Self-adaptive zero-trust security management and control method based on trust dynamics

Abstract

The invention provides an adaptive zero-trust security management and control method based on trust dynamics, and relates to the technical field of network security. Comprising the following steps: firstly, collecting and preprocessing communication data at network key nodes in real time to generate feature vectors; then, a deep auto-encoder model is utilized to calculate reconstruction loss of network behaviors, and the reconstruction loss is mapped into a standardized basic credibility score through fitted Gaussian distribution; thirdly, dynamically capturing a trust evolution trend by calculating the speed and the acceleration of the trust score, driving a state machine comprising a plurality of security states to transfer, and generating a corresponding disposal action set according to a preset strategy mapping matrix; and finally, a strategy execution point is converted into specific network control rule execution, and a complete and automatic management and control system is formed. According to the invention, the problems of static lag of trust assessment and lack of perspectiveness of decision making in a zero-trust architecture are effectively solved, and early warning and self-adaptive fine management of potential risks are realized.

Description

Technical Field

[0001] This invention relates to the field of network security technology, specifically to an adaptive zero-trust security management method based on trust dynamics. Background Technology

[0002] The rapid development of the Internet of Things (IoT) has brought enormous security challenges. Traditional "perimeter defense" security models, which assume trust within the network, are no longer applicable in the increasingly blurred boundaries of the IoT environment. Zero Trust Architecture (ZTA), as a next-generation security concept, is considered an ideal paradigm for addressing IoT security, with "never trust, always verify" at its core. The successful implementation of ZTA hinges on an efficient, automated, and continuous trust assessment mechanism.

[0003] However, existing technologies have the following drawbacks: Static and Lag: Traditional trust assessments rely heavily on static rules or reputation systems, which are difficult to adapt to the dynamic changes in the Internet of Things environment and are almost ineffective against unknown "zero-day attacks".

[0004] Lack of effective coupling: Although existing research has used artificial intelligence for anomaly detection, most of these studies stop at a binary "normal / abnormal" distinction. Current technologies generally lack a key mechanism to transform the raw output of unsupervised models into a refined, continuous trust metric that can be directly used by the ZTA policy engine.

[0005] Lack of foresight: Most existing decision engines are based on "static thresholds," which trigger actions when the trust score falls below a certain value. This approach is passive and lagging, unable to anticipate and respond to risks in their early stages.

[0006] Therefore, there is an urgent need for an end-to-end framework that can deeply couple and seamlessly integrate the underlying anomaly detection with the top-level ZTA dynamic decision-making. Summary of the Invention

[0007] To achieve the above objectives, the present invention provides the following technical solution: an adaptive zero-trust security management method based on trust dynamics, comprising: S1: Data acquisition and preprocessing: Real-time capture of communication data packets of network entities at key network nodes, followed by data cleaning, feature selection, and numerical normalization to generate feature vectors. S2: Trust Quantization Assessment Based on Autoencoder. Using feature vectors as input, a deep autoencoder model consisting of an encoder and a decoder is constructed and trained within the trust assessment engine. The training set comprises only normal network traffic samples, and the optimization objective is to minimize the reconstruction loss. The reconstruction loss of normal network behavior samples is statistically analyzed using a validation set, and a Gaussian distribution is fitted to define the normal fluctuation range. For real-time network behavior samples, the reconstruction loss is calculated, and a basic trust score is obtained based on the cumulative distribution function of the Gaussian distribution. S3: Dynamic policy decision-making based on trust dynamics, using a time-series basic trust score as input, calculates trust velocity and trust acceleration; defines a security state space, including verified, observation period, isolation zone, and locked state, with increasing control intensity; dynamically updates the security state of entities through a state transition function based on the current basic trust score, trust velocity, and trust acceleration; and maps the security state to a set of action actions through a policy mapping matrix. S4: The action set is sent to the policy execution point, which then translates the action into actual network access control rules and executes them, thereby dynamically adjusting the entity's permissions and feeding back to the trust assessment engine.

[0008] Further, in step S2, a validation set composed of feature vectors generated from normal network behavior is input into the trained deep autoencoder model to obtain a set of reconstruction loss samples of normal network behavior. Statistical analysis is performed on this set of reconstruction loss samples, and a Gaussian distribution N(μ,σ²) is used for fitting, where μ is the mean of the reconstruction loss and σ is the standard deviation. This Gaussian distribution defines a reasonable fluctuation range for the reconstruction loss of normal network behavior. In the real-time trust calculation stage, the reconstruction loss RL of the real-time samples is mapped to the basic trust level through the cumulative distribution function Φ of the standard normal distribution. Its calculation formula is This mapping process ensures that the reconstruction loss value is within the normal range. Approaching 1, when the reconstruction loss deviates from the normal range It decreases monotonically to 0.

