 is a structural block diagram of the security rule protection system of one of the embodiments of the present application. As Figure 5 shown, the security rule protection system 50 includes a data processing module 52, a rule issuing module 54 and a result evaluation module 56; wherein: the data processing module 52 is used to collect original security rules in real time from a plurality of security data sources; wherein the security data source includes a security protection device and a security rule data source; the collected original security rules are regularized and coded, optimized security rules are generated through machine learning, and the optimized security rules are divided into threat levels; the rule issuing module 54 is used to synchronize the optimized security rules and the corresponding threat levels to different security protection devices in the ETCD mode; the result evaluation module 56 is used to evaluate the effectiveness of the optimized security rules based on the trigger situation of the optimized security rules of different threat levels on the security protection device, and obtain the evaluation result; according to the evaluation result, the threat level or state of the optimized security rules is dynamically adjusted.

[0082] It should be noted that the above various modules can be functional modules or program modules, which can be implemented by software or hardware. For the modules implemented by hardware, the above various modules can be located in the same processor; or the above various modules can also be located in different processors in any combination.

[0083] In the embodiment, an electronic device is also provided, which comprises a memory and a processor, the memory stores a computer program, and the processor is configured to execute the computer program to perform the steps in the embodiment of the adjustment method of the security rule. The electronic device can include but is not limited to a server, a network security controller, a cloud security center management system or other dedicated security operation equipment.

[0084] Optionally, the electronic device can further comprise a transmission device and an input and output device, wherein the transmission device is connected with the processor, and the input and output device is connected with the processor.

[0085] Optionally, in the embodiment, the processor can be configured to execute the following steps through the computer program:

[0086] S1, collecting original security rules in real time from a plurality of security data sources; wherein the security data sources include security protection devices and security rule data sources;

[0087] S2, normalizing and encoding the collected original security rules, generating optimized security rules through machine learning, and dividing the optimized security rules into threat levels;

[0088] S3, synchronizing the optimized security rules and the corresponding threat levels to different security protection devices in an ETCD manner;

[0089] S4, evaluating the effectiveness of the optimized security rules based on the triggering of the optimized security rules of different threat levels on the security protection devices, and obtaining an evaluation result;

[0090] S5, dynamically adjusting the threat level or state of the optimized security rules according to the evaluation result.

[0091] It should be noted that the specific examples in the embodiment can refer to the examples described in the above embodiments and optional implementation manners, which will not be described herein.

[0092] It should be understood that the specific embodiments described herein are used to explain this application, but not to limit it. According to the embodiments provided in the present application, all other embodiments obtained by those of ordinary skill in the art without creative labor are within the scope of protection of the present application.

[0093] It should be noted that the user information (including but not limited to user equipment information, user personal information, etc.) and data (including but not limited to data for analysis, stored data, displayed data, etc.) involved in the present application are all information and data authorized by the user or authorized by all parties.

[0094] Obviously, the drawings are only some examples or embodiments of the present application, and those skilled in the art can also apply the present application to other similar situations without creative labor according to the drawings. In addition, it can be understood that although the work done in the development process may be complex and long, but for those skilled in the art, some design, manufacture or production changes according to the technical content disclosed in the present application are only routine technical means, and should not be regarded as insufficient disclosure of the present application.

[0095] The word "embodiment" in the present application means that the specific features, structures or characteristics described in combination with the embodiment can be included in at least one embodiment of the present application. The appearance of this phrase in various places in the specification does not necessarily mean the same embodiment, nor does it mean independence or alternatives to other embodiments. It can be clearly or implicitly understood by those skilled in the art that the embodiments described in the present application can be combined with other embodiments without conflict.

[0096] The above embodiments only express several implementation manners of the present application, and the description is more specific and detailed, but it should not be understood as a limitation on the scope of patent protection. It should be noted that for those skilled in the art, without departing from the concept of the present application, a number of modifications and improvements can be made, which are all within the scope of protection of the present application. Therefore, the scope of protection of the present application should be subject to the appended claims.

