Zero-trust network adaptive defense method

Abstract

The invention discloses a zero-trust network adaptive defense method, and belongs to the technical field of network security protection. The method aims at solving the problems that static strategies are rigid, updating lags, combined attacks are difficult to detect, and centralized decision delay and single-point faults exist. According to the technical scheme, the method comprises the following steps: acquiring multi-dimensional security data through a sensing probe, encrypting and transmitting the multi-dimensional security data to a strategy coordination center for aggregation and feature extraction, and generating a global feature vector; calculating a dynamic trust score by using the anomaly detection model and generating a macroscopic strategy instruction to be issued; performing local real-time analysis by the micro boundary controller, and performing logic AND operation on the central instruction and a local abnormal mark to cooperatively update an access control rule; and meanwhile, incremental optimization of the model is realized through periodic log feedback. The method is mainly used for constructing a dynamic self-adaptive zero-trust network defense system, the accuracy and response speed of threat identification are improved, false alarms and missing alarms are effectively reduced, and the intelligence and robustness of the whole system are enhanced.

Description

Technical Field

[0001] This invention belongs to the field of network security protection technology, specifically relating to an adaptive defense method for zero-trust networks. Background Technology

[0002] In the practice of zero-trust network architecture, existing defense methods typically rely on pre-defined static security policies. These policies have long update cycles after deployment, making it difficult to adapt to the rapid evolution of network threats and dynamic changes in the internal state of the network. When new attacks occur or normal business traffic patterns change, static policies may fail to provide effective protection, or may generate false alarms due to their rigidity, affecting normal business access.

[0003] The root cause of this problem lies in the fact that traditional analysis often focuses on a single data source or single-point detection, lacking continuous analysis of the spatiotemporal correlations of data from multiple nodes across the entire network. This makes it difficult for the system to identify combined attacks composed of low-intensity, distributed activities from a global perspective. Furthermore, due to performance concerns, data collection granularity is typically coarse, and the collection frequency is fixed. This can increase system load during high-load periods and may miss critical details during low-load periods. At the policy execution level, existing methods largely rely on centralized decision-making. All analysis and policy generation are completed by a central node. While this facilitates a unified view, it also introduces decision-making delays and the risk of single points of failure. In addition, policies issued centrally usually take effect directly at edge nodes, lacking pre-verification of policy security and effectiveness in a real traffic environment. This can lead to the application of incorrect rules, causing service interruptions or security blind spots. Policy lifecycle management is also inadequate. Policies often require manual revocation or update, lacking an automatic expiration mechanism. In dynamic networks, this can easily lead to the accumulation of expired policies, consuming resources and potentially hindering normal communication or leaving hidden dangers.

[0004] Furthermore, there is a lack of efficient and secure collaboration mechanisms among multiple security execution nodes. When a node detects a local threat, it is difficult to share reliable containment information with other potentially risky nodes in a timely manner, resulting in delayed and fragmented defense responses and making it difficult to form a unified and coordinated defense system. Summary of the Invention

[0005] This invention provides a zero-trust network adaptive defense method, which can achieve dynamic adaptive security protection, effectively improve the accuracy and response speed of threat identification, reduce false alarms and false negatives, and enhance the overall intelligence and robustness of the system.

[0006] To achieve these objectives and other advantages of the present invention, a zero-trust network adaptive defense method is provided. The method includes the following steps: S1. Data Acquisition: Through sensing probes deployed on terminals and servers, process hash values, network connection quintuples, system call sequences, and memory usage data are collected and synchronously sent to the policy coordination center and the corresponding micro-boundary controllers via TLS encrypted channels. S2. Data aggregation and feature extraction: The strategy coordination center performs spatiotemporal correlation on the network data collected in step S1 and performs statistical feature extraction within a preset time window to generate a structured global feature vector. S3. Centralized Global Analysis and Command Issuance: In the policy coordination center, the global feature vector is input into an anomaly detection model trained based on the XGBoost algorithm for processing to generate a dynamic trust score; the dynamic trust score is compared with a preset threshold, and a macro-policy command containing policy ID, action and priority is generated based on a predefined policy priority lookup table, and the macro-policy command is issued to the relevant micro-boundary controllers through the gRPC protocol. S4. Distributed local analysis: The micro-boundary controller uses its embedded kernel-level rule executor based on eBPF technology to analyze the data packets flowing through in real time and generate a momentary anomaly flag. S5. Collaborative Decision-Making and Execution: The micro-boundary controller performs a logical AND operation between the received macro-policy instructions and the locally generated instantaneous anomaly flag, dynamically updates its access control list rules based on the operation result, and performs corresponding control actions on network traffic. S6. Feedback Optimization: The rule execution log of the micro-boundary controller is periodically fed back to the policy coordination center for incremental updates to the anomaly detection model trained based on the XGBoost algorithm.

[0007] Preferably, in step S1, the data acquisition frequency of the sensing probe is dynamically adjusted according to the CPU load of the host machine, specifically including: S110. The sensing probe starts an independent monitoring thread in the user space. The monitoring thread obtains system-level CPU time statistics and the CPU usage time of the sensing probe process itself at fixed time intervals. S120. The monitoring thread calculates a comprehensive load index based on the above time information; S130. The sensing probe is preset with at least three acquisition cycle levels: a first cycle level, a second cycle level, and a third cycle level. The first cycle level has the shortest acquisition cycle and the highest acquisition frequency, while the third cycle level has the longest acquisition cycle and the lowest acquisition frequency. A first load threshold T1 and a second load threshold T2 are preset, and T1>T2. S140. When the comprehensive load index continues to exceed T1 for a predetermined number of times N, the sensing probe switches its collection cycle from the current level to an adjacent level with a longer collection cycle to reduce the collection frequency, until it switches to the third cycle level. When the comprehensive load index remains below T2 for a predetermined number of times M, the sensing probe switches its acquisition cycle from the current level to an adjacent level with a shorter acquisition cycle to increase the acquisition frequency, until it switches back to the first cycle level.

[0008] Preferably, in step S3, the generated macro-policy instruction includes a survival time field; in step S5, the policy is further included in the steps of automatic expiration and removal, specifically including: S510. When the micro-boundary controller receives the macro-strategy instruction issued in step S3, it parses out the survival time field value therein and starts a countdown timer with this value as the interval. Simultaneously, the macro-policy instruction and its corresponding countdown information are stored in a local policy hash table. The local policy hash table uses the policy ID as the key and stores entries including policy rule content, countdown handle, and status flag. S511. If an update instruction with the same policy ID is received from the policy coordination center before the countdown timer expires, the countdown timer corresponding to the macro-policy instruction is reset. S512. If the countdown timer expires, a timeout interrupt service routine is triggered. The timeout interrupt service routine searches for the corresponding entry in the local policy hash table according to the timeout policy ID, removes the policy rule from its access control list, and cleans up the relevant entries in the hash table.

[0009] Preferably, in step S5, before applying the new rules derived from the macro-policy instructions to the actually running access control list, the micro-boundary controller further includes a security testing step, specifically including: S520. The micro boundary controller maintains, within its internal logic, a sandbox access control list dedicated to testing, which runs parallel to the actual running access control list. S521. The micro-border controller uses port mirroring or traffic replication technology to copy the actual traffic passing through it and guide it to the sandbox access control list for processing. S522. When a new rule needs to be tested, the micro-boundary controller first adds the new rule to the sandbox access control list and starts a timed test window of a preset duration. S523. During the test window, monitor the matching results of the replicated traffic in the sandbox access control list in real time, and record the characteristics of the traffic that matches the new rule. Meanwhile, network connectivity is continuously monitored by sending ICMP heartbeat packets or TCP synchronization probe packets to a pre-defined list of critical business server addresses. S524. If the network connectivity test is successful throughout the test window and no rule matching the predefined critical business service port and triggering a denial action is recorded in the sandbox access control list, then the security test is deemed to have passed. S525. After the security test is passed, the micro-border controller will migrate the new rule from its sandbox access control list to the actual running access control list to take effect; if the security test fails, the new rule will be discarded and an alarm log will be generated and sent to the policy coordination center.

[0010] Preferably, in step S5, the collaboration between multiple micro-boundary controllers is achieved through a publish / subscribe message queue, specifically including: S530, when the kernel-level rule executor based on eBPF technology embedded in the first micro-boundary controller detects a transient anomaly and generates a containment rule, the first micro-boundary controller serializes this rule into a predefined structured data format. S531. The first micro-border controller then acts as a publisher, publishing the serialized containment rule data as a message payload through a message broker server based on the MQTT protocol. The subject of the message is set to a Uniform Resource Identifier corresponding to the threat type. The hierarchical structure of the Uniform Resource Identifier includes a network area identifier and a threat classification identifier. S532, pre-subscribed to other micro-border controllers on topics related to this threat type, and as a subscriber, received the message in real time from the message broker server; S533 and other micro-boundary controllers deserialize the received message payload and parse out the containment rules. S534. Other micro-boundary controllers first perform a five-tuple-based conflict detection between the containment rule and their existing access control list rules. If there is no conflict, the containment rule is directly added to its local access control list. If a conflict is detected, arbitration is performed based on the priority field carried in the containment rule, and the rule with higher priority is retained.

