Switch port security management method, device and equipment and storage medium

Abstract

The application discloses a switch port security management method and device, equipment and a storage medium, and relates to the technical field of network management. The switch port security management method comprises the following steps: obtaining port operation data and traffic data of a switch; generating a security policy of a port according to the port operation data and the traffic data; performing real-time state monitoring on the port of the switch and determining an abnormal event after the security policy is executed; and performing a security response operation according to the type and severity level of the abnormal event. The application can improve the accuracy of switch port security management.

Description

Technical Field

[0001] This application relates to the field of network management technology, and in particular to a method, apparatus, device, and storage medium for security management of switch ports. Background Technology

[0002] In the current network environment, switches, as core connection devices, serve as the first line of defense against internal network attacks through their port security. Traditional port security management technologies, such as statically bound port security, dynamic address resolution protocol checks, or Internet Protocol source protection, primarily rely on administrators manually configuring fixed policies for each port. This lack of real-time, intelligent analysis capabilities of port traffic and access behavior leads to rigid and imprecise security management. Therefore, improving the accuracy of switch port security management remains a problem that needs to be addressed.

[0003] The above content is only used to help understand the technical solution of this application and does not represent an admission that the above content is prior art. Summary of the Invention

[0004] The main objective of this application is to provide a method, apparatus, device, and storage medium for security management of switch ports, aiming to solve the technical problem of how to improve the accuracy of security management of switch ports.

[0005] To achieve the above objectives, this application proposes a method for security management of switch ports, the method comprising:

[0006] Obtain port operation data and traffic data from the switch;

[0007] Generate a security policy for the port based on the port operation data and the traffic data;

[0008] After the security policy is implemented, the ports of the switch are monitored in real time and abnormal events are identified.

[0009] Perform security response actions based on the type and severity level of the abnormal event.

[0010] In one embodiment, before the step of obtaining the port operation data and traffic data of the switch, the method further includes:

[0011] Detect changes in the port status of the switch;

[0012] The sampling frequency is determined based on the port status change data.

[0013] In one embodiment, the step of generating a port security policy based on the port operation data and the traffic data includes:

[0014] The port type is determined based on the port operation data, and the corresponding basic policy template is matched from the preset policy template library based on the port type.

[0015] Traffic features and device access features are extracted from the port operation data and the traffic data;

[0016] The traffic characteristics and device access characteristics are processed using a port model to obtain policy template parameters. The port model is trained from historical port-related data.

[0017] The basic policy template is modified according to the policy template parameters to obtain the security policy.

[0018] In one embodiment, after the step of generating a port security policy based on the port operation data and the traffic data, the method further includes:

[0019] Monitor the topology information of the network where the switch is located;

[0020] When the topology information changes, the security policy is regenerated.

[0021] In one embodiment, the abnormal events include traffic abnormal events, device access abnormal events, and protocol abnormal events. The step of real-time status monitoring of the switch ports and determining the abnormal events includes:

[0022] Collect the latest traffic data, latest device access data, and latest protocol behavior data of the switch ports;

[0023] Traffic anomaly events are determined based on the preset traffic baseline value and the latest traffic data;

[0024] Based on the latest device access data, determine the device access anomaly event;

[0025] The protocol anomaly event is determined based on the latest protocol behavior data.

[0026] In one embodiment, the step of performing a security response operation based on the type and severity level of the abnormal event includes:

[0027] The severity level of the abnormal event is determined according to preset rules;

[0028] Determine the target protection measures based on the type of the abnormal event;

[0029] Determine the target alarm measures based on the severity level.

[0030] In one embodiment, after the step of determining the target alarm measure based on the severity level, the method further includes:

[0031] Receive manual confirmation instructions;

[0032] Adjust the target protection measures according to the manual processing confirmation instruction.

[0033] Furthermore, to achieve the above objectives, this application also proposes a switch port security management device, which includes:

[0034] The acquisition module is used to acquire port operation data and traffic data of the switch;

[0035] The generation module is used to generate a security policy for the port based on the port operation data and the traffic data.

[0036] The determination module is used to perform real-time status monitoring of the ports of the switch and determine abnormal events after the security policy is executed.