[0009] Furthermore, in step S3, the calculation process for trust velocity and trust acceleration includes: On a continuous time series, the baseline confidence level is expressed at a fixed time interval Δt. Sampling is performed; the confidence velocity is calculated using a differential approximation. This variable represents the rate of change of trust level per unit time; Calculate trust acceleration This variable characterizes the acceleration or deceleration trend of the rate of change of trust. By simultaneously considering the instantaneous value of trust, the first-order rate of change, and the second-order rate of change, a multi-dimensional index system describing the dynamic characteristics of trust evolution is constructed, enabling the system to identify abnormal fluctuation patterns of trust.

[0010] Furthermore, in step S3, the specific implementation of the security state space and state transition includes: Define discrete security state space The states are arranged in ascending order of control intensity; the state transition function is based on the previous state and the current state. , and As input, state transitions are dynamically determined based on a precise rule set; this includes dynamic and drastic rules, which are applied when trust acceleration is detected. The absolute value exceeds the threshold and the trust speed When it is negative, even Even if the danger threshold has not been reached, it will still trigger from arrive Or from arrive The state is downgraded and migrated to achieve proactive risk warning.

[0011] Furthermore, the specific process of policy mapping and decision output includes: Define the action space Here, ALLOW means allowing the network entity's access request or data to pass through; LOG means recording the entity's current behavior, trust score, triggered rules, or executed actions for auditing and analysis; BLOCK means completely denying the entity's access request, discarding its data packets, and disconnecting its connection; ALERT means generating and sending real-time alert information to security operations personnel; and THROTTLE means limiting network bandwidth or the number of connections. Establish a policy mapping matrix, which specifies the mapping relationship between each security state and the corresponding set of actions; when the entity is in the observation period state. When, the mapping result is Combination, which involves implementing resource constraints while logging; when an entity is in an isolated state. When, the mapping result is The combination involves blocking access and generating an alert.

[0012] Furthermore, in the state transition function, the recovery condition from a low-trust state to a high-trust state is: the entity recovers from the observation period... Restore to verified satisfy Continuously above the normal threshold and Maintain a non-negative value for the preset duration; The condition for downgrading from a low-trust state to a high-trust state is: the entity is downgraded from a verified state. Downgraded to observation period Satisfying detection The instantaneous negative mutation.

[0013] Furthermore, the dynamic access policy engine distributes the action set D to the SDN switch or firewall as the policy execution point (PEP). The PEP transforms the abstract action into specific network control rules, where the THROTTLE action is transformed into a bandwidth limiting flow table entry, and the BLOCK action is transformed into a packet dropping rule. The execution effect is monitored in real time by the data acquisition layer and fed back to the trust assessment engine.

[0014] The present invention also provides an adaptive zero-trust security management device based on trust dynamics, comprising: The data acquisition and preprocessing unit is used to capture communication data packets of network entities in real time at key network nodes, and to perform data cleaning, feature selection and numerical normalization preprocessing to generate feature vectors. The trust quantization evaluation unit of the autoencoder is used to take the generated feature vector as input and build and train a deep autoencoder model consisting of an encoder and a decoder in the trust evaluation engine. The training set consists only of normal network traffic samples, and the optimization objective is to minimize the reconstruction loss. The reconstruction loss of normal network behavior samples is statistically analyzed using the validation set, and a Gaussian distribution is fitted to define the normal fluctuation range. For real-time network behavior samples, the reconstruction loss is calculated, and the basic trust score is obtained based on the cumulative distribution function of the Gaussian distribution. The dynamic policy decision-making unit is used to calculate the trust velocity and trust acceleration by taking the time-series basic trust score as input; it defines a security state space, including verified, observation period, isolation zone and locked state, with control intensity increasing; based on the current basic trust score, trust velocity and trust acceleration, it dynamically updates the security state of the entity through a state transition function; and it maps the security state to a set of action actions through a policy mapping matrix. The policy execution unit is used by the policy execution point to translate actions into actual network access control rules and execute them, thereby dynamically adjusting entity permissions and feeding back to the trust assessment engine.

[0015] The present invention also provides an electronic device, including: a memory and a processor, wherein the memory is used to store a computer program, and the processor runs the computer program to enable the electronic device to perform the adaptive zero-trust security management method based on trust dynamics.

[0016] The present invention also provides a computer-readable storage medium storing a computer program that, when executed by a processor, implements the aforementioned adaptive zero-trust security management method based on trust dynamics.