[0011] Preferably, in step S3, the strategy coordination center dynamically calculates the value of the survival time field through the following steps: S310, Obtain the dynamic trust score S trust And set a trust threshold S th ; S320, Compare dynamic trust scores S trust With trust threshold S th: If S trust th If the condition is not met, it is considered a low-trust state, and the survival time T is calculated. ttl =max(T) min AB×(S) th -S trust )); If S trust ≥S th If it is determined to be a high-trust state, the survival time T is calculated. ttl = A + B × (S) trust -S th )); Where A is a preset base survival time, B is a preset adjustment coefficient, and T is a preset base survival time. min This is a preset minimum survival time threshold; In step S3, before the strategy coordination center performs global analysis, it also includes a pre-filtering step on the data collected in step S1: The micro-boundary controller or regional aggregation node filters and aggregates the collected data based on predefined local baseline rules and a list of key assets, and only reports a subset of data that meets preset anomaly conditions to the policy coordination center.

[0012] Preferably, after the security test is passed, the process of migrating the new rules from the sandbox access control list to the actual running access control list is carried out in stages, specifically including: First, the new rule is added to the actual running access control list with a priority value at least one level lower than the preset normal priority, and runs in parallel with the existing rules; After a second preset time period without triggering a predefined network anomaly, the priority of the new rule is adjusted to its preset normal priority.

[0013] Preferably, when the first micro-border controller publishes the serialized containment rule data, it also includes a digital signature signed by the policy coordination center; after receiving the message, the other micro-border controllers first verify the validity of the digital signature, and only execute the subsequent deserialization and conflict detection steps after the verification is successful.

[0014] Preferably, in step S1, the sensing probe compresses the collected data before sending it, specifically including: In step S1, the sensing probe compresses the collected data before sending it, specifically including: The sensing probe acquires the comprehensive load index calculated by the monitoring thread in real time. ​When the overall load index is lower than the second load threshold T2, a lossless compression algorithm is used to compress the data; When the comprehensive load index is higher than or equal to the second load threshold T2, lossy compression mode is enabled; wherein, the lossy compression mode includes at least one of the following operations: truncating the timestamp information in the system call sequence from microsecond precision to millisecond precision; aggregating multiple continuously collected data points into its arithmetic mean for memory occupancy data; reducing the precision or directly discarding auxiliary stream information other than the network connection quintuple.

[0015] Preferably, in step S6, when performing incremental updates, the selection of training data follows the following principles: first, locate abnormal events whose dynamic trust scores exceed a preset threshold; then, prioritize the selection of rule execution logs fed back by micro-boundary controllers that are associated with the abnormal events in the time and space dimensions. The incremental update specifically includes the following steps: retaining a fixed historical data validation set; after training the incremental anomaly detection model using the feedback rule execution logs, running the incremental anomaly detection model and the online anomaly detection model in parallel in shadow mode in the policy coordination center, and comparing their performance metrics on the historical data validation set; only when the performance metrics of the incremental anomaly detection model are not lower than those of the online anomaly detection model and the decrease does not exceed a preset threshold, is it switched to a new online anomaly detection model. After switching anomaly detection models, performance monitoring and rollback steps are also included: continuously monitoring the false alarm rate of the policy and network connectivity events; if the monitoring indicators deteriorate within a preset time and exceed the safety threshold, the anomaly detection model will be automatically rolled back to the version before the switch.

[0016] The present invention has at least the following beneficial effects: First, this invention achieves dynamic adaptive defense for zero-trust networks through a collaborative mechanism of centralized global analysis and distributed local execution. Data collection covers multiple dimensions, including process hash values ​​and network connection quintuples (source IP address, destination IP address, source port number, destination port number, and transport layer protocol), and is encrypted via TLS to ensure data integrity and security. The policy coordination center uses an anomaly detection model trained with the XGBoost algorithm for global anomaly detection, generates dynamic trust scores, and issues macro-policy instructions based on a predefined policy priority lookup table, improving the accuracy and response speed of threat identification. The micro-boundary controller performs local real-time analysis using eBPF technology and performs logical AND operations with central instructions to dynamically update access control list rules, effectively reducing the risk of false positives and false negatives. The feedback optimization mechanism, through periodic log feedback and incremental model updates, enables the system to continuously learn and adapt to network changes, enhancing the intelligence and robustness of the overall defense. This method overcomes the rigidity of traditional static policies, improves the detection capability against combined attacks, and reduces the burden on the central node through distributed execution, avoiding single points of failure.

[0017] Secondly, this invention effectively balances system performance and security detection accuracy by dynamically adjusting the data acquisition frequency. The sensing probe calculates a comprehensive load index in real time based on CPU load and presets multiple frequency levels. When the load is consistently too high, it automatically switches to a lower frequency level to reduce system burden; when the load is low, it switches to a higher frequency level to capture more detailed data. This adaptive mechanism avoids the problems of fixed-frequency acquisition exacerbating resource consumption during high-load periods or missing critical events during low-load periods, thus optimizing resource utilization efficiency. Simultaneously, the monitoring thread runs independently in user space, ensuring that the acquisition process does not affect normal host operations, improving system stability and scalability.

[0018] Third, the introduction of a time-to-live (TTL) field and an automatic expiration mechanism enables intelligent management of the policy lifecycle. The micro-boundary controller parses the TTL field value from the macro-level policy instruction, starts a countdown timer, and automatically removes the policy upon timeout, preventing expired rules from accumulating and consuming resources or interfering with normal communication. Policy information is stored and managed through a local policy hash table, supporting rapid lookup and cleanup, thus improving execution efficiency. Simultaneously, if an update instruction with the same policy identifier (ID) is received from the policy coordination center before the countdown expires, the timer is reset, ensuring timely policy updates and continuity. This mechanism reduces the need for manual intervention, lowers management costs, and avoids security risks or service interruptions caused by policy expiration, enhancing the system's adaptability and reliability.

[0019] Fourth, through security testing steps, this invention ensures the security and effectiveness of new rules before application. The micro-border controller maintains a sandboxed access control list (ACL) parallel to the actual running ACL, used for testing. Through port mirroring or traffic replication technology, rule application is simulated in the test environment, and matching results and network connectivity are monitored in real time. During the test window, the reachability of critical business services is continuously checked via ICMP heartbeat packets or TCP synchronization probe packets to prevent rules from mistakenly blocking normal traffic. Rules are only migrated to the production environment after security testing is passed; otherwise, alarm logs are generated and reported to the center for timely adjustments. This mechanism significantly reduces the risk of erroneous rule deployment, prevents service interruptions or security blind spots caused by policy errors, and improves the reliability of system deployment and business continuity.

[0020] Fifth, a collaborative mechanism based on publish / subscribe message queues enables efficient threat response among distributed nodes. When a micro-border controller detects a transient anomaly, it serializes the containment rules into a predefined structured data format and publishes it via an MQTT protocol message broker server. Other micro-border controllers subscribe to relevant topics and receive the rules in real time, performing deserialization and conflict detection before applying them locally. This asynchronous communication method reduces coupling and improves system scalability and response speed. Uniform Resource Identifier (URI) topic classification ensures accurate rule distribution to relevant areas, forming a coordinated defense. A conflict detection and priority arbitration mechanism based on network connection quintuples avoids rule overlap or contradictions, ensuring consistency.

[0021] Sixth, the dynamic calculation of the survival time field closely links the policy's timeliness with the network's trust status. The policy coordination center calculates the initial survival time based on the dynamic trust score and adjusts it through preset penalty coefficients and minimum survival time thresholds. This ensures that the policy is temporarily effective under low trust and persistently applied under high trust, optimizing defense flexibility. Simultaneously, the data pre-filtering step, using local baseline rules and a critical asset list, reports only a subset of data meeting preset anomaly conditions to the policy coordination center, reducing the processing burden on the central node and network transmission overhead. This combined mechanism improves the policy's adaptability and resource efficiency, avoids unnecessary data processing, and enhances the system's scalability in large-scale networks.

[0022] Seventh, the phased migration of new rules reduces the impact of rule switching on network stability. First, the new rule is added to the actual running access control list with a priority value at least one level lower than the preset normal priority, running in parallel with existing rules. After a second preset time period without triggering any predefined network anomalies, the priority of the new rule is then adjusted to its preset normal priority. This gradual deployment method allows the system to verify the rule's effectiveness in a real traffic environment, avoiding network outages caused by priority conflicts or unforeseen behavior. Monitoring network anomalies ensures the security of the rule migration.

[0023] Eighth, the digital signature mechanism ensures the security and trustworthiness of rule sharing among distributed nodes. When the first micro-border controller publishes serialized containment rule data, it attaches a digital signature signed by the policy coordination center. Other micro-border controllers, upon receiving the data, first verify the validity of the digital signature. Only after successful verification will they execute the subsequent deserialization and conflict detection steps. This effectively prevents malicious nodes from forging or tampering with rules, avoiding damage to the defense system. Identity authentication through public key infrastructure or similar technologies enhances the confidentiality and integrity of the transmission process.

[0024] Ninth, the dynamic compression strategy optimizes data transmission efficiency. Before sending data, the sensing probe dynamically selects the compression method based on a comprehensive load index: lossless compression is used when the load index is not lower than the second load threshold to ensure data integrity; lossy compression is used when the load index is lower than T2, and the compression ratio is dynamically calculated according to the formula. This adaptive compression mechanism significantly reduces network transmission bandwidth usage and improves data synchronization efficiency while ensuring the accuracy of critical data.

