Cloud environment-oriented data security policy automatic adjustment system

Abstract

The invention provides a cloud environment-oriented data security policy automatic adjustment system. The system is composed of a data acquisition module, a data analysis module, a security policy adjustment module, a monitoring feedback module and a training data module. The data acquisition module acquires user access records, network traffic and system log data. A data analysis module analyzes these data and generates security event alarms and risk assessments in combination with a risk knowledge base. And the security policy adjustment module formulates and updates security parameters according to the evaluation result, and generates and pushes a new security policy to the cloud environment. And the monitoring feedback module monitors network flow and user behaviors, compares the network flow and the user behaviors with a preset baseline, and feeds back when finding abnormity. And the training data module performs scene simulation training by using historical data, optimizes a data analysis model, and improves the safety performance of the system.

Description

Technical fields:

[0001] This invention belongs to the field of power safety technology, specifically relating to an automatic adjustment system for data security policies in cloud environments. Background technology:

[0002] With the increasing prevalence of cloud computing technology, enterprises and organizations are relying more and more on cloud services to support critical business operations and store sensitive data. However, this centralized data storage and processing approach also brings new security challenges. First, traditional security mechanisms—firewalls, intrusion detection systems, and antivirus software—while providing some protection, typically only address known security threats and require manual intervention to update rules and handle security incidents. This is often slow and inefficient in a dynamically changing network environment. Second, with constantly evolving regulations, such as the implementation of the EU's General Data Protection Regulation (GDPR), cloud service providers need to ensure their services not only defend against cyberattacks but also comply with data protection regulations in various countries and regions. Third, compliance checks often involve a large amount of manual review, adding extra complexity and cost to cloud service management. Fourth, in the face of major system failures and catastrophic events, the lack of effective automated disaster recovery plans can lead to prolonged business interruptions and data loss, causing severe economic losses and damage to brand reputation for enterprises. Summary of the Invention:

[0003] Based on this, the present invention provides an automatic data security policy adjustment system for cloud environments, which aims to solve the problems of the lag in security policy adjustment, the complexity of compliance checks, and the lack of automation in disaster recovery plans in traditional cloud services.

[0004] To achieve the objectives of this invention, an artificial intelligence-based automatic data security policy adjustment device for a cloud environment is provided. The device includes a data acquisition module, a data analysis module, a security policy adjustment module, a monitoring and feedback module, a training data module, a policy database module, and a user interface module, wherein:

[0005] The data acquisition module, as the perception layer of the system, collects user access records, network traffic information and system log data from the cloud environment in real time by connecting to the data acquisition device set up on site, providing raw data input for the data analysis module, the security policy adjustment module and the monitoring feedback module.

[0006] The data analysis module involves data receiving, data cleaning, and data preprocessing steps. It also includes convolutional neural network and recurrent neural network learning models. Through deep learning algorithms, it mines potential security threats from complex network traffic and system logs, performs feature extraction and analysis, compares the discovered abnormal data with risk thresholds, generates security event alerts and risk assessment results, and transmits them to the security policy adjustment module. At the same time, it uses a behavior analysis model to learn user behavior patterns, feeding back new risk data identified from the monitoring feedback results returned by the monitoring feedback module to the training data storage module, automatically performing scenario simulation training to optimize and improve the data analysis model.

[0007] The security policy adjustment module obtains security event alerts and risk assessment results from the data analysis module, determines the current security threat level faced by the cloud environment, formulates updated firewall rule sets, intrusion detection system parameters, and access control list security parameters, and automatically generates updated security policies. Simultaneously, based on the security policy optimization information output by the policy database module, it generates new security adjustment policies and pushes them to the corresponding security components in the cloud environment to execute policy changes and optimizations. It monitors the security status of the cloud environment in real time, analyzes security events and risk assessment results, and formulates updated security policies accordingly. These policies include, but are not limited to, firewall rule sets, intrusion detection system parameters, and access control lists. The security policy adjustment module first obtains key security event and risk assessment data from the data analysis module. This data is obtained through in-depth analysis of network, user behavior, and system log data. Using this information, the security policy adjustment module determines the current security threat level faced by the cloud environment through a predefined threat assessment algorithm. This algorithm can be expressed as: Threat_Level = f(Alert_Count, Risk_Assessment), where Alert_Count is the number of security event alerts triggered within a certain time period, and Risk_Assessment is based on the assessment results of the data analysis module. Based on the threat level assessed, the security policy adjustment module automatically generates and updates the corresponding security policy. This process involves retrieving the latest security policy tuning information from the policy database module and, combined with the current threat assessment results, generating a new security policy using the following algorithm: `Security_Policy = Generate_Policy(Threat_Level, Policy_Database)`. The generated policy selects the appropriate policy template based on the threat level: high threat, medium threat, or low threat level. The generated security policy is further refined into specific security parameters. The security policy adjustment module updates these parameters using the following algorithm: `Security_Parameters = ...`