Claims

1. A method for adjusting security rules, characterized in that, The method includes: Raw security rules are collected in real time from multiple security data sources; wherein, the security data sources include security protection devices and security rule data sources; The collected original security rules are coded into rules, optimized security rules are generated through machine learning, and threat levels are classified for the optimized security rules. The optimized security rules and corresponding threat levels are synchronized to different security protection devices using the ETCD method. The effectiveness of the optimized security rules is evaluated based on the triggering status of the optimized security rules on the security protection device for different threat levels, and the evaluation results are obtained. Based on the assessment results, the threat level or status of the optimized security rules will be dynamically adjusted.

2. The method for adjusting security rules according to claim 1, characterized in that, The security protection equipment includes a website application-level intrusion prevention system, a security gateway, a firewall, an intrusion detection system, and a distributed denial-of-service; the security rule data source includes a zero-day vulnerability rule base and a global security rule base.

3. The method for adjusting security rules according to claim 1, characterized in that, The process of encoding the collected original security rules into rules, generating optimized security rules through machine learning, and classifying the optimized security rules into threat levels includes: Assign a unique device identifier to the security protection device and the security rule data source, and assign a unique rule identifier to each security rule; Based on machine learning, the rule features of the original security rules are analyzed to generate optimized security rules; Based on the different device types identified by the device's unique identifier, the optimized security rules are converted into rule formats adapted to the corresponding device types.

4. The method for adjusting security rules according to claim 1, characterized in that, The threat level classification includes: zero-day vulnerabilities, high-threat security rules, medium-threat security rules, and low-threat security rules.

5. The method for adjusting security rules according to claim 3, characterized in that, The method of synchronizing the optimized security rules and corresponding threat levels to different security protection devices using ETCD includes: The optimized security rules, after being regularized and learned, are synchronized to different security protection devices using the ETCD method.

6. The method for adjusting security rules according to claim 1, characterized in that, The effectiveness of the optimized security rules, based on different threat levels, is evaluated on the triggering status of the optimized security rules on the security protection device, and the evaluation results are obtained, including: Configure threat coefficients for different threat levels corresponding to the optimized security rules; By collecting the actual number of times the optimized security rules are triggered on each of the security protection devices in real time, and combining the threat threshold preset by the optimized security rules, the number of triggers is normalized to obtain a standardized trigger value. The standardized trigger value of each optimized security rule is multiplied by the threat coefficient of the corresponding threat level to obtain the weighted risk contribution value; The weighted risk contribution values ​​of all the optimized security rules are summed to obtain the effectiveness evaluation result of the optimized security rules.

7. The method for adjusting safety rules according to claim 6, characterized in that, The step of dynamically adjusting the threat level or status of the optimized security rules based on the evaluation results includes: Based on the assessment results, it is determined whether the threat level of the optimized security rule needs to be reduced, or whether the optimized security rule should be removed directly.

8. A security rule protection system, characterized in that, The security rule protection system includes a data processing module, a rule distribution module, and a result evaluation module; wherein: The data processing module is used to collect raw security rules in real time from multiple security data sources; wherein, the security data sources include security protection devices and security rule data sources; the collected raw security rules are coded into rules, optimized security rules are generated through machine learning, and threat levels are classified for the optimized security rules; The rule distribution module is used to synchronize the optimized security rules and the corresponding threat levels to different security protection devices using the ETCD method. The result evaluation module is used to evaluate the effectiveness of the optimized security rules based on the triggering status of the optimized security rules on the security protection device at different threat levels, and obtain the evaluation result; and dynamically adjust the threat level or status of the optimized security rules according to the evaluation result.

9. An electronic device comprising a memory and a processor, characterized in that, The memory stores a computer program, and the processor is configured to run the computer program to perform the method for adjusting the security rules according to any one of claims 1 to 7.

10. A computer-readable storage medium having a computer program stored thereon, characterized in that, When the computer program is executed by a processor, it implements the steps of the method for adjusting the security rules according to any one of claims 1 to 7.

Images