[0025] Tenth, the incremental update mechanism ensures the security and performance of model updates through targeted data selection and shadow mode validation. Training data prioritizes rule execution logs from micro-boundary controllers that are associated with anomalies whose dynamic trust scores exceed preset thresholds in both time and space dimensions, improving the model's sensitivity to threats. A fixed historical data validation set is maintained, and after training the incremental anomaly detection model using feedback logs, it runs in parallel with the online anomaly detection model in shadow mode at the policy coordination center. The performance metrics of the two models on the historical data validation set are compared to determine whether to switch, avoiding performance degradation. Continuous monitoring of policy false alarm rates and network connectivity events ensures reliable fault recovery capabilities by automatically rolling back to the previous version when metrics deteriorate beyond a safety threshold.

[0026] Other advantages, objectives and features of the present invention will become apparent in part from the following description, and in part from those skilled in the art through study and practice of the invention. Attached Figure Description

[0027] Figure 1 This is a flowchart illustrating the zero-trust network adaptive defense method of the present invention. Detailed Implementation

[0028] The present invention will now be described in further detail so that those skilled in the art can implement it based on the description.

[0029] It should be understood that terms such as “having,” “comprising,” and “including” as used herein do not exclude the presence or addition of one or more other elements or combinations thereof.

[0030] like Figure 1 As shown, the zero-trust network adaptive defense method provided in this embodiment of the invention, through multiple closely linked steps... In conjunction with these efforts, a dynamic and intelligent security protection system has been built.

[0031] Step S1: In the data acquisition phase, this embodiment of the invention systematically collects various types of security-related data through perception probes deployed on terminal devices and servers. A perception probe is a lightweight software agent designed to run on the host operating system with minimal resource overhead. Its core function is to monitor and capture key indicators reflecting system behavior. Specifically, the collected data includes process hash values, network connection quintuples, system call sequences, and memory usage data. A process hash is a unique identifier obtained by calculating the cryptographic hash of a process's executable file (e.g., the SHA-256 algorithm). It is used to verify the integrity and authenticity of the process, preventing malware from infiltrating through tampering or spoofing. A network connection 5-tuple encompasses the source IP address, destination IP address, source port number, destination port number, and transport layer protocol (e.g., TCP or UDP). This provides a complete context of the network session, helping to identify abnormal connection patterns, such as port scanning or distributed denial-of-service attacks. System call sequences record the instruction flow of the application's interaction with the operating system kernel. Analyzing sequence patterns (e.g., frequent calls to sensitive system calls) can detect potential attacks, such as privilege escalation or code injection. Memory usage data reflects the system's resource usage; abnormal memory fluctuations may indicate malicious activity, such as memory malware or cryptocurrency mining programs. All this data is synchronously sent to the policy coordination center and the corresponding micro-border controller via a TLS (Transport Layer Security) encrypted channel. To address the issue of asynchronous data processing caused by network latency, this invention clarifies the collaborative sequence of data transmission and processing: Data collected by the sensing probe, after being encrypted via TLS, is simultaneously sent to the policy coordination center and the micro-boundary controller. However, the micro-boundary controller introduces a brief waiting window, prioritizing the reception and integration of macro-level policy instructions from the policy coordination center. Subsequently, it performs a logical AND operation between the center's instructions and anomaly flags generated by local real-time analysis, thereby collaboratively updating access control rules. This mechanism ensures effective coordination between central global decisions and local instantaneous detection, even under network fluctuations, avoiding inconsistencies or misoperations caused by instruction delays. TLS encryption ensures the confidentiality and integrity of data transmission, preventing eavesdropping or tampering. A two-way authentication mechanism verifies the identities of the sender and receiver, preventing man-in-the-middle attacks. The implementation process of the sensing probe involves deploying a sensing probe program on the host. This program runs as a daemon or service, intercepting system events through hook technology (such as Linux's auditd or Windows' ETW) and collecting data in an event-driven or periodically polling manner. To optimize performance, the sensing probe may use memory-mapped files or a circular buffer to temporarily store data, reducing I / O overhead. The data acquisition frequency can be dynamically adjusted based on system load, but during this step, acquisition is continuous to ensure comprehensive coverage of security events and provide a rich, real-time data source for subsequent analysis.

[0032] Step S2, data aggregation and feature extraction, is performed in the policy coordination center. As the core processing node of the system, the policy coordination center is responsible for integrating and analyzing data from network-wide sensing probes. The policy coordination center first performs spatiotemporal correlation on the received data. This means it integrates data from different time points and spatial locations (such as different subnets or host groups). For example, it uses timestamps and network topology information to correlate network connection data of multiple hosts within the same time period to identify cross-node coordinated attack patterns, such as lateral movement or botnet activity. Within a preset time window, such as 5 minutes, 15 minutes, or 30 minutes (the specific window size can be adjusted according to network size and security requirements; in large enterprise networks, a longer window may be preferred to smooth noise, while a shorter window may be used in high-security environments for rapid detection), the policy coordination center performs statistical feature extraction, calculating various statistics such as the mean and variance of connection frequency, the distribution characteristics of packet size, the entropy value of system call sequences, and the trend of memory usage. These statistics are combined into a structured global feature vector, a high-dimensional numerical array where each dimension represents a specific feature, such as "average number of connections in the past 5 minutes" or "frequency of abnormal system calls." Feature extraction may involve data cleaning and normalization to eliminate noise and dimensionality effects, and dimensionality reduction techniques (such as principal component analysis or autoencoders) can be used to reduce computational burden while retaining key information. In implementation, the policy coordination center can employ stream processing frameworks (such as Apache Kafka or Flink) to process data streams in real time and use an in-memory database to cache intermediate results for efficient querying. The generation of the global feature vector allows the network state to be abstracted into a quantifiable form, providing standardized input for subsequent machine learning models, thereby achieving a macroscopic characterization of the entire network's behavior.

[0033] Step S3, the centralized global analysis and command issuance stage, utilizes an anomaly detection model trained based on the XGBoost algorithm to process the global feature vector. XGBoost (Extreme Gradient Boosting) is a highly efficient ensemble learning algorithm that improves prediction accuracy by combining multiple weak decision tree models. Its advantages lie in handling high-dimensional data, preventing overfitting, and efficient computation. In this anomaly detection model, training data includes historical normal and abnormal network behavior samples. The anomaly detection model learns how to distinguish between safe and threat states based on feature vectors. When the global feature vector is input into the anomaly detection model, a dynamic trust score is output. This dynamic trust score is a continuous value, for example, between 0 and 1, quantifying the trust level of the current network state; the lower the score, the more suspicious it is. This dynamic trust score is compared with a preset threshold, which can be set between 0.6 and 0.8. The specific value can be adjusted according to the network strategy; for example, a higher threshold is used in strict environments to reduce false alarms. Based on the comparison result, the policy coordination center queries a predefined policy priority lookup table. This lookup table is a mapping structure that maps trust score ranges to specific policy actions. For example, when a score is below a threshold, it triggers actions such as "blocking IPs" or "limiting bandwidth," assigning a priority (e.g., high, medium, low) to resolve rule conflicts. The generated macro-policy instructions contain a policy ID (a unique identifier for tracking and management), actions (e.g., allow, deny, redirect, or log), and priority, and are distributed to the relevant micro-boundary controllers via the gRPC protocol. gRPC is a high-performance remote procedure call framework based on HTTP / 2 and Protocol Buffers, supporting bidirectional streaming and low-latency communication to ensure the reliability and real-time nature of instruction transmission. In implementation, the policy coordination center may adopt a microservice architecture, deploying the anomaly detection model inference and instruction generation modules as independent services, using a load balancer to handle high-concurrency requests. This step enables centralized intelligent decision-making, capable of identifying complex threats (such as low-intensity distributed attacks) from a global perspective and responding quickly.

[0034] Step S4: Distributed local analysis is performed on the micro-boundary controller. The micro-boundary controller embeds a kernel-level rule executor based on eBPF technology. This rule executor performs in-depth analysis of real-time flowing data packets by loading eBPF programs to key points in the network stack (such as XDP or TC hooks), including parsing packet headers and payloads, matching predefined rules (such as 5-tuple-based filtering rules), and calculating statistical characteristics (such as packet rate or size anomalies). Based on the analysis results, the rule executor generates a transient anomaly flag, a binary value (0 or 1) indicating whether an anomaly was detected at the current instant (e.g., within a millisecond window), such as packet protocol violations or frequencies exceeding the local baseline. The eBPF program uses a mapped data structure to store state and rules, supporting atomic updates and concurrent access, ensuring low overhead and high performance. The rule executor performs in-depth analysis of real-time flowing data packets by hooking eBPF programs to key points in the network stack (such as XDP or TC hooks), including parsing packet headers and payloads, matching predefined rules (such as 5-tuple-based filtering rules), and calculating statistical characteristics (such as packet rate or size anomalies). Based on the analysis results, the rule executor generates a transient anomaly flag, a binary value (0 or 1) indicating whether an anomaly, such as a packet protocol violation or frequency exceeding the local baseline, was detected at the current instant (e.g., within a millisecond window). The eBPF program uses a mapped data structure to store state and rules, supporting atomic updates and concurrent access, ensuring low overhead and high performance. In implementation, the micro-boundary controller can run in a lightweight container or virtualized environment. The rule executor is loaded and managed via the eBPF toolchain (such as BCC or bpftool) and communicates with user-space control logic through perf events or a ring buffer. This step provides distributed, rapid detection capabilities, enabling responses to localized threats without relying on delayed decisions from a central node.