[0008] The `Update_Parameters(Security_Policy)` method pushes these parameters to the corresponding security components in the cloud environment, executing policy changes and optimizations. This process ensures that the cloud environment's security policies can respond promptly to new security threats. The monitoring and continuous optimization system can continuously learn and optimize its security policies, improving its ability and accuracy in identifying new threats. Through this automated process, the security policy adjustment module not only improves the security of the cloud environment but also ensures the compliance and effectiveness of the policies.

[0009] The monitoring feedback module (Monitoring Feedback Module) is implemented in the following ways: Real-time data collection and monitoring: The Monitoring Feedback Module collects network traffic, user behavior, system logs, and security event response time data in real time. This data is captured by monitoring devices deployed at key network nodes and transmitted to the centralized system through a secure encrypted channel. Performance indicator monitoring: Key performance indicators monitored by the Monitoring Feedback Module include response time, packet loss rate, DDoS attack detection, unauthorized access attempts, abnormal traffic patterns, user behavior deviations, abnormal system logs, configuration changes, malware activity, and data leaks. Preset performance baselines: The data analysis module presets performance baselines, which define the expected behavior and performance indicators of the system under normal operating conditions. Comparative analysis: The Monitoring Feedback Module compares the real-time collected data with the preset performance baselines to evaluate the effectiveness of the current security strategy and system performance. Statistical methods and machine learning algorithms, along with anomaly detection models, are used to identify abnormal patterns in the data. Anomaly behavior generation: Once anomaly behavior is detected, the Monitoring Feedback Module generates detailed monitoring feedback results. These results include the type, timing, scope of impact, and possible causes of the anomaly behavior. Scenario simulation training involves sending monitoring feedback results back to the data analysis module for training. Utilizing historical security event data and real-time monitoring data, the data analysis module optimizes itself through machine learning models, improving the accuracy and efficiency of the data analysis model. Security policy adjustment suggestions are provided by the monitoring feedback module based on the analysis results of feedback data and abnormal behavior. These suggestions may include adjusting firewall rules, updating intrusion detection system parameters, and modifying access control lists. Implementation steps: Configure NetFlow on network devices, setting the appropriate version and specifying the data flow to the data acquisition device. The data acquisition module preprocesses the data flow, including data cleaning, deduplication, formatting, and feature extraction. Network traffic is monitored using traffic analysis tools, and unauthorized access and malicious behavior are captured by the intrusion detection system. User and entity behavior analysis technologies identify deviations in user behavior, and log management tools track anomalies in system logs. Anomaly detection algorithms are used to evaluate security performance indicators in real time and compare them with preset baselines to quickly identify potential abnormal behaviors and security threats. Once an anomaly is detected, detailed monitoring feedback results are generated, and immediate notifications and alerts are sent to system administrators through the user interface module and mobile terminals. The monitoring feedback results and security policy adjustment suggestions are provided to the security policy adjustment module, which automatically generates updated security policies based on this information. The module monitors the effectiveness of policy implementation and collects feedback for continuous policy optimization. Through these refined and automated processes, the monitoring feedback module not only achieves comprehensive monitoring and analysis of cloud environment security but also adapts to rapidly changing security threats and regulatory requirements, providing enterprises with an efficient, intelligent, and compliant cloud data security management solution.