[0037] The execution module is used to perform security response operations based on the type and severity level of the abnormal event.

[0038] In addition, to achieve the above objectives, this application also proposes a switch port security management device, the device comprising: a memory, a processor, and a computer program stored in the memory and executable on the processor, the computer program being configured to implement the steps of the switch port security management method described above.

[0039] In addition, to achieve the above objectives, this application also proposes a storage medium, which is a computer-readable storage medium, on which a computer program is stored, and when the computer program is executed by a processor, it implements the steps of the switch port security management method described above.

[0040] In addition, to achieve the above objectives, this application also provides a computer program product, which includes a computer program that, when executed by a processor, implements the steps of the switch port security management method described above.

[0041] This application provides a method for security management of switch ports. The method involves acquiring port operation data and traffic data of the switch; generating a port security policy based on the port operation data and traffic data; executing the security policy; performing real-time status monitoring of the switch ports and identifying abnormal events; and performing security response operations based on the type and severity level of the abnormal events. This application improves the accuracy of switch port security management by generating port security policies and performing real-time monitoring and anomaly determination of switch ports based on these policies, and then executing corresponding response operations according to the type and severity of abnormal events. Attached Figure Description

[0042] The accompanying drawings, which are incorporated in and form part of this specification, illustrate embodiments consistent with this application and, together with the description, serve to explain the principles of this application.

[0043] To more clearly illustrate the technical solutions in the embodiments of this application or the prior art, the drawings used in the description of the embodiments or the prior art will be briefly introduced below. Obviously, for those skilled in the art, other drawings can be obtained based on these drawings without creative effort.

[0044] Figure 1 This is a flowchart illustrating an embodiment of the switch port security management method of this application.

[0045] Figure 2 This is a flowchart illustrating Embodiment 2 of the switch port security management method of this application.

[0046] Figure 3 This is a schematic diagram of the module structure of the switch port security management device according to an embodiment of this application;

[0047] Figure 4 This is a schematic diagram of the device structure of the hardware operating environment involved in the switch port security management method in this application embodiment.

[0048] The purpose, features, and advantages of this application will be further explained in conjunction with the embodiments and with reference to the accompanying drawings. Detailed Implementation

[0049] It should be understood that the specific embodiments described herein are merely illustrative of the technical solutions of this application and are not intended to limit this application.

[0050] To better understand the technical solution of this application, a detailed description will be provided below in conjunction with the accompanying drawings and specific implementation methods.

[0051] The main solution of this application is to obtain the port operation data and traffic data of the switch; generate a port security policy based on the port operation data and traffic data; after executing the security policy, perform real-time status monitoring on the port of the switch and identify abnormal events; and perform security response operations according to the type and severity level of the abnormal events.

[0052] In the current network environment, switches, as core connection devices, serve as the first line of defense against internal network attacks through their port security. Traditional port security management technologies, such as statically bound port security, dynamic address resolution protocol checks, or Internet Protocol source protection, primarily rely on administrators manually configuring fixed policies for each port. This lack of real-time, intelligent analysis capabilities of port traffic and access behavior leads to rigid and imprecise security management. Therefore, improving the accuracy of switch port security management remains a problem that needs to be addressed.

[0053] This application improves the accuracy of switch port security management by generating port security policies and performing real-time monitoring and anomaly detection of switch ports based on these policies, and then executing corresponding response operations according to the type and level of the abnormal events.

[0054] Based on this, this application provides a method for security management of switch ports, referring to... Figure 1 , Figure 1 This is a flowchart illustrating the first embodiment of the switch port security management method of this application.

[0055] In this embodiment, the switch port security management method includes steps S10 to S40:

[0056] Step S10: Obtain the port operation data and traffic data of the switch;

[0057] It should be noted that the executing entity in this embodiment can be a computing service device with data processing, network communication, and program execution functions, such as a tablet computer, personal computer, or mobile phone, or an electronic device or switch port security management device capable of performing the above functions. The following description uses a switch port security management device as an example to illustrate this embodiment and the subsequent embodiments.