[0035] Step S5, the collaborative decision-making and execution step, combines central instructions with local analysis results to achieve intelligent response. The micro-border controller performs a logical AND operation between the received macro-policy instructions and the locally generated transient anomaly flag. This means that a defensive action is triggered only when both indicate an anomaly—that is, the macro-policy instruction suggests action and the local flag is 1; otherwise, the current state is maintained or the default action is executed. For example, if the macro-policy instruction suggests blocking a certain IP, but no transient anomaly is detected locally, the micro-border controller may temporarily refrain from execution to avoid mistakenly blocking normal traffic; conversely, if an anomaly is detected locally but no instruction is issued from the central authority, the micro-border controller can simply log the action without actively blocking traffic. This logical operation is based on Boolean algebra principles and is implemented through hardware or software logic circuits, executing efficiently in the micro-border controller's decision-making module. Based on the operation results, the micro-border controller dynamically updates its Access Control List (ACL) rules. An ACL is a set of rules that defines traffic processing policies based on 5-tuples or other attributes. The update process includes adding, modifying, or deleting rules, such as adding a rule to drop packets from suspicious IPs. After the rules are updated, the micro-border controller immediately performs corresponding control actions on network traffic, such as allowing, denying, redirecting to honeypots, or generating alerts. In implementation, the micro-border controller may use hash tables or tree structures to store ACL rules to support fast matching and apply rules directly through kernel mechanisms (such as Netfilter or eBPF) to ensure nanosecond-level response. This step embodies the collaboration between the central and edge layers, leveraging the accuracy of global analysis while retaining the agility of local execution, forming a multi-layered defense.

[0036] Step S6, the feedback optimization phase, enables continuous learning of the system by periodically collecting rule execution logs from the micro-boundary controller. The rule execution logs include detailed information such as rule matching counts, action execution results, traffic statistics, error events, and timestamps. These logs are periodically fed back to the policy coordination center via a secure channel (such as TLS or MQTT), with the period ranging from minutes to hours, depending on network dynamics and resource constraints. At the policy coordination center, the log data is used to incrementally update the anomaly detection model trained using the XGBoost algorithm. Incremental updates are a machine learning technique that allows the anomaly detection model to adjust its parameters using new data without retraining on the full dataset, thus adapting to network changes. For example, if certain rules are frequently triggered but subsequent analysis shows they are false alarms (e.g., normal business traffic is misjudged), the anomaly detection model can reduce the weight of the corresponding features; conversely, if a new threat pattern emerges, the anomaly detection model can enhance its detection sensitivity. In implementation, the policy coordination center can use an online learning framework (such as River or Spark Streaming) to clean the feedback data before inputting it into the anomaly detection model update pipeline, and use a version control mechanism to manage model iterations. To ensure stability, the update process may include verification steps, such as A / B testing or rollback mechanisms. This step forms a closed-loop control system, enabling the entire defense system to learn from actual deployments and continuously optimize detection accuracy and response strategies.

[0037] It should be noted that the defense system of this invention consists of two types of components: a policy coordination center and a micro-border controller. The policy coordination center, as the logically centralized brain, is usually deployed in the core management area of ​​the network as an independent server or cloud service, and is responsible for global data analysis, machine learning inference, and macro-policy generation. The micro-border controller, as a distributed execution terminal, can be flexibly deployed in the host (implementing process-level micro-isolation in the form of a daemon process and kernel eBPF program), network gateway (such as an SDN switch or cloud-native sidecar proxy), or cloud platform virtual network node, depending on the required protection granularity. It is responsible for performing local real-time traffic analysis, receiving central instructions, and ultimately completing the collaborative update of access control rules.

[0038] Existing technologies typically rely on static security policies, resulting in long update cycles that struggle to adapt to the rapid evolution of network threats. Furthermore, their centralized decision-making often leads to high response latency and a high risk of single points of failure. Fixed data collection granularity can also cause critical events to be missed or increase system burden under high load. In contrast, this invention achieves dynamic adaptive defense through a collaborative mechanism of centralized global analysis and distributed local execution. Data collection covers multi-dimensional information, and TLS encrypted transmission ensures data comprehensiveness and security. The policy coordination center utilizes the XGBoost model for intelligent analysis, generating dynamic trust scores to improve threat identification accuracy. The micro-boundary controller, based on eBPF technology, performs low-latency local analysis and coordinates with central commands through logical AND operations, significantly reducing the risk of false positives and false negatives. A feedback optimization mechanism enables the system to continuously learn and adapt to network changes, enhancing the intelligence and robustness of the overall defense. Overall, this invention improves the detection capabilities of combined attacks and new threats, offering faster response times and more efficient resource utilization. Simultaneously, the distributed architecture reduces the burden on central nodes, avoids single points of failure, and makes network security protection more flexible and reliable.

[0039] In one specific implementation, in the zero-trust network adaptive defense method, the data collection frequency of the sensing probe is dynamically adjusted according to the CPU load of its host. This mechanism is achieved through the coordinated use of multiple technical features. First, the sensing probe starts an independent monitoring thread in user space. This monitoring thread runs at fixed time intervals, such as once every second or every few seconds, to acquire system-level CPU time statistics and the CPU usage time of the sensing probe process itself. System-level CPU time statistics include total CPU utilization, idle time, or load distribution of each core, while the CPU usage time of the sensing probe process reflects the resource consumption of the sensing probe software itself. Based on this time information, the monitoring thread calculates a comprehensive load index through weighted average calculation, with the specific formula as follows: Where L represents the comprehensive load index, with a value range of 0-100%, and U... systemm This indicates system-level CPU utilization, obtained by reading / proc / stat (Linux) or performance counters (Windows). probe The CPU utilization of the sensing probe process is indicated by the process status interface, L. systemThis represents the overall system load average, obtained by reading ` / proc / loadavg` (Linux) or the system API (Windows). W1, W2, and W3 are weighting coefficients, satisfying W1 + W2 + W3 = 1. Typical values ​​are W1 = 0.5, W2 = 0.3, and W3 = 0.2. In practice, the monitoring thread collects these parameters at fixed time intervals (e.g., 1 second) and smooths out instantaneous fluctuations using a moving average method to ensure the comprehensive load metric stably reflects the system load status. The weighting coefficients can be adjusted according to the host type and application scenario. For example, the weight of W1 can be increased on compute-intensive servers, and the weight of W3 can be increased in I / O-intensive environments. This comprehensive load metric aims to comprehensively reflect the real-time load status of the host, for example, by combining the overall system load and the utilization rate of the sensing probe process to avoid bias from a single data source. The principle behind this process is to continuously monitor CPU resource usage and dynamically assess system pressure, thereby providing a basis for adjusting the collection frequency. In implementation, the monitoring thread uses interfaces provided by the operating system (such as / proc / stat in Linux or performance counters in Windows) to collect data periodically and calculates comprehensive load metrics using simple algorithms (such as moving average or exponential smoothing) to ensure that the metrics can respond quickly to load changes while reducing the impact of instantaneous fluctuations.

[0040] Secondly, the sensing probe has multiple preset acquisition cycle levels, including at least three: a first cycle level, a second cycle level, and a third cycle level. The first cycle level has the shortest acquisition cycle and the highest acquisition frequency, for example, it can be set to 1 second or less, for high-precision data acquisition; the second cycle level has a moderate acquisition cycle, for example, around 5 seconds; and the third cycle level has the longest acquisition cycle and the lowest acquisition frequency, for example, 10 seconds or longer, for low-frequency acquisition to minimize resource consumption. Simultaneously, the system presets two load thresholds: a first load threshold T1 and a second load threshold T2, with T1 being greater than T2. ​​T1 can be set to a high value, such as 80% CPU utilization, indicating a high system load; T2 can be set to a low value, such as 50% CPU utilization, indicating a light system load. These threshold and acquisition frequency settings are based on load distribution in typical network environments, aiming to reduce acquisition intensity when resources are scarce and increase data granularity when resources are abundant. During implementation, the sensing probe loads these preset parameters during initialization and fine-tunes them according to host characteristics and security requirements. For example, on critical servers, more conservative thresholds can be set to prioritize performance.