[0017] The present invention has the following beneficial effects: This invention solves the problem that traditional trust assessment relies on static rules and cannot effectively detect unknown attacks by using a trust quantification mechanism that reconstructs loss and Gaussian probability mapping with an autoencoder. It transforms unsupervised anomaly detection output into continuous and standardized trust scores, thereby significantly improving the detection accuracy and reliability of trust assessment for unknown threats such as zero-day attacks.

[0018] This invention solves the problems of delayed decision-making and inability to perceive risk trends by calculating trust speed and acceleration and realizing state transition based on dynamic and drastic rules. It enables risk prediction by changing trends of trust rather than absolute values, thereby significantly improving the response speed to potential threats and the foresight of risk warning.

[0019] This invention solves the problems of rigid and easily circumvented access control by combining trust dynamics with hierarchical security state space and refined action set. It achieves progressive control from observation to blocking, and prevents attacker fraud through strict recovery conditions, thus comprehensively enhancing the adaptability, robustness and balance between security and business continuity of the system defense. Attached Figure Description

[0020] Figure 1 This is a block diagram of the overall architecture of the present invention; Figure 2 This invention relates to a trust quantification assessment method; Figure 3 This is a safety state transition diagram for the present invention. Detailed Implementation

[0021] To make the above-mentioned objects, features and advantages of the present invention more apparent and understandable, the following description is provided in conjunction with the accompanying drawings. Figure 1-3 The present invention will be further described in detail below with reference to specific embodiments. This will allow for a full understanding of how the present application uses technical means to solve technical problems and achieve technical effects, and to facilitate its implementation.

[0022] Those skilled in the art will understand that all or part of the steps in the methods of the above embodiments can be implemented by a program instructing related hardware. Therefore, this application can take the form of a completely hardware embodiment, a completely software embodiment, or an embodiment combining software and hardware aspects. Moreover, this application can take the form of a computer program product implemented on one or more computer-usable storage media (including but not limited to disk storage, CD-ROM, optical storage, etc.) containing computer-usable program code.

[0023] Please refer to Figure 1 This embodiment proposes an adaptive zero-trust security management method based on trust dynamics, which includes the following steps:

[0024] S1: Data acquisition and preprocessing: Real-time capture of communication data packets of network entities at key network nodes, followed by data cleaning, feature selection, and numerical normalization to generate feature vectors. At key network nodes, such as gateways or border routers, a data acquisition layer is deployed to capture communication data packets of network entities in real time. These data packets include raw traffic characteristics such as source IP address, destination IP address, port number, protocol type, packet size, and transmission rate. The data acquisition frequency is set to once per second to ensure real-time performance. The captured raw data is first cleaned to remove duplicates, invalid values, or records with abnormal formats, such as discarding packets with zero length or records with incomplete protocol fields. Then, feature selection is performed to filter out key dimensions related to security behavior from the raw features, such as session duration, packet throughput, error rate, and connection frequency, ultimately forming a set of multi-dimensional feature vectors. The number of features can be adjusted according to the network scale; for example, in a typical IoT environment, 20 core features are selected. Then, the feature vectors are numerically normalized, scaling each feature value to the range [0,1] using a min-max normalization method, such as mapping the packet size from the original range [0,1500] bytes to [0,1] to ensure the consistency of the model input. The preprocessed feature vectors are stored in a temporary buffer for subsequent trust assessment.

[0025] As a preferred implementation of step S1, a validation set, independent of the training set and composed entirely of normal network traffic, is input into the trained autoencoder model to obtain a set of reconstruction loss samples representing normal network behavior patterns. Subsequently, this set of reconstruction loss samples undergoes in-depth statistical analysis. The core of this analysis is the recognition that while normal network behavior is macroscopically stable, its reconstruction loss value exhibits inherent random fluctuations at the microscopic level, causing these fluctuations to follow certain statistical patterns. A Gaussian distribution N(μ,σ²) is used to accurately fit this fluctuation range, where parameter μ represents the central tendency of the normal behavior reconstruction loss, i.e., the mean, and parameter σ quantifies its normal dispersion, i.e., the standard deviation. A normal quantization boundary is automatically learned and defined from the data; any behavior significantly deviating from this boundary is considered abnormal. In the real-time trust calculation stage, for each incoming real-time network behavior sample, the system calculates its reconstruction loss RL and maps it to a standardized basic trust level T with a clear probabilistic interpretation using the cumulative distribution function Φ of a standard normal distribution. base It calculates the percentile of the current reconstruction loss in the normal distribution and converts it into a confidence level; therefore, when the RL value is equal to or very close to μ, its T base When the value approaches or exceeds 0.5, it indicates normal behavior; when the RL value is much smaller than μ, T... base A value approaching 1 indicates high reliability; however, when the RL value is greater than μ and continues to deviate, T... base The value will monotonically decrease from 1 and eventually approach 0, indicating extreme unreliability.