[0058] It should be noted that SNMP v3 (Simple Network Management Protocol version 3) can be used to collect port operation data and traffic data from the switch, including: port type, such as access port, trunk port, and management port; the physical address (Media Access Control, MAC address), Internet Protocol (IP) address, port speed, real-time traffic (inbound / outbound), device online duration, and historical access device records of the currently accessing devices. Furthermore, the collected data can be cleaned, removing invalid data, such as incorrectly formatted MAC addresses; standardizing the data unit, such as unifying the traffic unit to Mbps; and deduplicating, such as deleting duplicate device access records.

[0059] In one feasible approach, before the step of acquiring the port operation data and traffic data of the switch, the method further includes: detecting port status change data of the switch; and determining the acquisition frequency based on the port status change data.

[0060] It should be noted that, to ensure no critical data is missed, the data collection frequency can be automatically adjusted. Specifically, the default collection frequency is once every 5 minutes; when a change in port status is detected (such as a new device being connected, a device going offline, or a sudden change in traffic), the collection frequency is automatically increased to once every 1 minute, and this continues for 5 cycles before returning to the default frequency.

[0061] Step S20: Generate a security policy for the port based on the port operation data and the traffic data;

[0062] It should be noted that different port types require different security policies. Therefore, the port type can be determined first based on the port operation data, and then the corresponding security policy can be selected from the fixed policy template. The parameters in the security policy can be modified to obtain a targeted security policy for the port.

[0063] In one feasible approach, after the step of generating a port security policy based on the port operation data and the traffic data, the method further includes: monitoring the topology information of the network where the switch is located; and regenerating the security policy when the topology information changes.

[0064] It's important to note that after obtaining the security policies, they are batch-deployed to the target switch ports. During deployment, configuration results can be verified in real time. If a port configuration fails (e.g., the switch goes offline), the reason for the failure is recorded, and a retry mechanism is triggered, such as retrying once every 5 minutes. After three failed attempts, the administrator is notified. Furthermore, a comprehensive review of all port policies can be performed every 24 hours, incorporating the latest network data and security threat intelligence to optimize policy parameters. Additionally, the network topology information of the network containing the switches can be monitored. If significant changes to the network topology are detected, such as the addition of a switch or adjustments to port roles, it indicates that the original security policies need adjustment, thus immediately triggering the policy update process.

[0065] Step S30: After executing the security policy, perform real-time status monitoring on the ports of the switch and identify abnormal events;

[0066] It should be noted that after implementing the security policy, a restriction command is issued to the switch, which can avoid common security issues. However, problems such as configuration failure, devices bypassing restrictions (e.g., MAC spoofing), or traffic surges exceeding limits still exist. Therefore, further monitoring can be performed as a secondary detection method to comprehensively address security issues.

[0067] In one feasible approach, the abnormal events include traffic abnormal events, device access abnormal events, and protocol abnormal events. The step of real-time status monitoring of the switch ports and determining abnormal events includes: collecting the latest traffic data, latest device access data, and latest protocol behavior data of the switch ports; determining traffic abnormal events based on a preset traffic baseline value and the latest traffic data; determining device access abnormal events based on the latest device access data; and determining protocol abnormal events based on the latest protocol behavior data.

[0068] It should be noted that real-time status monitoring can specifically perform traffic data collection: capturing traffic data (including source IP, destination IP, port number, protocol type, packet size, transmission rate, etc.) from switch ports in real time, with a collection granularity of 1 second / datagram, and achieving high-throughput data transmission through Kafka message queues (supporting processing more than 100,000 traffic records per second); device access data collection: obtaining the MAC address, device model, and manufacturer information of devices accessing the port in real time through the switch's LLDP (Link Layer Discovery Protocol), triggering immediate data reporting when a device is connected or disconnected; protocol behavior data collection: monitoring the interaction process of key protocols such as Address Resolution Protocol (ARP), Dynamic Host Configuration Protocol (DHCP), and Secure Shell Protocol (SSH), recording the field information of protocol data packets, such as the MAC-IP mapping relationship in ARP packets and the address allocation record in DHCP packets.