[0041] Finally, the data acquisition cycle switching logic is triggered based on the continuous changes in the comprehensive load index. When the comprehensive load index continuously exceeds T1 for a predetermined number of times N, such as meeting the condition in 3 or 5 consecutive monitoring sessions, the sensing probe will switch its acquisition cycle from the current level to a longer adjacent level, such as switching from the first cycle level to the second cycle level. If the load remains high, it will further switch to the third cycle level to gradually reduce the acquisition frequency and alleviate the system load. Conversely, when the comprehensive load index continuously falls below T2 for a predetermined number of times M, such as meeting the condition in 5 or more consecutive monitoring sessions, the sensing probe will switch its acquisition cycle from the current level to a shorter adjacent level, such as switching from the third cycle level to the second cycle level, or further switching to the first cycle level to increase the acquisition frequency and capture more safety-related details. This switching mechanism avoids frequent level changes caused by load fluctuations by introducing hysteresis behavior, ensuring system stability. During operation, the sensing probe maintains an internal state machine to record the current cycle level and the number of consecutive times the target is met. Each time the monitoring thread updates the comprehensive load index, it checks the switching conditions and performs corresponding adjustments. At the same time, it records the switching events through the log for subsequent analysis.

[0042] In one specific implementation of the zero-trust network adaptive defense method, the macro-policy instruction includes a lifetime field, which defines the effective duration of the macro-policy instruction on the micro-border controller. When the micro-border controller receives a macro-policy instruction from the policy coordination center, it first parses the lifetime field value, which can be in seconds or minutes, for example, 300 seconds or 10 minutes, depending on the urgency of the network policy and the expected duration of the threat. After parsing, the micro-border controller immediately starts a corresponding countdown timer, which is typically implemented using a software timer and operates based on the operating system's clock interrupt mechanism, accurately measuring the elapsed time. Simultaneously, the micro-border controller stores the received macro-policy instruction and its corresponding countdown timer information in a local policy hash table. This local policy hash table uses the policy ID as a unique key, and each entry contains the specific content of the policy rule, a handle reference to the countdown timer, and a status flag indicating the policy status. The status flag can be used to mark whether the policy is active, paused, or awaiting deletion, facilitating subsequent management. This design principle is based on the efficient query characteristics of key-value stores, ensuring that a large number of strategies can be quickly located and managed.

[0043] During the policy's effective period, the system ensures its timeliness through a dynamic update mechanism. At any point before the countdown expires, if the micro-border controller receives an update instruction with the same policy ID from the policy coordination center, it immediately resets the countdown timer corresponding to that policy. The reset operation involves stopping the current timer and then restarting it based on the potentially modified lifetime field value in the update instruction or by directly using the original value. The principle behind this mechanism is that continuous policy state synchronization allows the system to adapt to dynamic changes in the network environment. For example, when a threat persists, the policy coordination center can extend the validity period of the corresponding policy by periodically sending update instructions, avoiding defense interruptions. During implementation, the micro-border controller maintains a policy update listening thread specifically for handling update messages from the center and uses a hash table for fast lookup to locate the target policy entry, completing the timer reset and necessary content updates.

[0044] When the countdown timer expires, the system triggers a timeout interrupt service routine to automatically clean up the policy. This routine looks up the corresponding storage entry in the local policy hash table based on the timeout policy ID. Upon successful lookup, the routine performs a series of cleanup operations: first, it removes the policy rule from the actual running access control list to ensure it no longer affects network traffic; then, it cleans up the relevant entries in the hash table, releasing the occupied storage resources. The timeout interrupt service routine typically runs with high priority to ensure timely release of system resources; its implementation may rely on the operating system's interrupt handling mechanism or a dedicated timer management module. In actual operation, when a timer timeout event occurs, the hardware or software timer generates an interrupt signal, the CPU suspends the current task and executes the interrupt service routine, completing policy removal and resource reclamation before resuming the original task.

[0045] In one specific implementation of the zero-trust network adaptive defense method, the micro-border controller ensures the reliability of macro-policy instructions through a security testing mechanism before applying new rules. This mechanism first maintains a sandbox access control list (ACL) within the micro-border controller's internal logic, completely parallel to the actual running ACL, dedicated to testing. This sandbox environment serves as an isolated test area, and its rule set has no impact on actual network traffic. During actual operation, the micro-border controller uses port mirroring or traffic replication technology to completely copy the actual traffic passing through it and guide it to the sandbox ACL for processing. Port mirroring typically utilizes the characteristics of network switches to copy traffic from a specified port to a monitoring port, while traffic replication can be implemented internally within the micro-border controller via software. Both methods ensure that test traffic is completely consistent with production traffic and does not interfere with each other. The principle behind this design is to create a testing platform highly consistent with the real environment, allowing new rules to be tested by real traffic without risk.

[0046] When a new rule needs to be tested, the system enters a rigorous testing and verification phase. The micro-boundary controller first adds the new rule to the sandbox access control list and simultaneously initiates a pre-set timed test window. This window can last from tens of seconds to several minutes, such as 30 seconds or 2 minutes, with the specific duration adjusted according to business criticality and risk level. During the test window, the system monitors the matching results of replicated traffic in the sandbox access control list in real time, recording detailed characteristics of traffic matching the new rule, including source and destination addresses, port numbers, and other key information. Simultaneously, the system proactively sends ICMP heartbeat packets or TCP synchronization probe packets to a pre-set list of critical business server addresses to continuously monitor network connectivity. These probe packets are sent at an appropriate frequency, such as once per second, to ensure timely detection of any network reachability issues. The principle behind this process is a dual verification mechanism: observing the impact of the new rule on actual traffic while proactively confirming the availability of critical services, thereby comprehensively assessing the security of the new rule.

[0047] The final crucial step involves decision-making and execution based on test results. If network connectivity testing is successful throughout the entire test window, and no denial rule matching events for predefined critical business service ports are recorded in the sandbox access control list, the system considers the security test passed. In the security testing process, the criteria for determining critical business service ports are based on a predefined configuration list, dynamically maintained by the administrator according to actual business needs. This list typically includes port numbers, protocol types (such as TCP or UDP), and corresponding business service descriptions (e.g., web services might include ports 80 and 443, database services might include port 3306, remote login services might include port 22, etc.). A denial rule matching event refers to an event where a rule in the sandbox access control list matches the flowing traffic and executes a "deny" action. The system detects whether traffic to critical business service ports is being denied by monitoring the sandbox access control list's matching logs in real time. Specifically, during the testing window, if any rule in the sandbox access control list matches a predefined critical business service port (i.e., the target port matches the port and protocol in the list) and triggers a denial action, it is considered a rule denial match event. Conversely, if no such event is recorded and network connectivity checks continue to succeed, the security test is considered passed. This standard ensures that new rules do not mistakenly block critical business traffic, thereby guaranteeing business continuity and network security. At this point, the micro-border controller will securely migrate the new rule from its sandbox access control list to the actual running access control list for formal implementation. Conversely, if network connectivity anomalies or critical business ports are mistakenly denied during the test, the security test is immediately deemed failed, the system will automatically discard the new rule, and a detailed alarm log will be generated and sent to the policy coordination center. The alarm log contains key information such as the rule content, test time, and reason for failure for administrator analysis and processing. The principle of the entire testing process is to ensure that each new rule undergoes a thorough security assessment before formal deployment through rigorous sandbox verification and real-time monitoring.

[0048] In one specific implementation, within a zero-trust network adaptive defense system, efficient collaboration among multiple micro-border controllers is achieved through a message queue mechanism based on a publish / subscribe pattern. When a first micro-border controller in the network detects a transient anomaly through its embedded kernel-level rule executor based on eBPF technology, such as identifying a suspicious packet flooding attack or abnormal connection attempt, it immediately generates a specific containment rule. This containment rule contains processing instructions for the threat, such as blocking all traffic from a specific source IP. Subsequently, the first micro-border controller serializes this rule into a predefined structured data format. This format may use JSON, XML, or a more efficient binary protocol (such as Protocol Buffers) to encapsulate the key elements of the rule, including five-tuple information, action type, and priority identifier. The principle of serialization is to convert complex objects in memory into a transmissible and persistent byte stream, laying the foundation for subsequent network transmission and cross-platform parsing. In specific implementations, the first micro-border controller calls serialization library functions to encode all fields of the rule object according to a predetermined structure, ensuring data integrity and consistency.

[0049] The serialized containment rule data is distributed through a message broker server based on the MQTT protocol. The first micro-border controller, acting as the publisher, publishes the serialized data as a message payload to the message broker. The message subject is set to a Uniform Resource Identifier (URI) corresponding to the threat type, and the message queue subject uses a structured URI format of "base path / network zone identifier / threat classification identifier". The network zone identifier is based on a configurable mapping table (such as IP network segments, VLANs, or service groups), while the threat classification identifier is recommended to be standardized using an industry-standard framework (such as MITRE ATT&CK technology ID). Through this structure, the micro-border controller can accurately publish or subscribe to threat intelligence for specific regions and types, thereby achieving precise and efficient distributed collaborative defense. For example, it can contain a path like "network / zone-a / scan-detection", which explicitly includes the network zone identifier and threat classification identifier. This subject design principle utilizes the hierarchical nature of URIs, making message classification and routing clear and efficient. The message broker server, such as using implementations like EMQX or Mosquitto, is responsible for receiving published messages and forwarding them to all clients subscribed to the relevant topics. In actual operation, the publisher micro-boundary controller establishes a persistent TLS connection with the message broker and sends messages to the specified topic by calling the Publish interface. The messages may be configured to be retained for a certain period of time, such as a few seconds to a few minutes, to ensure that short-term network fluctuations do not cause message loss.