[0026] S2: Trust Quantization Assessment Based on Autoencoder. Using feature vectors as input, a deep autoencoder model consisting of an encoder and a decoder is constructed and trained within the trust assessment engine. The training set comprises only normal network traffic samples, and the optimization objective is to minimize the reconstruction loss. The reconstruction loss of normal network behavior samples is statistically analyzed using a validation set, and a Gaussian distribution is fitted to define the normal fluctuation range. For real-time network behavior samples, the reconstruction loss is calculated, and a basic trust score is obtained based on the cumulative distribution function of the Gaussian distribution. As a preferred implementation of step S2, in the trust evaluation engine, a trust quantification evaluation process based on a deep autoencoder is initiated, such as... Figure 2As shown, a deep autoencoder model is first constructed, consisting of an input layer, an encoder, and a decoder. The input layer has the same dimension as the feature vector, for example, 20 dimensions. The encoder consists of three fully connected layers with 16, 8, and 4 neurons, respectively, using the ReLU activation function. The decoder symmetrically consists of three fully connected layers with 8, 16, and 20 neurons, ultimately outputting a reconstructed feature vector. The deep autoencoder model is trained using only normal network traffic samples, for example, 10,000 normal network behavior samples extracted from historical data to form the training set. The optimization objective is to minimize the reconstruction loss, and the loss function is the mean squared error. The training process uses the Adam optimizer with a learning rate of 0.001, a batch size of 32, and 100 training cycles. After training, the deep autoencoder model is validated using an independent validation set, such as one containing 2000 normal network behavior samples. The reconstruction loss for each sample is calculated, which is the mean squared error between the input and output feature vectors. These reconstruction loss values ​​are then statistically analyzed, fitting a Gaussian distribution N(μ,σ²), where μ is the mean reconstruction loss and σ is the standard deviation. For example, in the dataset context, μ is 0.02 and σ is 0.005, defining a reasonable fluctuation range for the reconstruction loss of normal network behavior. During the real-time trust calculation phase, when a new network behavior sample arrives, the trust evaluation engine calculates its reconstruction loss RL. For example, if the RL for a sample is 0.035, it is then mapped to the base trust score T using the cumulative distribution function Φ of a standard normal distribution. base The calculation formula is: Where Φ is the cumulative distribution function of the standard normal distribution, and its expression is: In the calculation, it is achieved through numerical approximation methods; for example, when RL=0.035, z=3, then Φ(3)≈0.9987, therefore T base =1-0.9987=0.0013, indicating an extremely low level of confidence; this process ensures that when the reconstruction loss is within the normal range, T base It approaches 1, and when it deviates, it monotonically decreases to 0.

[0027] S3: Dynamic policy decision-making based on trust dynamics, using a time-series basic trust score as input, calculates trust velocity and trust acceleration; defines a security state space, including verified, observation period, isolation zone, and locked state, with increasing control intensity; dynamically updates the security state of entities through a state transition function based on the current basic trust score, trust velocity, and trust acceleration; and maps the security state to a set of action actions through a policy mapping matrix. As a preferred implementation of step S3, the calculation process of the trust dynamics variable includes: the system, over a continuous time series, at fixed, preset time intervals Δt, such as 1 second, 5 seconds, etc., adjusts the basic trust level T. baseSampling is performed to form a temporal trust sequence; based on this temporal trust sequence, the concept of derivative in calculus is calculated to capture the dynamic evolution characteristics of trust; specifically, the trust velocity v T Calculated using first-order difference, i.e. The physical meaning of this variable is clear; it characterizes the rate of change of an entity's trust level per unit time. A negative v T This indicates a decline in trust, suggesting that potential risks are accumulating; furthermore, the acceleration of trust (a) T Calculated using second-order difference, i.e. This variable reveals how the rate of change in trust itself changes, i.e., the intensity of the change; a negative a T This means that trust is declining rapidly, a strong signal that attacks are being launched, while a positive a T This means that the downward trend in trust is slowing down or improving; by simultaneously considering the instantaneous value T of trust. base First rate of change (v) T ) and second-order rate of change (a T This study constructs a multi-dimensional indicator system to describe the dynamic characteristics of trust evolution. This system can not only perceive whether an entity is "currently trustworthy", but also see "how its trustworthiness is changing" and "whether the trend of change is intensifying or easing". This allows for the accurate identification of abnormal fluctuation patterns such as a "cliff-like drop" in trustworthiness, and enables a forward-looking perception of risk, which is a capability that static threshold methods do not possess at all.