[0069] It's important to note that for traffic data, a baseline traffic value can be set, such as a normal traffic range of 80-100 Mbps. If the detected traffic exceeds this range, it's considered a traffic anomaly. Similarly, if the traffic changes at a rate exceeding a set threshold (e.g., 150%) within a short period, it's also marked as a traffic anomaly. For device access data, MAC addresses, device models, etc., can be used to determine if unauthorized devices have connected, or to detect device disconnections, thus identifying device access anomalies. For protocol behavior data, abnormal protocol behaviors, such as forged ARP responses or DHCP address exhaustion attacks, can be identified to determine protocol anomalies.

[0070] Step S40: Perform a security response operation based on the type and severity level of the abnormal event.

[0071] It should be noted that abnormal events may be caused by network fluctuations or external attacks. Obviously, the response actions will differ depending on the type and severity of the abnormal event. Specific security response actions should be performed based on the type and severity of the abnormal event.

[0072] In one feasible approach, the step of performing a security response operation based on the type and severity level of the abnormal event includes: determining the severity level of the abnormal event according to preset rules; determining target protection measures according to the type of the abnormal event; and determining target alarm measures according to the severity level.

[0073] It should be noted that the type of an abnormal event can be directly obtained from the abnormal event identification process. However, the severity level requires matching the abnormal event according to preset rules to determine whether it is low-risk, medium-risk, or high-risk. These preset rules are pre-set rules that mark the risk levels of various abnormal behaviors, thus allowing the matching of the abnormal event's severity level.

[0074] It should be noted that the corresponding protective measures can be determined based on the type of abnormal event. For example, if the abnormal event is a traffic anomaly, port traffic can be restricted. If the abnormal event is a device access anomaly, new device access can be temporarily prohibited, or the IP / MAC address corresponding to that port can be added to the blacklist in the firewall. If the abnormal event is a protocol anomaly, the protocol protection function can be immediately enabled or strengthened on the corresponding port through the switch interface, or all or unnecessary traffic on that port can be blocked to completely cut off the attack path.

[0075] It should be noted that the target alerting measures can be determined based on the severity of the abnormal event. For low-risk events, no alert can be issued initially, but the event can be marked in the system log. An alert will be triggered only after a certain number of occurrences. For medium-risk events, an alert message can be sent to the administrator via email, including event details, automatic handling measures, and suggestions, such as "Please suggest checking if there are any business anomalies on the port." Continuous monitoring should be maintained, with the monitoring frequency increased. If the situation does not return to normal within a certain period, it should be upgraded to high-risk. For high-risk events, an emergency alert should be sent to the administrator simultaneously via email, SMS, and other means, including event details and automatic isolation measures.

[0076] In one feasible approach, after the step of determining the target alarm measure based on the severity level, the method further includes: receiving a manual processing confirmation instruction; and adjusting the target protection measure according to the manual processing confirmation instruction.

[0077] It should be noted that after an alert is issued, the administrator may manually adjust the automated protection settings. In this case, the system can receive manual confirmation instructions to adjust the current protection measures.

[0078] This embodiment acquires port operation data and traffic data of the switch; generates a port security policy based on the port operation data and traffic data; after executing the security policy, performs real-time status monitoring of the switch ports and identifies abnormal events; and executes security response operations according to the type and severity level of the abnormal events. This embodiment improves the accuracy of switch port security management by generating port security policies and performing real-time monitoring and anomaly determination of switch ports based on these policies, and then executing corresponding response operations according to the type and severity of abnormal events.

[0079] Based on the first embodiment of this application, in the second embodiment of this application, the content that is the same as or similar to that in Embodiment 1 above can be referred to the above description, and will not be repeated hereafter. Based on this, please refer to... Figure 2 Step S20 also includes steps S201 to S204:

[0080] Step S201: Determine the port type based on the port operation data, and match the corresponding basic policy template from the preset policy template library based on the port type;

[0081] It should be noted that port types include access ports, trunk ports, and management ports. Different basic policy templates exist in the preset policy template library for different ports. For example, the access port template allows ≤5 bound MAC addresses, a maximum single-device traffic limit (dynamically adjusted based on port speed, e.g., a 1Gbps port limits maximum traffic to 800Mbps), enables ARP spoofing protection, and prohibits cross-VLAN access. The trunk port template allows ≤10 bound MAC addresses, limits traffic to 90% of the port speed, enables DAI and IP source protection, and allows only traffic from specified VLANs to pass through. The management port template only allows access from preset administrator device MAC addresses, limits traffic to 100Mbps, enables encrypted access, and prohibits connections from non-management network segments.