[0010] The training data module is used to optimize and improve data analysis models through scenario simulation training using historical security data. The policy database module, connected to an external policy database device, provides security policy tuning suggestions for compliance checks of national security-related laws and regulations and disaster recovery drills. These two key components, ensuring high availability and scalability, support the storage and rapid retrieval of large-scale data. By regularly collecting and classifying data within the cloud environment, they optimize machine learning models; record detailed logs of security policy history, compliance operations, and disaster recovery operations, utilizing redundant storage and failover technologies to ensure data reliability; and provide powerful data retrieval capabilities to accelerate troubleshooting and security analysis, ensuring the efficiency and reliability of the entire system in data-driven security operations. Furthermore, they integrate with existing IT management tools and cloud service platforms via APIs to automate security management tasks and are easily scalable to adapt to different scales of cloud service needs.

[0011] The policy database module obtains security-related laws and regulations information through external connections and updates the security policy configuration file in real time.

[0012] The user interface module connects to the mobile terminal and provides an interactive interface for system administrators to display the system's security status, compliance information, and workflow for approving changes to security policies.

[0013] An automatic security policy adjustment system based on the same inventive concept includes one or more computer devices and one or more mobile terminals connected to the computer devices. The computer devices are connected to a policy database device on site, and the computer devices are required to be equipped with the full policy automatic adjustment device as described in claim 1.

[0014] The system also includes a data acquisition device connected to the data acquisition module, including a network sniffer and log analysis tool deployed and integrated on a cloud platform.

[0015] The system also includes a basic data management module and an auxiliary decision management module connected to the automatic security policy adjustment device.

[0016] The data management module is used to provide basic data services to the automatic adjustment device for data security policies; the auxiliary decision management module is used to acquire all data and generate the system's security adjustment policy.

[0017] This invention also provides an automatic adjustment method for data security policies based on artificial intelligence, including: collecting key data using a data acquisition module; generating security incident alerts and risk assessment results using a data analysis module; formulating and updating security parameters using a security policy adjustment module; generating monitoring feedback results using a monitoring feedback module; optimizing the data analysis model using a training data module; and refreshing the security policy configuration file in real time using a policy database module.

[0018] In one embodiment, the present invention provides an AI-based automatic adjustment system for data security policies in a cloud environment. This system can monitor and analyze network traffic, user behavior and system log data in real time, and automatically adjust security policies to deal with potential security threats.

[0019] In one embodiment, the method further includes the following steps:

[0020] a. The data acquisition module obtains user access records, network traffic information, and system log data by connecting to the data acquisition device set up on site;

[0021] b. The data analysis module uses convolutional neural networks and recurrent neural networks to learn models and uncover potential security threats from complex network traffic and system logs;

[0022] c. The security policy adjustment module determines the level of security threats faced by the current cloud environment and automatically generates updated security policies;

[0023] d. The monitoring and feedback module collects real-time data related to cloud environment security to evaluate the effectiveness of current security strategies and system performance;

[0024] e. The user interface module allows administrators to access historical security events and log information, adjust system settings, and respond to security alerts.

[0025] In one embodiment, the system further includes a basic data management module and an auxiliary decision management module connected to the security policy automatic adjustment device, wherein:

[0026] a. The basic data management module provides basic data services to the automatic data security policy adjustment device;

[0027] b. The auxiliary decision management module acquires data from all modules and produces a security adjustment strategy for the system.

[0028] The beneficial effects of this invention are that by real-time monitoring and automatic adjustment of security strategies, it improves the data security management capabilities of cloud services, ensures the stable operation of the power system and the security of data, and takes into account regulatory compliance, providing power companies with an efficient and automated data security solution. Attached image description:

[0029] Figure 1 This is a diagram illustrating the operation of the system in this invention patent.

[0030] Figure 2 This is a diagram showing the operation of the device after the system of this invention is applied to it. Detailed implementation method:

[0031] To make the objectives, technical solutions, and advantages of the present invention clearer, the specific embodiments of the safety production control device, safety production control system, and safety production control method of the present invention will be described below with reference to the accompanying drawings. It should be understood that the specific embodiments described herein are merely illustrative of the present invention and are not intended to limit the present invention. The specific embodiments are as follows:

[0032] (I) Detailed Explanation of System Layout and Composition

[0033] like Figure 1 As shown, a dedicated computer room is configured in the core area of ​​the cloud platform to deploy the core components of the cloud environment data security policy automatic adjustment system. The internal layout of the computer room is as follows:

[0034] 1. Data acquisition device (10): Deployed at key nodes of the cloud network, responsible for capturing network traffic, user behavior and system log data in real time and transmitting them to the data processing center through a high-speed network interface.