[0050] Other micro-border controllers that have pre-subscribed to relevant threat type topics receive these containment rule messages in real time from the message broker. Subscription relationships are typically established during system initialization. Each micro-border controller subscribes to a corresponding topic pattern based on the network zone it protects and its scope of responsibility. For example, micro-border controllers located in the same security domain might subscribe to "network / zone-a / #" to receive all threat alerts for that zone. When a subscriber micro-border controller receives a message, it first deserializes the message payload to parse out the specific content of the containment rule. Subsequently, the system performs a crucial conflict detection step: it performs a five-tuple-based conflict detection on the received containment rule and its existing access control list rules to check for rule overlap or contradictions. If a conflict is detected, the system arbitrates based on the priority field carried in the containment rule, retaining the rule with higher priority. The priority field may be represented numerically, such as a 1-10 scale (higher numbers indicate higher priority), or semantic labels such as "urgent," "high," "medium," and "low." The principle behind this arbitration mechanism is to resolve decision conflicts between rules through explicit priority definitions, ensuring the consistency and determinism of network security policies. Throughout the process, the micro boundary controller records relevant logs of rule reception and application for subsequent auditing and analysis.

[0051] In one specific implementation, in the zero-trust network adaptive defense method, the policy coordination center determines the survival time field value in the macro-policy instruction through a dynamic calculation mechanism. First, the value of the survival time field is dynamically calculated based on a dynamic trust score, which is generated by an anomaly detection model and reflects the real-time trustworthiness of network entities. After obtaining this dynamic trust score, the policy coordination center calculates the initial survival time by combining it with a preset base time constant and adjustment coefficient. The policy coordination center determines the survival time field value in the macro-policy instruction through a dynamic calculation mechanism, which is based on the dynamic trust score S. trust First, the system presets a trust threshold Sth (e.g., 0.6), a base survival time A (e.g., 300 seconds), an adjustment factor B (e.g., 200 seconds), and a minimum survival time T. min (e.g., 60 seconds), S trust Normalized to the [0,1] interval. The calculation process uses a piecewise function form: when S trust th Low Trust State: Indicates that the network entity's behavior is suspicious or poses a high risk. In this state, the survival time T... ttl The calculation formula is T ttl = max(T min , AB × (S th -S trust ​This formula ensures that survival time decreases as trust score decreases, but will not be less than T. min This ensures that high-risk strategies can be quickly recovered or updated. When S trust ≥ S th High Trust State: Indicates that the network entity is behaving normally or at low risk. In this state, the survival time T is... ttl The calculation formula is T ttl = A + B × (S trust -S th This formula makes the survival time increase linearly with the trust score, providing a stable policy environment for trustworthy behavior and reducing the overhead of policy issuance. The principle behind this piecewise calculation mechanism is that it makes the policy survival time negatively correlated with the entity's real-time risk level, achieving an optimal balance between security and performance.

[0052] Secondly, the data pre-filtering step is performed before the global analysis is executed by the policy coordination center, and is handled by the micro-boundary controller or regional aggregation node. This step filters and aggregates the collected raw data based on predefined local baseline rules and a list of key assets. Local baseline rules may include network connection frequency thresholds, such as a maximum of 100 connection attempts per minute, or abnormal system call patterns; the list of key assets identifies important servers or services, such as databases or authentication nodes. The principle of pre-filtering is to identify abnormal behavior near the data source and report only a subset of data that meets preset conditions. The "preset abnormal conditions" in the data pre-filtering step are specifically executed by a lightweight rule engine deployed on the micro-boundary controller or regional aggregation node. This engine makes judgments based on predefined local baseline rules and the list of key assets by comparing multiple technical indicators in real time, including: network connection frequency (such as more than 100 new connections to the same target per minute), sudden changes in traffic volume relative to the historical baseline (such as more than 3 standard deviations), behavioral patterns that match port scanning or brute-force attacks, and unusual access to key assets (such as core databases) (such as unauthorized IPs or access outside of working hours). Only when collected data triggers one or more of the above conditions and is marked as an anomalous subset is it aggregated and reported to the policy coordination center. The remaining data is recorded locally and then discarded, thereby reducing network transmission and the processing load on the central node. During implementation, the micro-boundary controller runs a filtering engine that continuously matches collected data against the rule base, filtering out suspicious activities through pattern recognition and threshold comparison, and aggregating and compressing the data to reduce its size. This mechanism significantly reduces the amount of data transmitted, avoids the central node processing irrelevant information, and preserves critical security events.

[0053] These technical features work together to form a highly efficient adaptive defense scheme. Data pre-filtering reduces the burden on central nodes and network bandwidth consumption, allowing the policy coordination center to focus more on the analysis of critical data, thereby quickly generating accurate dynamic trust scores. Survival time calculation based on this score ensures that the timeliness of the policy matches the network trust status; the policy takes effect briefly in high-risk situations for rapid adjustment, and is persistently applied in low-risk situations to maintain stability. Overall, this combination optimizes resource utilization, improves system response speed and adaptability, and enables the defense system to remain agile and reliable in large-scale networks.

[0054] In one specific implementation, within a zero-trust network adaptive defense system, the migration of new rules from the sandbox access control list to the actual operating environment employs a phased deployment strategy. After security testing is passed, the system first adds the new rule to the actual operating access control list with a lower priority value. This priority value is typically set at least one level lower than the preset normal priority. For example, in a numerical priority system, if the normal rule priority is set to 100, the new rule might initially be deployed with a priority of 80. The principle behind this design is to achieve a gradual introduction of rules through priority control, ensuring that new rules do not overwrite or interfere with the execution of existing critical rules in the initial stage. In actual implementation, the system maintains a dynamic priority mapping table. When a rule migrates from the sandbox environment, the priority adjustment module automatically calculates the initial priority value based on a preset downgrade margin and injects the rule into the runtime rule engine, forming a parallel execution system with existing rules.

[0055] During the parallel rule execution phase, the system enters a continuous monitoring period. This phase maintains a preset observation duration, which may last from several minutes to several hours, such as 15 minutes or 1 hour, depending on the importance and risk level of the rule. During this period, the system continuously monitors the network's operational status, focusing on predefined network anomaly indicators. These indicators may include sudden increases in connection failure rates, abnormal access to specific service ports, or significant changes in network latency. The monitoring process involves real-time data collection via sensing probes deployed at various network nodes, which are then analyzed by the anomaly detection engine. The monitoring principle is based on baseline comparison technology; the system compares the current network state with historical normal behavior patterns. When an anomaly pattern deviating from the baseline is detected, a corresponding event alarm is generated. Throughout the monitoring period, although new rules are in a low-priority state, their execution results and network impacts are recorded in detail.

[0056] After a complete monitoring cycle without triggering any predefined network anomalies, the system enters the final priority adjustment phase. At this point, the rule management module adjusts the priority of the new rule from its initial low priority to its preset normal priority level. This adjustment process typically employs atomic operations to ensure instantaneous rule switching, avoiding gaps in rule execution during priority changes. In practice, the system first pauses the rule matching service of the rule engine, then updates the priority field of the target rule, and finally reactivates the rule engine. To ensure a smooth transition, this process may be performed during off-peak hours or staggered across different nodes using a batch rolling upgrade approach. Once the adjustment is complete, the new rule officially participates in network traffic processing decisions with full permissions.

[0057] In one specific implementation, within a zero-trust network adaptive defense system, the first micro-border controller, when publishing serialized containment rule data, attaches a digital signature signed by the policy coordination center. This digital signature is generated using an asymmetric encryption algorithm, such as RSA-2048 or ECDSA. The policy coordination center holds the private key for signature generation, while all micro-border controllers have pre-configured corresponding public keys for verification. The digital signature generation process involves calculating a hash value from the serialized containment rule data, encrypting the hash value using the policy coordination center's private key, and finally attaching the encrypted result as the digital signature to the message. The principle behind this mechanism is to leverage the characteristics of asymmetric encryption technology to ensure that only the policy coordination center, holding the corresponding private key, can generate a valid signature, thereby providing reliable identity authentication for the source of the rule data.

[0058] When other micro-border controllers receive a message containing a digital signature, they first execute a signature verification process. This verification process involves calculating a hash value for the received serialized rule data, simultaneously decrypting the attached digital signature using a pre-set public key to obtain the original hash value, and then comparing the two hash values. If the hash values ​​match perfectly, it proves that the message indeed originated from a legitimate policy coordination center and has not been tampered with during transmission; if verification fails, it indicates that the message may have been forged or tampered with, and the system will immediately discard the message. In actual operation, the verification module is integrated at the entry point of the message processing pipeline, employing an efficient cryptographic library to implement the verification operation, ensuring that security is guaranteed without impacting system processing performance. The verification process typically completes within milliseconds, without causing significant delays to real-time defense responses.

[0059] Only after the digital signature verification is successful will the micro-boundary controller receiving the message continue with the subsequent deserialization and collision detection steps. This sequential processing mechanism forms a strict security check chain, ensuring that any unverified message will not enter the rule processing flow. In practice, the system maintains a verification status flag; the subsequent message parsing engine is only activated when this flag is true. Simultaneously, for messages that fail verification, the system generates security event logs and reports them to the policy coordination center. These logs contain key information such as the message source, verification time, and reason for failure, providing data support for security auditing and threat analysis. The tight integration of the entire verification process and subsequent processing steps constitutes a complete security protection closed loop.