[0082] Step S202: Extract traffic features and device access features from the port operation data and the traffic data;

[0083] It should be noted that key quantitative indicators that characterize the current and historical behavior patterns of a port are calculated and extracted from continuous port operation data streams and traffic data streams. For example, traffic statistics such as average traffic, peak traffic, and traffic volatility are extracted from traffic data; and device access characteristics such as the number of active devices, the distribution of device online time, and the frequency of new device access are extracted from operation data.

[0084] Step S203: Process the traffic characteristics and device access characteristics using a port model to obtain policy template parameters. The port model is trained from historical port-related data.

[0085] It should be noted that the extracted traffic statistics features and device access features are input into a machine learning model (such as a regression model, decision tree, or neural network) trained with a large amount of historical network data and security event data. This model can predict the optimal parameter adjustment amount under the current network condition. Step S204: Modify the basic policy template according to the policy template parameters to obtain the security policy.

[0086] It should be noted that the security policy is obtained by modifying the basic policy template according to the policy template parameters. For example, the number of MAC addresses bound can be automatically increased from 5 to 8 in the template, or the traffic rate limit threshold can be dynamically adjusted from 800Mbps to 850Mbps, resulting in a more accurate security policy.

[0087] This embodiment determines the port type based on the port operation data and matches the corresponding basic policy template from a preset policy template library according to the port type. Traffic features and device access features are extracted from the port operation data and the traffic data. The traffic features and device access features are processed using a port model, which is trained from historical port-related data, to obtain policy template parameters. The basic policy template is modified according to the policy template parameters to obtain the security policy. This embodiment uses a machine learning model to achieve automated and personalized generation of security policies, enabling policies to dynamically adapt to changes in the network environment and improving the accuracy of port security management.

[0088] It should be noted that the above examples are only for understanding this application and do not constitute a limitation on the switch port security management method of this application. Any simple modifications based on this technical concept are within the protection scope of this application.

[0089] This application also provides a switch port security management device; please refer to... Figure 3 The switch port security management device includes:

[0090] Module 10 is used to acquire port operating data and traffic data of the switch;

[0091] Generation module 20 is used to generate a security policy for the port based on the port operation data and the traffic data;

[0092] The determination module 30 is used to perform real-time status monitoring of the ports of the switch and determine abnormal events after the security policy is executed.

[0093] The execution module 40 is used to perform a security response operation based on the type and severity level of the abnormal event.

[0094] This embodiment acquires port operation data and traffic data of the switch; generates a port security policy based on the port operation data and traffic data; after executing the security policy, performs real-time status monitoring of the switch ports and identifies abnormal events; and executes security response operations according to the type and severity level of the abnormal events. This embodiment improves the accuracy of switch port security management by generating port security policies and performing real-time monitoring and anomaly determination of switch ports based on these policies, and then executing corresponding response operations according to the type and severity of abnormal events.

[0095] In one embodiment, the acquisition module 10 is further configured to detect port status change data of the switch and determine the acquisition frequency based on the port status change data.

[0096] In one embodiment, the generation module 20 is further configured to determine the port type based on the port operation data, and match the corresponding basic policy template from a preset policy template library based on the port type; extract traffic features and device access features from the port operation data and the traffic data; process the traffic features and device access features using a port model to obtain policy template parameters, wherein the port model is trained from historical port-related data; and modify the basic policy template according to the policy template parameters to obtain a security policy.

[0097] In one embodiment, the generation module 20 is further configured to monitor the topology information of the network where the switch is located; when the topology information changes, the security policy is regenerated.