[0028] In this embodiment, the dynamic policy decision-making process based on trust dynamics begins; the dynamic access policy engine receives a time-series basic trust score and samples it at fixed time intervals Δt, for example, Δt is set to 1 second; for each network entity, at time t, the trust velocity v is calculated. T And trust acceleration a T Trust speed v T It is approximately the difference between the current baseline trust score and the baseline trust score at the previous moment, divided by the time interval; for example, at time t, T base (t)=0.6, at t-Δt, T base If (t-Δt)=0.8, then v T =(0.6-0.8) / 1=-0.2, indicating that the trust level decreases by 0.2 units per second; trust acceleration a T It is approximately the difference between the current trust velocity and the trust velocity at the previous moment, divided by the time interval; for example, at time t, v T (t)=-0.2, at t-Δt, v T If (t-Δt)=-0.1, then a T=(-0.2-(-0.1)) / 1=-0.1, indicating that the trust speed is decreasing at an accelerating rate; the dynamic variables construct a multi-dimensional index system to describe the dynamic characteristics of trust evolution.

[0029] As a preferred implementation, the specific implementation of the security state space and state transition includes: defining a discrete, finite security state space. ,like Figure 3 As shown, these four states constitute a defense depth system with progressively increasing control intensity; the transitions between states are not caused by a single T. base The value is not determined by the previous state, but by a value based on "the previous state and the current state T". base v T and a T The input is a rule-based state transition function that is dynamically driven; the core of this rule set is the inclusion of a "dynamic drastic rule," which explicitly states that when the absolute value of the detected trust acceleration exceeds a preset sensitivity threshold, and the trust velocity is simultaneously negative, even if T at this moment... base Even if the absolute value has not fallen below the traditional danger threshold for entering the next state, a state downgrade transition will be triggered immediately, for example, from "verified" q. V The state is directly transferred to the "observation period" q P Status, or from the "observation period" q P Status transition to "quarantine zone" q Q This allows for early intervention and enhanced control levels in the early stages of an attack, before its full destructive potential is revealed, thereby achieving true proactive risk warning and defense, and significantly reducing the attacker's window of opportunity.

[0030] In this embodiment, the states are arranged in ascending order of control intensity (within the defined safe state space, as the risk of entity behavior increases, the security restrictions imposed by the system gradually become more stringent, and the intensity of management and control gradually increases); the state transition function takes the previous state, the current basic trust score, trust velocity, and trust acceleration as inputs, and dynamically determines the state transition based on a precise rule set; for example, the initial state is q. V The rule set includes: if T base If the value is below the threshold of 0.3, then migrate to q. Q If v T negative and a T If the absolute value of T exceeds the threshold of 0.05, then even if T base A value higher than 0.3 will also trigger a state degradation; specifically, when 'a' is detected... T The absolute value of v exceeds 0.05 and v T When it is negative, from q V Migrate to q P Or from qP Migrate to q Q This enables proactive risk warning; furthermore, the recovery conditions from a low-trust state to a high-trust state are more stringent, for example, from q P Restore to q V It requires a base trust level consistently above 0.6 and a trust speed maintained at a non-negative value for a preset duration of 60 seconds, while from q V Downgrade to q P Only v needs to be detected T Transient negative mutations, such as v T Below -0.1; this trust delay principle prevents attackers from evading detection by briefly resuming normal behavior.

[0031] As a preferred implementation, the specific process of strategy mapping and decision output includes: the system defines a rich and executable action space. Each action has a clear, executable definition for network devices: ALLOW represents allowing the network entity's access requests or data to pass through, maintaining its normal business permissions; LOG represents recording the entity's current behavior, trust score, triggered rules, or executed actions for subsequent auditing, forensics, and in-depth analysis; THROTTLE represents imposing resource restrictions on the entity, such as reducing its network bandwidth limit, limiting its new connection rate, or limiting the frequency of its access to specific resources; BLOCK represents completely denying the entity's access requests, directly discarding its data packets, or actively disconnecting its network connection—this is the most stringent control measure; ALERT represents generating and sending real-time alerts to security operations personnel, notifying them to pay attention to abnormal entities and the automated actions taken by the system; a policy mapping matrix M is established. Π The abstract security state is transformed into a concrete combination of actions. This policy mapping matrix explicitly defines the mapping relationship from the next security state to the corresponding set of actions using a lookup table; for example, when the entity is in state q... V When , it is mapped to {ALLOW,LOG}; when in q Q When, the mapping is {BLOCK, ALERT}; when in q L When the time is right, it is mapped to {BLOCK}; the matrix implementation is done through a lookup table, for example, D=QM Π When the entity is in the "observation period" state q P When the mapping result is a combination of {LOG, THROTLE}, the THROTLE action limits the bandwidth to 50% of the normal value; this means that while logging all suspicious behavior of the entity, its network resources will be immediately restricted, which will not affect its basic business and will effectively curb the spread of potential attacks; and when the entity's state deteriorates to the "isolation zone" q QIn such cases, the mapping result is upgraded to a combination of {BLOCK, ALERT}, which decisively blocks all access and immediately alerts the administrator. This hierarchical and combined response strategy avoids the brute force of black-and-white access control and maintains business continuity to the maximum extent while ensuring security.