[0060] In one specific implementation, the sensing probe first acquires a comprehensive load metric in real time through an independent monitoring thread. This metric comprehensively reflects the CPU load status of the host machine. Specifically, the monitoring thread runs at fixed time intervals (e.g., once per second), obtaining system-level CPU time statistics (such as total CPU utilization, idle time, etc.) from the operating system kernel, as well as the CPU usage time of the sensing probe process itself. Then, a comprehensive load metric is obtained through weighted calculation (e.g., combining system utilization, process utilization, and the system load average), expressed as a percentage ranging from 0% to 100%. The principle is to continuously monitor CPU resource usage and dynamically assess system pressure, thereby providing real-time basis for subsequent data compression decisions. During implementation, the monitoring thread runs as a background task in user space, collecting data using operating system interfaces (such as / proc / stat in Linux or performance counters in Windows), and smoothing out instantaneous fluctuations using a moving average method to ensure the metric's stability and reliability. For example, in a typical deployment, the monitoring thread might collect data once per second and calculate a rolling average as the comprehensive load metric to avoid misjudgments due to short-term fluctuations. This technical feature is closely related to subsequent compression processing because it provides a key input for dynamically switching compression modes, ensuring that compression behavior matches the state of system resources.

[0061] Based on real-time acquired comprehensive load metrics, the sensing probe dynamically selects the data compression mode. When the comprehensive load metric is lower than a preset second load threshold T2, the system uses a lossless compression algorithm (such as LZ4 or Zstandard) to compress the collected security data; when the metric is higher than or equal to T2, a lossy compression mode is activated. The second load threshold T2 is a configurable value, which can be set to 50%, 60%, or 70% of CPU utilization. The specific value can be adjusted according to the network environment and management policies. For example, in resource-sensitive scenarios, T2 may be set to a lower value to prioritize performance. The principle is to achieve intelligent switching of compression modes through threshold comparison: under low load, lossless compression can ensure data integrity and reproducibility, avoiding errors introduced by compression; under high load, lossy compression sacrifices some data precision to achieve a higher compression ratio, thereby reducing the system load. During operation, the sensing probe checks the current comprehensive load metric before encapsulating data and calls the corresponding compression module. For example, if T2 is set to 60%, when the indicator remains below 60%, the sensing probe will activate lossless compression, inputting data such as process hash values ​​and network connection quintuples into the algorithm to generate a compressed stream; conversely, it will switch to lossy mode. This technical feature works in conjunction with the load monitoring stage to form a closed-loop control, enabling the system to optimize data transmission efficiency based on real-time resource status.

[0062] In lossy compression mode, the sensing probe performs a series of precision adjustment operations to further reduce data volume. These operations include: truncating timestamp information in system call sequences from microsecond precision to millisecond precision, for example, simplifying a timestamp originally recorded as "2023-10-01 12:00:00.123456" to "2023-10-01 12:00:00.123", thus significantly reducing storage requirements; aggregating multiple continuously collected data points (e.g., 5 or 10 points) into an arithmetic mean for memory usage data, using a single value to summarize the memory usage trend over a period of time, avoiding the transmission of redundant details; and reducing the precision of auxiliary flow information outside the network connection quintuple (such as flow duration, packet size distribution, or protocol flags) (e.g., rounding floating-point values ​​to integers) or directly discarding non-critical fields. The principle is to selectively discard secondary information in the data, maximizing compression efficiency with acceptable precision loss. In implementation, the sensing probe dynamically selects specific operations based on predefined strategies. For example, under high load, multiple lossy compression techniques may be applied simultaneously. The process includes: after data acquisition, the sensing probe first checks for lossy compression flags, then truncates the timestamp field, performs sliding window aggregation on the memory data, and filters auxiliary information. For example, in memory usage processing, the system may calculate the average value every 5 data points and only transmit the aggregation result; for auxiliary stream information, if it does not belong to the critical monitoring scope (such as non-business traffic), it may be directly ignored. These operations work together to ensure that lossy compression reduces data volume while still retaining sufficient security analysis value.

[0063] In one specific implementation, during the feedback optimization phase of the zero-trust network adaptive defense system, the selection of training data follows specific optimization principles when incrementally updating the anomaly detection model. The system first identifies anomaly events whose dynamic trust scores exceed a preset threshold. This preset threshold can be set to a value of 0.7 or 0.8 to distinguish between normal and abnormal network behavior states. Subsequently, the system prioritizes the selection of rule execution logs from micro-boundary controllers that are associated with these anomaly events in both time and space dimensions. In the incremental update data selection, the association rules are specifically defined as follows: in the time dimension, all logs within a configurable time window (30 to 60 minutes recommended) before and after the anomaly event are selected to capture attack precursors and subsequent impacts; in the spatial dimension, based on network topology and communication relationships, logs from micro-boundary controllers located in the same security group or subnet as the source of the anomaly event, or those with recent active network connections (such as TCP sessions within the past 24 hours), are prioritized to ensure that the training data accurately covers possible attack propagation paths. The temporal correlation might be defined as log records within a specific time window before and after an anomaly, such as data within 30 minutes before and after the event. The spatial correlation is based on network topology, including nodes in the same subnet, the same business group, or those with direct communication relationships. The principle behind this selection is to focus on confirmed anomalies and their impact, enabling model updates to specifically enhance the ability to identify real threats while avoiding diluting key features in a large amount of normal data.

[0064] After determining the training dataset, the system executes a rigorous incremental update validation process. This process first requires maintaining a fixed historical data validation set, which typically contains representative network behavior data from several months, covering various normal and anomalous scenarios. After training the incremental anomaly detection model using feedback rule execution logs, the system runs this new model in parallel with the current online anomaly detection model in shadow mode at the policy coordination center. In shadow mode, both anomaly detection models process the input data and produce prediction results simultaneously, but only the output of the online model actually affects the decision. The system compares several performance metrics of the two anomaly detection models on the historical data validation set. The performance metrics comparison in shadow mode includes, but is not limited to, the following key metrics: False positive rate: The difference in false positive rate between the incremental model and the online model on the historical validation set does not exceed 2%; False negative rate: The false negative rate of the incremental model is not higher than that of the online model, or the increase does not exceed 1.5%; Accuracy: The overall accuracy of the incremental model decreases by no more than 1%; F1 score: The F1 score of the incremental model decreases by no more than 1.5% compared to the online model; Model inference latency: The average inference time of the incremental model increases by no more than 10%. The performance comparison follows this process: 10,000 samples are randomly selected from a fixed historical data validation set and input into two models for prediction. A unified evaluation script is used to calculate the aforementioned metrics. The incremental model is considered to have met performance standards only when all the following conditions are met: false positive rate ≤ online model false positive rate + 2%; false negative rate ≤ online model false negative rate + 1.5%; accuracy ≥ online model accuracy - 1%; F1 score ≥ online model F1 score - 1.5%; inference latency ≤ online model inference latency × 1.1. In actual deployment, the system generates a detailed comparison report, including confidence interval analysis and statistical significance tests (p-value < 0.05), ensuring the scientific validity and reliability of the performance evaluation. Therefore, the incremental anomaly detection model will only be switched to a new online anomaly detection model when its performance metrics are not lower than the online model and the performance degradation does not exceed a preset threshold (e.g., an overall accuracy degradation of no more than 2%). This verification mechanism ensures that model updates do not cause a degradation in detection capabilities through thorough performance comparison.

[0065] After switching anomaly detection models, the system also includes continuous performance monitoring and an automatic rollback mechanism. The system continuously monitors key operational metrics, including policy false positive rate and network connectivity events. The policy false positive rate reflects the proportion of normal behavior misclassified as abnormal by the anomaly detection model, while network connectivity events track business access anomalies caused by policy execution. The monitoring process uses real-time streaming processing, statistically analyzing metric trends by setting appropriate time windows, such as 5-minute or 15-minute sliding windows. If monitored metrics continuously deteriorate and exceed safety thresholds within a preset time period, such as 1 hour or 2 hours, the system automatically rolls back the anomaly detection model to the version before the switch. The rollback operation includes stopping the new model's service, restoring the old model's running state, and generating a detailed event report. The principle behind this mechanism is to establish rapid-response remedial measures, ensuring that the system can quickly return to a stable state when unexpected situations occur during model updates.

[0066] The number of devices and processing scale described herein are for the purpose of simplifying the description of the invention. Applications, modifications, and variations of the invention will be readily apparent to those skilled in the art.

[0067] Although the embodiments of the present invention have been disclosed above, they are not limited to the applications listed in the specification and embodiments. They can be applied to various fields suitable for the present invention. For those skilled in the art, other modifications can be easily made. Therefore, without departing from the general concept defined by the claims and their equivalents, the present invention is not limited to the specific details.