[0098] In one embodiment, the determining module 30 is further configured to collect the latest traffic data, latest device access data, and latest protocol behavior data of the switch port; determine traffic anomaly events based on a preset traffic baseline value and the latest traffic data; determine device access anomaly events based on the latest device access data; and determine protocol anomaly events based on the latest protocol behavior data.

[0099] In one embodiment, the execution module 40 is further configured to determine the severity level of the abnormal event according to preset rules; determine target protection measures according to the type of the abnormal event; and determine target alarm measures according to the severity level.

[0100] In one embodiment, the execution module 40 is further configured to receive a manual processing confirmation instruction and adjust the target protection measures according to the manual processing confirmation instruction.

[0101] The switch port security management device provided in this application, employing the switch port security management method described in the above embodiments, can solve the technical problem of how to improve the accuracy of switch port security management. Compared with the prior art, the beneficial effects of the switch port security management device provided in this application are the same as those of the switch port security management method provided in the above embodiments, and other technical features in the switch port security management device are the same as those disclosed in the methods of the above embodiments, and will not be repeated here.

[0102] This application provides a switch port security management device, which includes: at least one processor; and a memory communicatively connected to the at least one processor; wherein the memory stores instructions executable by the at least one processor, and the instructions are executed by the at least one processor to enable the at least one processor to perform the switch port security management method in the above embodiment 1.

[0103] The following is for reference. Figure 4 The diagram illustrates a structural schematic of a switch port security management device suitable for implementing embodiments of this application. The switch port security management device in this application may include, but is not limited to, mobile terminals such as mobile phones, laptops, digital broadcast receivers, PDAs (Personal Digital Assistants), PADs (Portable Application Description), PMPs (Portable Media Players), in-vehicle terminals (e.g., in-vehicle navigation terminals), and fixed terminals such as digital TVs and desktop computers. Figure 4 The switch port security management device shown is merely an example and should not impose any limitations on the functionality and scope of use of the embodiments of this application.

[0104] like Figure 4As shown, the switch port security management device may include a processing unit 1001 (e.g., a central processing unit, a graphics processing unit, etc.), which can perform various appropriate actions and processes according to a program stored in ROM (Read Only Memory) 1002 or a program loaded from storage device 1003 into RAM (Random Access Memory) 1004. RAM 1004 also stores various programs and data required for the operation of the switch port security management device. The processing unit 1001, ROM 1002, and RAM 1004 are interconnected via bus 1005. Input / output (I / O) interface 1006 is also connected to the bus. Typically, the following systems can be connected to I / O interface 1006: input devices 1007 including, for example, touch screens, touchpads, keyboards, mice, image sensors, microphones, accelerometers, gyroscopes, etc.; output devices 1008 including, for example, liquid crystal displays (LCDs), speakers, vibrators, etc.; storage devices 1003 including, for example, magnetic tapes, hard disks, etc.; and communication devices 1009. Communication device 1009 allows the switch port security management device to communicate wirelessly or wiredly with other devices to exchange data. While the figure shows switch port security management devices with various systems, it should be understood that implementation or possession of all the systems shown is not required. More or fewer systems may be implemented alternatively.

[0105] Specifically, according to the embodiments disclosed in this application, the processes described above with reference to the flowcharts can be implemented as computer software programs. For example, embodiments disclosed in this application include a computer program product comprising a computer program carried on a computer-readable medium, the computer program containing program code for performing the methods shown in the flowcharts. In such embodiments, the computer program can be downloaded and installed from a network via a communication device, or installed from storage device 1003, or installed from ROM 1002. When the computer program is executed by processing device 1001, it performs the functions defined in the methods of the embodiments disclosed in this application.

[0106] The switch port security management device provided in this application, employing the switch port security management method described in the above embodiments, can solve the technical problem of how to improve the accuracy of switch port security management. Compared with the prior art, the beneficial effects of the switch port security management device provided in this application are the same as those of the switch port security management method provided in the above embodiments, and other technical features of this switch port security management device are the same as those disclosed in the previous embodiment method, and will not be repeated here.

[0107] It should be understood that the various parts disclosed in this application can be implemented using hardware, software, firmware, or a combination thereof. In the description of the above embodiments, specific features, structures, materials, or characteristics can be combined in any suitable manner in one or more embodiments or examples.