[0032] In a preferred embodiment, the state transition function is specifically designed with an asymmetric state recovery mechanism, such as... Figure 3 As shown, the conditions for moving from a low-trust state, such as the observation period or quarantine zone, to a high-trust state, such as a verified recovery, are more stringent and complex than the conditions for downgrading from a high-trust state to a low-trust state. Specifically, if an entity wants to move from the "observation period" q P The status has been restored to "Verified". V The state must satisfy a series of stringent conditions for sustained stability: for example, its T base Not only does it need to consistently exceed a set normal threshold, but its trust speed v T The entity needs to maintain a non-negative value for a relatively long, preset period, such as 5 consecutive minutes, indicating that the trust level does not show a downward trend, to prove that its behavior has truly returned to stable and normal; in contrast, the entity's behavior changes from "verified" to "true". V Status downgraded to "observation period" q P The state only needs to detect v. T A sudden negative mutation, combined with "dynamic drastic rules", can be triggered; this greatly increases the attack cost and uncertainty for attackers, and effectively prevents attackers from using intermittent attack patterns, that is, by briefly restoring normal behavior to deceive the system into lifting control, and then launching an attack again.

[0033] S4: The action set is sent to the policy execution point, which then translates the action into actual network access control rules and executes them, thereby dynamically adjusting the entity's permissions and feeding back to the trust assessment engine.

[0034] As a preferred implementation, the dynamic access policy engine transmits the final action set D generated by the decision through a secure and reliable communication channel, such as NETCONF or REST. APIs and other mechanisms are deployed to physical or virtual devices that act as policy enforcement points (PEPs) within the network. These devices can be SDN switches supporting software-defined networking or next-generation firewalls with API interfaces. The core function of a PEP is to translate the received, relatively abstract action instructions into specific, low-level network control rules that the device can understand and execute. For example, for a THROTTLE action, the PEP generates and deploys a flow table entry or policy rule that restricts the bandwidth of the entity's IP address. For a BLOCK action, the PEP generates an access control list rule that matches the entity's characteristics, such as IP address and port, and sets the action to "drop." These rules are immediately loaded onto the network device's data plane and made effective, enabling real-time and dynamic adjustment of the entity's network permissions. Ultimately, this execution effect is monitored in real-time through the data acquisition layer, and new network behavior data is fed back to the trust assessment engine as feedback, forming a complete and automated security closed loop from "perception-assessment-decision-execution" back to "perception." This allows the PEP to continuously adapt to changes in the network environment and achieve continuous adaptive security management.

[0035] In this embodiment, during the policy execution and closed-loop management phase, the action set is distributed to the policy execution point. The policy execution point can be an SDN switch or a firewall. For example, the dynamic access policy engine distributes the action set {BLOCK, ALERT} to the SDN controller. The policy execution point transforms the abstract actions into actual network control rules: the BLOCK action is transformed into a packet dropping rule, such as adding a rule matching the entity's IP in the OpenFlow flow table, with the action set to DROP; the ALERT action is transformed into generating an SNMP trap or Syslog message and sending it to the security operations and maintenance platform; the THROTLE action is transformed into a bandwidth limiting flow table entry, such as using the token bucket algorithm to limit the entity's bandwidth to 1Mbps. After execution, the policy execution point monitors the effect in real time through the data acquisition layer, such as checking the packet drop rate or bandwidth usage, and feeds it back to the trust assessment engine. For example, if the entity still attempts to connect after being blocked, the feedback data can be used to update the basic trust calculation, forming overall control.

[0036] Throughout the process, the data flow is continuous; for example, when a network entity is at time t=0, T base =0.9, state is q V The actions are ALLOW and LOG; at t=10 seconds, due to abnormal behavior, T base Decreased to 0.5, v T =-0.2, a T=-0.1, triggering state transition to q P The actions are LOG and THROTLE, and bandwidth is limited; at t=20 seconds, T base It further decreased to 0.2, v T =-0.3, a T =-0.2, migrate to q Q The actions are BLOCK and ALERT, access is blocked and an alarm is triggered; if the entity's behavior returns to normal at t=80 seconds, T base Rising to 0.7, v T =0.1, and lasts for 60 seconds, then migrate back to q. P .