[0035] 2. Data acquisition module (20): As the data input layer of the system, it receives data from the data acquisition device (10), performs preliminary cleaning, verification and formatting to ensure the quality and consistency of the data and provide standardized input for subsequent analysis.

[0036] 3. Control System Servers 1 and 2: These servers install the system server software and are responsible for business logic processing, data storage, and communication with the data acquisition module (20) and other modules. High-availability clustering technology is used between the servers to achieve hot standby, ensuring the stability and reliability of the system.

[0037] Implementing highly available cluster technology in a cloud environment typically involves a complex set of components and strategies to ensure continuous system operation and data consistency. Hardware and software load balancers, such as Nginx, intelligently distribute network traffic, reducing the load on individual servers and improving response speed. Meanwhile, the Keepalived heartbeat mechanism monitors server status in real time, automatically performing failover and switching services to backup servers to minimize service interruptions upon detecting a fault. For data synchronization, the cluster may employ shared storage solutions and the distributed file system GlusterFS to ensure data consistency across all servers. Furthermore, inter-server communication typically utilizes high-speed network technologies, such as InfiniBand, and the dedicated cluster communication protocol Corosync for fast and reliable data exchange. Fault detection is usually handled by the monitoring system Nagios, which monitors key server performance indicators in real time and issues alerts when indicators exceed preset thresholds. To shorten recovery time, automated scripts and tools like Ansiblet are used for rapid service recovery, while regular disaster recovery drills ensure rapid response capabilities in the event of real-world failures. The cluster's redundancy design includes backups for critical components such as network switches, power supplies, and storage systems, as well as a dual-active data center configuration to ensure seamless service failover in the event of a primary data center failure. Red Hat Cluster Suite, the cluster management software, provides a graphical interface and command-line tools for cluster configuration, monitoring, and management. Security measures, including encrypted inter-node communication and regular security updates, ensure cluster data security. Log management and auditing strategies, utilizing the ELK Stack, centrally collect and manage logs, recording critical operations and changes for easy problem tracking and analysis. Performance optimization strategies, using Redis as a caching layer, reduce direct access to the backend database, improving overall system performance. Finally, a comprehensive disaster recovery plan, including data backup, system imaging, rapid recovery strategies, and regular testing, ensures rapid business recovery in the face of unforeseen disasters.

[0038] Deployment within the control center:

[0039] 1. User Interface Module (80) Computer Workstation: Equipped with a high-performance graphics workstation, with client software installed, providing an intuitive user interface, enabling administrators to perform complex interactive operations, monitor security status in real time, view early warning information, and adjust policies.

[0040] 2. Mobile terminal (90): The administrator is equipped with a customized mobile terminal with mobile terminal APP software installed, which supports remote access to the system and realizes mobile approval of security policies and emergency response.

[0041] Each department office 1…N is configured with corresponding user interface modules (80) and mobile terminals (90) according to business needs to achieve customized security policy management, including personalized customization of security policies, allowing department administrators to define and implement security rules according to business characteristics; detailed permission management to ensure that only authorized users can access sensitive data; and customized interface layout, allowing users to adjust the interface according to workflow and preferences. Personalized dashboards display key performance indicators and real-time data, and mobile terminals support push notifications to ensure that administrators can respond to security incidents in a timely manner even remotely. The system also records the history of all security policy changes, provides easy-to-use audit log viewing functions, and supports multi-factor authentication to enhance security. The user interface and mobile terminals are designed to work across platforms, ensuring real-time data synchronization, and include built-in interactive help and documentation to support users in quick learning and use. Customized reporting and analysis functions support decision-making, while emergency response and disaster recovery processes ensure a rapid and consistent response in the face of security threats. These customized functions not only improve operational flexibility and convenience but also strengthen cross-departmental communication and collaboration, enhancing the security policy management and collaborative efficiency of the entire organization.