[0108] The above description is merely a specific embodiment of this application, but the scope of protection of this application is not limited thereto. Any variations or substitutions that can be easily conceived by those skilled in the art within the scope of the technology disclosed in this application should be included within the scope of protection of this application. Therefore, the scope of protection of this application should be determined by the scope of the claims.

[0109] This application provides a computer-readable storage medium having computer-readable program instructions (i.e., a computer program) stored thereon, which are used to execute the switch port security management method in the above embodiments.

[0110] The computer-readable storage medium provided in this application may be, for example, a USB flash drive, but is not limited to, electrical, magnetic, optical, electromagnetic, infrared, or semiconductor systems, devices, or any combination thereof. More specific examples of computer-readable storage media may include, but are not limited to: electrical connections having one or more wires, portable computer disks, hard disks, random access memory (RAM), read-only memory (ROM), erasable programmable read-only memory (EPROM or flash memory), optical fiber, portable compact disk read-only memory (CD-ROM), optical storage devices, magnetic storage devices, or any suitable combination thereof. In this embodiment, the computer-readable storage medium may be any tangible medium containing or storing a program that can be used by or in conjunction with an instruction execution system, system, or device. The program code contained on the computer-readable storage medium may be transmitted using any suitable medium, including but not limited to: wires, optical cables, RF (Radio Frequency), etc., or any suitable combination thereof.

[0111] The aforementioned computer-readable storage medium may be included in the switch port security management device; or it may exist independently and not be assembled into the switch port security management device.

[0112] The aforementioned computer-readable storage medium carries one or more programs that, when executed by a switch port security management device, cause the switch port security management device to: acquire port operation data and traffic data of the switch; generate a port security policy based on the port operation data and traffic data; perform real-time status monitoring of the switch port and identify abnormal events after executing the security policy; and perform security response operations based on the type and severity level of the abnormal events.

[0113] Computer program code for performing the operations of this application can be written in one or more programming languages ​​or a combination thereof, including object-oriented programming languages ​​such as Java, Smalltalk, and C++, and conventional procedural programming languages ​​such as the "C" language or similar programming languages. The program code can be executed entirely on the user's computer, partially on the user's computer, as a standalone software package, partially on the user's computer and partially on a remote computer, or entirely on a remote computer or server. In cases involving remote computers, the remote computer can be connected to the user's computer via any type of network—including a Local Area Network (LAN) or a Wide Area Network (WAN)—or can be connected to an external computer (e.g., via the Internet using an Internet service provider).

[0114] The flowcharts and block diagrams in the accompanying drawings illustrate the architecture, functionality, and operation of possible implementations of systems, methods, and computer program products according to various embodiments of this application. In this regard, each block in a flowchart or block diagram may represent a module, segment, or portion of code containing one or more executable instructions for implementing a specified logical function. It should also be noted that in some alternative implementations, the functions indicated in the blocks may occur in a different order than those indicated in the drawings. For example, two consecutively indicated blocks may actually be executed substantially in parallel, and they may sometimes be executed in reverse order, depending on the functions involved. It should also be noted that each block in the block diagrams and / or flowcharts, and combinations of blocks in the block diagrams and / or flowcharts, can be implemented using a dedicated hardware-based system that performs the specified function or operation, or using a combination of dedicated hardware and computer instructions.

[0115] The modules described in the embodiments of this application can be implemented in software or hardware. The names of the modules do not necessarily limit the functionality of the unit itself.

[0116] The readable storage medium provided in this application is a computer-readable storage medium that stores computer-readable program instructions (i.e., a computer program) for executing the above-described switch port security management method, thereby solving the technical problem of how to improve the accuracy of switch port security management. Compared with the prior art, the beneficial effects of the computer-readable storage medium provided in this application are the same as those of the switch port security management method provided in the above embodiments, and will not be repeated here.

[0117] This application also provides a computer program product, including a computer program that, when executed by a processor, implements the steps of the switch port security management method described above.