[0037] In summary, the present invention provides an adaptive zero-trust security management method based on trust dynamics. By using a trust quantification mechanism that reconstructs loss from an autoencoder and maps Gaussian probability, it solves the problem that traditional trust assessment relies on static rules and cannot effectively detect unknown attacks. It transforms unsupervised anomaly detection output into continuous and standardized trust scores, thereby significantly improving the detection accuracy and reliability of trust assessment for unknown threats such as zero-day attacks.

[0038] By calculating trust velocity and acceleration, and realizing state transition based on dynamic and drastic rules, the problem of lag in static threshold decision-making and inability to perceive risk trends is solved. This enables the prediction of risks through the changing trends of trust rather than absolute values, thereby significantly improving the response speed to potential threats and the foresight of risk warnings.

[0039] By combining trust dynamics with a hierarchical security state space and a refined set of actions, the problem of rigid and easily circumvented access control is solved. It achieves progressive control from observation to blocking, while strict recovery conditions prevent attackers from engaging in fraudulent behavior. This comprehensively enhances the system's adaptability, robustness, and ability to balance security and business continuity.

[0040] In the description of this specification, the references to terms such as "one embodiment," "some embodiments," "example," "specific example," or "some examples," etc., indicate that a specific feature, structure, material, or characteristic described in connection with that embodiment or example is included in at least one embodiment or example of this application. Furthermore, the specific features, structures, materials, or characteristics described may be combined in any suitable manner in one or more embodiments or examples. Moreover, without contradiction, those skilled in the art can combine and integrate the different embodiments or examples described in this specification, as well as the features of those different embodiments or examples.

[0041] The logic and / or steps represented in the flowchart or otherwise described herein, for example, can be considered as a sequenced list of executable instructions for implementing logical functions, and can be embodied in any computer-readable medium for use by, or in conjunction with, an instruction execution system, apparatus or device (such as a computer-based system, a processor-included system or other system that can fetch and execute instructions from, an instruction execution system, apparatus or device).

[0042] The above embodiments provide a detailed description of the present invention. Specific examples have been used to illustrate the principles and implementation methods of the present invention. The descriptions of the above embodiments are only for the purpose of helping to understand the method and core ideas of the present invention. At the same time, for those skilled in the art, there will be changes in the specific implementation methods and application scope based on the ideas of the present invention. Therefore, the content of this specification should not be construed as a limitation of the present invention.

Claims

1. An adaptive zero-trust security management method based on trust dynamics, characterized in that, Includes the following steps: S1: Data acquisition and preprocessing: Real-time capture of communication data packets of network entities at key network nodes, followed by data cleaning, feature selection, and numerical normalization to generate feature vectors. S2: Trust Quantization Assessment Based on Autoencoder. Using feature vectors as input, a deep autoencoder model consisting of an encoder and a decoder is constructed and trained within the trust assessment engine. The training set comprises only normal network traffic samples, and the optimization objective is to minimize the reconstruction loss. The reconstruction loss of normal network behavior samples is statistically analyzed using a validation set, and a Gaussian distribution is fitted to define the normal fluctuation range. For real-time network behavior samples, the reconstruction loss is calculated, and a basic trust score is obtained based on the cumulative distribution function of the Gaussian distribution. S3: Dynamic strategy decision-making based on trust dynamics, using time-series basic trust scores as input, to calculate trust velocity and trust acceleration; Define a security state space, including verified, observation period, isolation zone and locked state, with increasing control intensity; Based on the current basic trust score, trust velocity, and trust acceleration, the security state of the entity is dynamically updated through a state transition function. Based on the security status, a policy mapping matrix is ​​used to map to a set of action actions; S4: The action set is sent to the policy execution point, which then translates the action into actual network access control rules and executes them, thereby dynamically adjusting the entity's permissions and feeding back to the trust assessment engine.

2. The adaptive zero-trust security management method based on trust dynamics according to claim 1, characterized in that: In step S2, a validation set composed of feature vectors generated from normal network behavior is input into the trained deep autoencoder model to obtain a set of reconstruction loss samples for normal network behavior. Statistical analysis is performed on this set of reconstruction loss samples, and a Gaussian distribution N(μ,σ²) is used for fitting, where μ is the mean of the reconstruction loss and σ is the standard deviation. This Gaussian distribution defines a reasonable fluctuation range for the reconstruction loss of normal network behavior. In the real-time trust calculation stage, the reconstruction loss RL of the real-time samples is mapped to the basic trust level through the cumulative distribution function Φ of the standard normal distribution. Its calculation formula is ; This mapping process ensures that the reconstruction loss value is within the normal range. Approaching 1, when the reconstruction loss deviates from the normal range It decreases monotonically to 0.