[0042] The key nodes are set as follows:

[0043] 1. Data Center Area: Deploy core data processing modules, including a data acquisition module (20), a monitoring feedback module (30), and a data analysis module (40), forming the brain of cloud environment security protection. The monitoring feedback module (30) is a real-time monitoring component in the cloud environment security protection system. It captures network traffic, user behavior, and system log data through devices deployed at key network nodes. Using advanced anomaly detection algorithms, it evaluates security performance indicators in real time and compares them with preset baselines to quickly identify potential abnormal behaviors and security threats. Once an anomaly is detected, it immediately generates detailed monitoring feedback results and sends instant notifications and alerts to system administrators through the user interface module (80) and mobile terminals (90) to ensure that response measures can be taken quickly. The data analysis module (40) is responsible for in-depth analysis of the data provided by the monitoring feedback module (30). Using the machine learning model CNN, it mines potential security threats and abnormal behavior patterns from a large amount of data. Through data preprocessing, feature extraction, and risk assessment, it generates detailed security reports that clearly indicate the nature, scope of impact, and possible sources of threats. The module can also provide customized security recommendations and policy optimization solutions based on the analysis results, helping system administrators improve the security and stability of the cloud environment. Through this data-driven analysis method, the data analysis module (40) provides powerful decision support for the security management of the cloud environment.

[0044] 2. Network Edge Nodes: Deploy auxiliary monitoring and data acquisition devices to enhance the comprehensiveness and real-time nature of data, thereby improving the breadth and depth of security monitoring. Typically deployed at the network perimeter, close to users and internet connection points, to enhance data comprehensiveness and real-time performance, thus improving the overall breadth and depth of network security monitoring. Network edge nodes may deploy various monitoring and data acquisition devices, including but not limited to intrusion detection systems / intrusion prevention systems (IDS / IPS), traffic analyzers, network sniffers, and firewalls. Key functions include: Traffic monitoring: monitoring network traffic, analyzing traffic patterns, and ensuring there is no abnormal traffic or potential denial-of-service (DDoS) attacks. Threat detection: using signature databases and anomaly detection technologies to identify and warn of potential network attacks and malicious behavior in real time. Packet capture: capturing packets passing through the network to provide raw data for in-depth analysis and post-incident investigation. Access control: implementing access control policies to ensure that only authorized traffic and users can access the internal network. Network edge nodes are typically located at the entry and exit points of the cloud environment and are the first point of contact between internal and external network traffic; they can detect and prevent external threats from entering the internal network in a timely manner; they are responsible for monitoring outbound traffic to identify potential data leaks and internal threats; and they work in conjunction with the monitoring feedback module (30) and data analysis module (40) of the core data center to achieve rapid response and effective defense against security threats.

[0045] (II) Data Acquisition and Monitoring Feedback Process

[0046] Step S1: The data acquisition device (10) configures NetFlow on the network device, sets the appropriate version, and specifies the data flow to the device (10). The device (10) captures the header information of data packets passing through the network device in real time, including source and destination IP addresses, port numbers, and protocol types, according to the rules defined by the security policy. This information is transmitted to the centralized system through a secure encrypted channel to ensure the security and integrity of the data during transmission. The device (10) also verifies the accuracy of the data using sequence numbers and timestamps, and balances data representativeness and system performance by setting the sampling rate. The captured NetFlow data is used for in-depth analysis to identify abnormal patterns and potential threats in network traffic, providing a real-time and accurate data foundation for the automatic adjustment system of data security policies in the cloud environment.

[0047] Step S2: The data acquisition module (20) performs a series of fine preprocessing operations on the data stream received by the data acquisition device (10). It removes invalid and erroneous data points through data cleaning algorithms, and corrects outliers caused by equipment failures and configuration errors. The deduplication algorithm ensures the uniqueness of each record and avoids duplicates in the dataset. The data formatting step converts the information into a uniform format, standardizes timestamps and IP address representations, makes the data consistent, and facilitates processing by analysis tools. Feature extraction technology identifies traffic size and connection frequency from the raw data, which are crucial for subsequent security analysis. Data normalization and transformation technology further optimizes the data to eliminate bias and identify periodic patterns. Data reduction technology reduces the size of the dataset while retaining important information and improving processing efficiency. If the data comes from multiple sources, the data acquisition module (20) will perform data integration to ensure data consistency and integrity. These preprocessing steps not only improve the quality of data analysis and enhance processing efficiency, but also optimize the performance of machine learning models, providing the data analysis module (40) with accurate, consistent data suitable for in-depth analysis.