[0118] The computer program product provided in this application can solve the technical problem of how to improve the accuracy of switch port security management. Compared with the prior art, the beneficial effects of the computer program product provided in this application are the same as those of the switch port security management method provided in the above embodiments, and will not be repeated here.

[0119] The above description is only a part of the embodiments of this application and does not limit the patent scope of this application. All equivalent structural transformations made under the technical concept of this application and using the contents of the specification and drawings of this application, or direct / indirect applications in other related technical fields, are included in the patent protection scope of this application.

Claims

1. A method for security management of switch ports, characterized in that, The method includes: Obtain port operation data and traffic data from the switch; Based on the port operation data and the traffic data, a security policy for the port is generated, and the generated security policy is deployed in batches to the target switch ports; After the security policy is implemented, the ports of the switch are monitored in real time and abnormal events are identified. Perform security response actions based on the type and severity level of the abnormal event; The step of generating a port security policy based on the port operation data and the traffic data includes: The port type is determined based on the port operation data, and the corresponding basic policy template is matched from the preset policy template library based on the port type. Traffic features and device access features are extracted from the port operation data and the traffic data. The device access features include at least the number of active devices, the distribution of device online duration, and the frequency of new device access. The traffic characteristics and device access characteristics are processed using a port model to obtain policy template parameters. The port model is trained from historical port-related data. The basic policy template is modified according to the policy template parameters to obtain the security policy.

2. The method as described in claim 1, characterized in that, Before the step of obtaining the port operation data and traffic data of the switch, the method further includes: Detect changes in the port status of the switch; The sampling frequency is determined based on the port status change data.

3. The method as described in claim 1, characterized in that, Following the step of generating a port security policy based on the port operation data and the traffic data, the method further includes: Monitor the topology information of the network where the switch is located; When the topology information changes, the security policy is regenerated.

4. The method as described in claim 1, characterized in that, The abnormal events include traffic abnormal events, device access abnormal events, and protocol abnormal events. The step of real-time status monitoring of the switch ports and determining abnormal events includes: Collect the latest traffic data, latest device access data, and latest protocol behavior data of the switch ports; Traffic anomaly events are determined based on the preset traffic baseline value and the latest traffic data; Based on the latest device access data, determine the device access anomaly event; The protocol anomaly event is determined based on the latest protocol behavior data.

5. The method as described in claim 1, characterized in that, The steps for performing security response operations based on the type and severity level of the abnormal event include: The severity level of the abnormal event is determined according to preset rules; Determine the target protection measures based on the type of the abnormal event; Determine the target alarm measures based on the severity level.

6. The method as described in claim 5, characterized in that, Following the step of determining the target alarm measure based on the severity level, the method further includes: Receive manual confirmation instructions; Adjust the target protection measures according to the manual processing confirmation instruction.

7. A switch port security management device, characterized in that, The device includes: The acquisition module is used to acquire port operation data and traffic data of the switch; The generation module is used to generate security policies for the ports based on the port operation data and the traffic data, and to deploy the generated security policies to the target switch ports in batches. The determination module is used to perform real-time status monitoring of the ports of the switch and determine abnormal events after the security policy is executed. The execution module is used to perform security response operations based on the type and severity level of the abnormal event; The step of generating a port security policy based on the port operation data and the traffic data includes: The port type is determined based on the port operation data, and the corresponding basic policy template is matched from the preset policy template library based on the port type. Traffic features and device access features are extracted from the port operation data and the traffic data. The device access features include at least the number of active devices, the distribution of device online duration, and the frequency of new device access. The traffic characteristics and device access characteristics are processed using a port model to obtain policy template parameters. The port model is trained from historical port-related data. The basic policy template is modified according to the policy template parameters to obtain the security policy.

8. A switch port security management device, characterized in that, The device includes a memory and a processor, wherein the memory stores a computer program, and when the computer program is executed by the processor, it implements the steps of the switch port security management method as described in any one of claims 1 to 6.

9. A storage medium, characterized in that, The storage medium is a computer-readable storage medium, and a computer program is stored on the storage medium. When the computer program is executed by a processor, it implements the switch port security management method as described in any one of claims 1 to 6.

Images