3. The adaptive zero-trust security management method based on trust dynamics according to claim 1, characterized in that: In step S3, the calculation process for trust velocity and trust acceleration includes: On a continuous time series, the baseline confidence level is expressed at a fixed time interval Δt. Sampling is performed; the confidence velocity is calculated using a differential approximation. This variable represents the rate of change of trust level per unit time; Calculate trust acceleration This variable characterizes the acceleration or deceleration trend of the rate of change of trust. By simultaneously considering the instantaneous value of trust, the first-order rate of change, and the second-order rate of change, a multi-dimensional index system describing the dynamic characteristics of trust evolution is constructed, enabling the system to identify abnormal fluctuation patterns of trust.

4. The adaptive zero-trust security management method based on trust dynamics according to claim 1, characterized in that: In step S3, the specific implementation of the security state space and state transition includes: Define discrete security state space The states are arranged in ascending order of control intensity; the state transition function is based on the previous state and the current state. , and As input, state transitions are dynamically determined based on a precise rule set; this includes dynamic and drastic rules, which are applied when trust acceleration is detected. The absolute value exceeds the threshold and the trust speed When it is negative, even Even if the danger threshold has not been reached, it will still trigger from arrive Or from arrive The state is downgraded and migrated to achieve proactive risk warning.

5. The adaptive zero-trust security management method based on trust dynamics according to claim 4, characterized in that: The specific process of policy mapping and decision output includes: Define the action space Here, ALLOW means allowing the network entity's access request or data to pass through; LOG means recording the entity's current behavior, trust score, triggered rules, or executed actions for auditing and analysis; BLOCK means completely denying the entity's access request, discarding its data packets, and disconnecting its connection; ALERT means generating and sending real-time alert information to security operations personnel; and THROTTLE means limiting network bandwidth or the number of connections. Establish a policy mapping matrix, which specifies the mapping relationship between each security state and the corresponding set of actions; when the entity is in the observation period state. When, the mapping result is Combination, which involves implementing resource constraints while logging; when an entity is in an isolated state. When, the mapping result is The combination involves blocking access and generating an alert.

6. The adaptive zero-trust security management method based on trust dynamics according to claim 4, characterized in that: In the state transition function, the recovery condition from a low-trust state to a high-trust state is: the entity recovers from the observation period... Restore to verified satisfy Continuously above the normal threshold and Maintain a non-negative value for the preset duration; The condition for downgrading from a low-trust state to a high-trust state is: the entity is downgraded from a verified state. Downgraded to observation period Satisfying detection The instantaneous negative mutation.

7. The adaptive zero-trust security management method based on trust dynamics according to claim 1, characterized in that: The dynamic access policy engine distributes the action set D to the SDN switch or firewall as the policy execution point (PEP). The PEP transforms the abstract action into specific network control rules, where the THROTTLE action is transformed into a bandwidth limiting flow table entry, and the BLOCK action is transformed into a packet dropping rule. The execution effect is monitored in real time by the data acquisition layer and fed back to the trust assessment engine.

8. An adaptive zero-trust security management device based on trust dynamics, characterized in that, include: The data acquisition and preprocessing unit is used to capture communication data packets of network entities in real time at key network nodes, and to perform data cleaning, feature selection and numerical normalization preprocessing to generate feature vectors. The trust quantization evaluation unit of the autoencoder is used to take the generated feature vector as input and build and train a deep autoencoder model consisting of an encoder and a decoder in the trust evaluation engine. The training set consists only of normal network traffic samples, and the optimization objective is to minimize the reconstruction loss. The reconstruction loss of normal network behavior samples is statistically analyzed using the validation set, and a Gaussian distribution is fitted to define the normal fluctuation range. For real-time network behavior samples, the reconstruction loss is calculated, and the basic trust score is obtained based on the cumulative distribution function of the Gaussian distribution. The dynamic strategy decision unit is used to calculate trust velocity and trust acceleration by taking a time-series-based basic trust score as input. Define a security state space, including verified, observation period, isolation zone and locked state, with increasing control intensity; Based on the current basic trust score, trust velocity, and trust acceleration, the security state of an entity is dynamically updated through a state transition function; and the security state is mapped to a set of action actions through a policy mapping matrix. The policy execution unit is used by the policy execution point to translate actions into actual network access control rules and execute them, thereby dynamically adjusting entity permissions and feeding back to the trust assessment engine.

9. An electronic device, characterized in that, include: A memory and a processor, the memory being used to store a computer program, the processor running the computer program to cause the electronic device to perform the adaptive zero-trust security management method based on trust dynamics as described in any one of claims 1-7.

10. A computer-readable storage medium, characterized in that, The computer-readable storage medium stores a computer program that, when executed by a processor, implements the adaptive zero-trust security management method based on trust dynamics as described in any one of claims 1-7.

Images