[0048] Step S3: The monitoring feedback module (30) uses a series of advanced monitoring tools and technologies to conduct 24 / 7 security monitoring of the cloud platform, collecting and analyzing key security performance indicators in real time. These indicators include response time, packet loss rate, DDoS attack detection, unauthorized access attempts, abnormal traffic patterns, user behavior deviations, system log anomalies, configuration changes, malware activity, and data breaches. Network traffic is monitored using traffic analysis tools, unauthorized access and malicious behavior are captured by an intrusion detection system (IDS), user and entity behavior analysis (UEBA) technology is used to identify deviations in user behavior, and log management tools are used to track anomalies in system logs. Configuration changes and malware activity are also tracked in real time to quickly identify potential security threats. Data breach monitoring is achieved by analyzing data transmission and access patterns. All these monitoring activities are enhanced by automated scripts to ensure that alarms are triggered immediately when any anomalies are detected, and this key information is fed back to the data analysis module (40) in real time for in-depth analysis and appropriate security measures.

[0049] (III) Data Analysis and Security Strategy Adjustment Process

[0050] Step S4: The data analysis module (40) uses advanced machine learning algorithms, convolutional neural networks and recurrent neural networks, to perform in-depth analysis on the processed data and identify potential security threats and abnormal behavior patterns. The specific steps are as follows:

[0051] S401. Problem Definition and Data Collection: Determine the types of security threats the model needs to identify, including phishing attacks, intrusion attempts, and data breaches. Collect labeled data, including normal traffic and various types of anomalous traffic data.

[0052] S402. Data Preprocessing: Clean the data, removing incorrectly formatted and incomplete records. Perform normalization to convert traffic volume to kilobytes per second (KB / s). Perform feature engineering to extract timestamps, source and destination IPs, and protocol type features from the raw logs.

[0053] S403. Model Architecture Selection: For user behavior sequences, design an RNN model containing LSTM and GRU units to handle time dependencies.

[0054] S404. Training / Validation / Test Set Splitting: Divide the dataset into a training set (70%), a validation set (15%), and a test set (15%).

[0055] S405. Loss Function and Optimizer Configuration: For classification problems, use the cross-entropy loss function; for regression problems, use the mean squared error loss function. Select the Adam optimizer and set the initial learning rate to 0.001.

[0056] S406. Model Training: Train the model using the training set data, recording the loss value and accuracy. Implement early stopping, i.e., stop training when performance on the validation set no longer improves to avoid overfitting.

[0057] S407 Hyperparameter Tuning: Test different learning rates, batch sizes, number of convolutional kernels, and number of hidden layer neurons on the validation set.

[0058] S408. Regularization and Optimization: Apply dropout regularization to the CNN by adding a dropout layer after the fully connected layer, with a ratio of 0.5. Apply L2 regularization to the RNN, setting the regularization coefficient to 0.01.

[0059] S409. Model Evaluation: Evaluate model performance on the test set using confusion matrix, ROC curve, and AUC value metrics.

[0060] S4010. Model Fine-tuning: Based on the test results, fine-tune the model architecture and hyperparameters, increase the depth of convolutional layers, and adjust the number of LSTM units.

[0061] S411. Model Deployment: Deploy the trained model to the production environment and integrate it into the data analysis process for real-time threat detection.

[0062] S412. Continuous monitoring and model updates: Monitor the performance of the model in actual operation, collect new data, and retrain the model regularly to adapt to emerging threat patterns.

[0063] Through these specific steps, the data analysis module (40) is able to train a machine learning model that can accurately identify potential security threats in the cloud environment, and maintain its efficient threat detection capabilities through continuous monitoring and updates.

[0064] Step S5: The security policy adjustment module (60) dynamically adjusts the security policy based on the insights provided by the data analysis module (40), and updates the firewall rule set (FRS), intrusion detection system parameters (IPSP), and access control list (ACL) in real time to cope with the ever-changing security threats.

[0065] (iv) Training and Strategy Optimization Process

[0066] Step S6: The training data module (50) uses historical security event data to continuously train and optimize the data analysis module (40) to improve its ability and accuracy in identifying emerging threats.

[0067] Step S7: The policy database module (70) synchronizes the latest security-related laws, regulations and policy documents in real time, and provides compliance support and policy optimization suggestions to the security policy adjustment module (60) through intelligent association and analysis.