Claims

1. A zero-trust network adaptive defense method, characterized in that, The method includes the following steps: S1. Data Acquisition: Through sensing probes deployed on terminals and servers, process hash values, network connection quintuples, system call sequences, and memory usage data are collected and synchronously sent to the policy coordination center and the corresponding micro-boundary controllers via TLS encrypted channels. S2. Data aggregation and feature extraction: The strategy coordination center performs spatiotemporal correlation on the network data collected in step S1 and performs statistical feature extraction within a preset time window to generate a structured global feature vector. S3. Centralized Global Analysis and Command Issuance: In the policy coordination center, the global feature vector is input into an anomaly detection model trained based on the XGBoost algorithm for processing to generate a dynamic trust score; the dynamic trust score is compared with a preset threshold, and a macro-policy command containing policy ID, action and priority is generated based on a predefined policy priority lookup table, and the macro-policy command is issued to the relevant micro-boundary controllers through the gRPC protocol. S4. Distributed local analysis: The micro-boundary controller uses its embedded kernel-level rule executor based on eBPF technology to analyze the data packets flowing through in real time and generate a momentary anomaly flag. S5. Collaborative Decision-Making and Execution: The micro-boundary controller performs a logical AND operation between the received macro-policy instructions and the locally generated instantaneous anomaly flag, dynamically updates its access control list rules based on the operation result, and performs corresponding control actions on network traffic. S6. Feedback Optimization: The rule execution log of the micro-boundary controller is periodically fed back to the policy coordination center for incremental updates to the anomaly detection model trained based on the XGBoost algorithm.

2. The zero-trust network adaptive defense method as described in claim 1, characterized in that, In step S1, the data acquisition frequency of the sensing probe is dynamically adjusted according to the CPU load of the host machine, specifically including: S110. The sensing probe starts an independent monitoring thread in the user space. The monitoring thread obtains system-level CPU time statistics and the CPU usage time of the sensing probe process itself at fixed time intervals. S120. The monitoring thread calculates a comprehensive load index based on the above time information; S130. The sensing probe is preset with at least three acquisition cycle levels: a first cycle level, a second cycle level, and a third cycle level. The first cycle level has the shortest acquisition cycle and the highest acquisition frequency, while the third cycle level has the longest acquisition cycle and the lowest acquisition frequency. A first load threshold T1 and a second load threshold T2 are preset, and T1 > T2. S140. When the comprehensive load index continues to exceed T1 for a predetermined number of times N, the sensing probe switches its collection cycle from the current level to an adjacent level with a longer collection cycle to reduce the collection frequency, until it switches to the third cycle level. When the comprehensive load index remains below T2 for a predetermined number of times M, the sensing probe switches its acquisition cycle from the current level to an adjacent level with a shorter acquisition cycle to increase the acquisition frequency, until it switches back to the first cycle level.

3. The zero-trust network adaptive defense method as described in claim 1, characterized in that, In step S3, the generated macro-policy instruction includes a lifespan field; in step S5, the process further includes steps for automatic policy expiration and removal, specifically including: S510. When the micro-boundary controller receives the macro-strategy instruction issued in step S3, it parses out the survival time field value therein and starts a countdown timer with this value as the interval. Simultaneously, the macro-policy instruction and its corresponding countdown information are stored in a local policy hash table. The local policy hash table uses the policy ID as the key and stores entries including policy rule content, countdown handle, and status flag. S511. If an update instruction with the same policy ID is received from the policy coordination center before the countdown timer expires, the countdown timer corresponding to the macro-policy instruction is reset. S512. If the countdown timer expires, a timeout interrupt service routine is triggered. The timeout interrupt service routine searches for the corresponding entry in the local policy hash table according to the timeout policy ID, removes the policy rule from its access control list, and cleans up the relevant entries in the hash table.

4. The zero-trust network adaptive defense method as described in claim 1, characterized in that, In step S5, before applying the new rules derived from the macro-policy instructions to the actually running access control list, the micro-boundary controller further includes a security testing step, specifically including: S520. The micro boundary controller maintains, within its internal logic, a sandbox access control list dedicated to testing, which runs parallel to the actual running access control list. S521. The micro-border controller uses port mirroring or traffic replication technology to copy the actual traffic passing through it and guide it to the sandbox access control list for processing. S522. When a new rule needs to be tested, the micro-boundary controller first adds the new rule to the sandbox access control list and starts a timed test window of a preset duration. S523. During the test window, monitor the matching results of the replicated traffic in the sandbox access control list in real time, and record the characteristics of the traffic that matches the new rule. Meanwhile, network connectivity is continuously monitored by sending ICMP heartbeat packets or TCP synchronization probe packets to a pre-defined list of critical business server addresses. S524. If the network connectivity test is successful throughout the test window and no rule matching the predefined critical business service port and triggering a denial action is recorded in the sandbox access control list, then the security test is deemed to have passed. S525. After the security test is passed, the micro-border controller will migrate the new rule from its sandbox access control list to the actual running access control list to take effect; if the security test fails, the new rule will be discarded and an alarm log will be generated and sent to the policy coordination center.

5. The zero-trust network adaptive defense method as described in claim 1, characterized in that, In step S5, the collaboration between multiple micro-boundary controllers is achieved through a publish / subscribe message queue, specifically including: S530, when the kernel-level rule executor based on eBPF technology embedded in the first micro-boundary controller detects a transient anomaly and generates a containment rule, the first micro-boundary controller serializes this rule into a predefined structured data format. S531. The first micro-border controller then acts as a publisher, using an MQTT-based message broker server to publish the serialized containment rule data as a message payload. The subject of the message is set to a Uniform Resource Identifier (URI) corresponding to the threat type. The hierarchical structure of the URI includes a network area identifier and a threat classification identifier. S532, pre-subscribed to other micro-border controllers on topics related to this threat type, and as a subscriber, received the message in real time from the message broker server; S533 and other micro-boundary controllers deserialize the received message payload and parse out the containment rules. S534. Other micro-boundary controllers first perform a five-tuple-based conflict detection between the containment rule and their existing access control list rules. If there is no conflict, the containment rule is directly added to its local access control list. If a conflict is detected, arbitration is performed based on the priority field carried in the containment rule, and the rule with higher priority is retained.

6. The zero-trust network adaptive defense method as described in claim 3, characterized in that, In step S3, the strategy coordination center dynamically calculates the value of the survival time field through the following steps: S310, Obtain the dynamic trust score S trust And set a trust threshold S th ; S320, Compare dynamic trust scores S trust With trust threshold S th : If S trust th If the condition is not met, it is considered a low-trust state, and the survival time T is calculated. ttl =max(T) min AB×(S) th -S trust ));​ If S trust ≥S th If it is determined to be a high-trust state, the survival time T is calculated. ttl = A + B × (S) trust -S th )); Where A is a preset base survival time, B is a preset adjustment coefficient, and T is a preset base survival time. min This is a preset minimum survival time threshold; In step S3, before the strategy coordination center performs global analysis, it also includes a pre-filtering step on the data collected in step S1: The micro-boundary controller or regional aggregation node filters and aggregates the collected data based on predefined local baseline rules and a list of key assets, and only reports a subset of data that meets preset anomaly conditions to the policy coordination center.

7. The zero-trust network adaptive defense method as described in claim 4, characterized in that, After the security test is passed, the process of migrating the new rules from the sandbox access control list to the actual running access control list is carried out in stages, specifically including: First, the new rule is added to the actual running access control list with a priority value at least one level lower than the preset normal priority, and runs in parallel with the existing rules; After a second preset time period without triggering a predefined network anomaly, the priority of the new rule is adjusted to its preset normal priority.

8. The zero-trust network adaptive defense method as described in claim 5, characterized in that, When the first micro-border controller publishes the serialized containment rule data, it also includes a digital signature signed by the policy coordination center. After receiving the message, the other micro-border controllers first verify the validity of the digital signature, and only execute the subsequent deserialization and conflict detection steps after the verification is successful.

9. The zero-trust network adaptive defense method as described in claim 2, characterized in that, In step S1, the sensing probe compresses the collected data before sending it, specifically including: The sensing probe acquires the comprehensive load index calculated by the monitoring thread in real time. When the overall load index is lower than the second load threshold T2, a lossless compression algorithm is used to compress the data; When the comprehensive load index is higher than or equal to the second load threshold T2, lossy compression mode is enabled; wherein, the lossy compression mode includes at least one of the following operations: truncating the timestamp information in the system call sequence from microsecond precision to millisecond precision; aggregating multiple continuously collected data points into its arithmetic mean for memory occupancy data; reducing the precision or directly discarding auxiliary stream information other than the network connection quintuple.

10. The zero-trust network adaptive defense method as described in claim 1, characterized in that, In step S6, when performing incremental updates, the selection of training data follows the following principles: first, locate abnormal events whose dynamic trust scores exceed a preset threshold; then, prioritize the selection of rule execution logs fed back by micro-boundary controllers that are associated with the abnormal events in the time and space dimensions. The incremental update specifically includes the following steps: retaining a fixed historical data validation set; after training the incremental anomaly detection model using the feedback rule execution logs, running the incremental anomaly detection model and the online anomaly detection model in parallel in shadow mode in the policy coordination center, and comparing their performance metrics on the historical data validation set; only when the performance metrics of the incremental anomaly detection model are not lower than those of the online anomaly detection model and the decrease does not exceed a preset threshold, is it switched to a new online anomaly detection model. After switching anomaly detection models, performance monitoring and rollback steps are also included: continuously monitoring the false alarm rate of the policy and network connectivity events; if the monitoring indicators deteriorate within a preset time and exceed the safety threshold, the anomaly detection model will be automatically rolled back to the version before the switch.

Images