[0068] (V) User Interface Display and Mobile Terminal Linkage Process

[0069] Step S8: The user interface module (80) dynamically displays a security situation map of the cloud environment through a high-resolution display screen, including information on the distribution of security events, risk assessment and trend prediction, to provide decision support for administrators.

[0070] Step S9: The administrator seamlessly connects with the user interface module (80) via a secure wireless network using a mobile terminal (90) and receives push notifications for security policy adjustments through a dedicated application. After logging in through a strong authentication mechanism, the administrator can view a real-time updated security posture map, including information on security event distribution, risk assessment, and trend prediction. In emergencies, the mobile terminal (90) supports push notifications to ensure that the administrator can respond promptly, remotely isolate infected areas, and update firewall rules. In addition, the administrator can access audit logs, track security policy changes and user activities, remotely configure security settings, submit feedback, and generate security event reports. This allows the administrator to maintain real-time monitoring and control of the cloud environment security regardless of location, improving response speed and processing efficiency.

[0071] (vi) Decision Support and Basic Data Service Process

[0072] Step S10: As Figure 1 As shown, the basic data module (100) serves as the data support layer of the system, providing comprehensive basic data services, including device status, user behavior patterns, and security event records, providing a solid data foundation for data analysis and decision-making.

[0073] Step S11: The decision support module (110) plays a crucial role by comprehensively analyzing data from different modules in the cloud environment and using decision trees and random forests to provide administrators with precise security policy adjustment suggestions. This module first integrates and cleans data collected from the data acquisition module (20), monitoring feedback module (30), and data analysis module (40), and then extracts key features through feature engineering to prepare for model training. Next, the data is divided into training and testing sets. The decision support module (110) uses this data to train decision tree and random forest models, which can identify patterns in the data and predict potential security threats. Decision trees recursively classify data through a series of logical judgments, ultimately making decisions at the leaf nodes, while random forests improve overall accuracy and robustness by constructing multiple decision trees and integrating their prediction results. After model training is complete, the decision support module (110) evaluates model performance to ensure it can effectively identify security threats and abnormal behaviors. Based on the model's output, the module generates a series of security policy adjustment suggestions, adjusting network monitoring thresholds, updating access control rules, and modifying parameters of the intrusion detection system. These recommendations are evaluated using risk assessment algorithms to determine their potential impact on the overall security posture. Before implementation, the effectiveness of the proposed security policy adjustments is assessed using simulation technology to ensure that they do not negatively impact the existing system. Then, the administrator receives these recommendations and, based on their experience and the current security posture, conducts manual review and makes necessary adjustments. After approval, the recommendations are transformed into specific security policies and implemented in the cloud environment through an automated system and user interface module (80). After implementation, the decision support module (110) continues to monitor the effectiveness of the policy adjustments and uses the feedback information cyclically for further optimization of the model, forming a closed loop of continuous improvement. In this way, the decision support module (110) not only improves the scientific nature and accuracy of security policy adjustments but also enhances the administrator's responsiveness and decision-making efficiency in complex security environments.

[0074] (VII) Abnormal Handling and Emergency Response Procedures

[0075] Step S12: Once the monitoring feedback module (30) detects abnormal behavior or security events, the system will automatically trigger the emergency response plan generation process. First, it will quickly assess the nature and severity of the current threat through intelligent analysis. The specific content of the emergency response plan covers multiple strategies, including immediate isolation measures to isolate the infected system from the network and prevent the threat from spreading; at the same time, it will activate a notification mechanism to quickly notify administrators and relevant personnel through multiple channels. The plan also includes rapidly developed response strategies, such as adjusting monitoring settings, changing access permissions, and updating firewall rules. These measures can be executed automatically to reduce reliance on manual intervention. In addition, the plan also involves coordinating the incident response team, ensuring legal compliance, protecting critical data, backup and recovery plans, and communication strategies with stakeholders. After execution, the system will record all activities, conduct follow-up assessments, and continuously improve the plan based on feedback. Through this series of closely coordinated measures, organizations can ensure a rapid and effective response to security threats and reduce potential damage.

[0076] Step S13: The security policy adjustment module (60) adjusts the security policy quickly according to the emergency plan, enables the backup firewall rule set, and isolates the infected network area to curb the spread of the threat.

[0077] Step S14: The user interface module (80) and the mobile terminal (90) display emergency response information in real time, provide clear operation guidelines and steps, guide administrators and operators to take corresponding measures, and minimize the impact of safety incidents.

[0078] Through this series of refined and automated processes, the cloud environment data security policy automatic adjustment system can not only achieve comprehensive monitoring, analysis, adjustment and optimization of cloud environment security, but also adapt to rapidly changing security threats and regulatory requirements, providing enterprises with an efficient, intelligent and compliant cloud data security management solution.

[0079] The foregoing has shown and described the basic principles, main features, and advantages of the present invention. Those skilled in the art should understand that the present invention is not limited to the above embodiments. The embodiments and descriptions in the specification are merely preferred examples and are not intended to limit the invention. Various changes and modifications can be made to the invention without departing from its spirit and scope, and all such changes and modifications fall within the scope of the present invention as claimed. The scope of protection of the present invention is defined by the appended claims and their equivalents.

Claims

1. A system for automatic adjustment of data security policy for cloud environment, characterized in that, The device comprises a data acquisition module, a data analysis module, a security policy adjustment module, a monitoring feedback module, a training data module, a policy database module and a user interface module, wherein: the data acquisition module, as the perception layer of the system, collects user access records, network traffic information and system log data from the cloud environment in real time through the data acquisition device connected in the field, and provides raw data input for the data analysis module, the security policy adjustment module and the monitoring feedback module (monitoring feedback module); the data analysis module, as the cognitive layer of the system, is used for combining the user access records, network traffic information and system log data provided by the data acquisition module with the risk knowledge base for risk classification, presetting the security performance baseline of the system, and generating security event alarm and risk assessment result once an anomaly is found; the security policy adjustment module, as the execution layer of the system, obtains the security event alarm and risk assessment result from the data analysis module, formulates updated firewall rule set, intrusion detection system parameter and access control list, generates system security policy adjustment information, and simultaneously generates new security adjustment strategy according to the security policy optimization information output by the policy database module, and pushes the new security adjustment strategy to the corresponding security components in the cloud environment to perform policy change and optimization; the monitoring feedback module is used for comparing the network traffic, user behavior, system log and security event response time index obtained in real time with the preset performance baseline from the data analysis module, and generating monitoring feedback result back to the data analysis module once an abnormal behavior is found, and the data analysis module feeds back the new risk in the monitoring feedback result to the training data module for scene simulation training, and optimizes the data analysis model; simultaneously, the security policy adjustment module updates the firewall rule and access control list according to the monitoring feedback result returned by the monitoring feedback module (monitoring feedback module), and regenerates the security policy adjustment information; the training data module is used for simulating the scene of the user behavior data, security attack behavior and potential security risk information provided by the monitoring feedback module to the data analysis module, and optimizing and improving the data analysis model; the policy database module is used for obtaining the newly promulgated security-related laws, regulations, policy documents, major system disaster recovery plans, backup data and system operation log information through the externally connected policy database device, and associating with the policy database, refreshing the security policy configuration file in the database in real time, and outputting the security policy optimization information; the user interface module provides an interactive interface for the system administrator, displays the security posture and compliance information of the system, and approves the modification of the security policy change workflow.

2. The system of claim 1, wherein, The computer adjusts the security policy through the security policy automatic adjustment device and the security policy adjustment information of the policy database device, and sends the system security policy adjustment information to the mobile terminal; the mobile terminal receives and displays the system security policy adjustment information.

3. The system of claim 1, wherein, The system comprises a data collection device connected with the data collection module, including a network sniffer and a log analysis tool deployed and integrated on a cloud platform, used for real-time monitoring and intercepting original network data packets and operation logs flowing through the node, data filtering and formatting through preset data rules, generating user access records, network traffic information and system log data, and transmitting to the data analysis module.

4. The system of claim 1, wherein, The system comprises a basic data management module and an auxiliary decision management module connected with the security policy automatic adjustment device.

5. The system of claim 1, wherein, The data management module is used to provide basic data services to the data security policy automatic adjustment device; the auxiliary decision management module is used to obtain all data of the data collection module, the data analysis module, the security policy adjustment module, the monitoring feedback module, the training data module, the policy database module and the user interface module in the data security policy automatic adjustment device, and produce a security adjustment policy of the system according to the obtained data.

Images