Firewall dynamic policy adaptation method and system based on big data

Abstract

The application discloses a kind of based on big data's firewall dynamic strategy adaptation method and system, comprising: collecting the multi-source heterogeneous data in network, and real-time construction dynamic network entity graph;Using the preset time series graph attention network model, the time series of the graph is processed, the behavior fingerprint vector of the behavior state of entity is obtained, and the risk score of entity is calculated;When risk score exceeds risk threshold, automatically generate temporary security policy for controlling entity access behavior;And the life cycle of the temporary security policy is managed, and according to the change of entity risk state, it is automatically updated, renewed or cancelled.The application realizes the change from passive defense to active defense by constructing network entity behavior baseline and risk prediction, can automatically, accurately generate and manage security policy, effectively deal with advanced persistent threat and zero-day attack, and improves the adaptability and intelligent level of network defense.

Description

Technical Field

[0001] This invention belongs to the field of network security technology. Specifically, it relates to a method and system for automating and intelligently configuring and managing network firewall security policies using big data analysis and artificial intelligence prediction technologies. Background Technology

[0002] As the infrastructure for network perimeter security, the core function of a firewall is to detect and control network traffic according to preset security policies, thereby blocking unauthorized access and defending against potential network attacks. In the course of technological development, firewalls have evolved from early static packet filtering firewalls to stateful inspection firewalls, and now to the mainstream Next-Generation Firewall (NGFW) that integrates application-layer identification and intrusion prevention functions.

[0003] However, regardless of their enhanced functionality, the cornerstone of existing firewalls remains a set of static policy rules manually created and maintained by network administrators. Administrators need to formulate a series of "allow" or "deny" rules based on the network connection 5-tuple (source IP address, destination IP address, source port, destination port, protocol type) or other application-layer characteristics, according to their understanding of network topology, business needs, and known threats. This traditional defense model, reliant on human experience and static rules, has revealed inherent and insurmountable technical limitations when facing increasingly complex, dynamic, and intelligent advanced network threats.

[0004] First, existing firewall defense mechanisms suffer from significant lag. For new types of attacks, especially zero-day attacks or advanced persistent threats (APTs), their attack characteristics are unknown, making it impossible to formulate precise blocking rules in advance. Defenders typically can only extract attack signatures or behavioral characteristics and update firewall policies after the attack has occurred, caused some impact, and been captured by security devices or analyzed by security researchers. This entire process involves multiple stages, including detection, analysis, response, and deployment, resulting in a dangerous attack window between the initial appearance of the attack and its effective interception, leaving the network vulnerable for an extended period.

[0005] Secondly, existing firewall policy decisions suffer from weak context awareness. Decisions based on the five-tuple essentially judge the underlying technical attributes of network connections, lacking a comprehensive understanding of higher-dimensional contextual information such as the business logic behind the connection, user identity, device status, and historical behavior. This makes it unable to effectively identify malicious activities disguised as normal business traffic. For example, a legitimate internal account with stolen credentials initiating data outflow from a trusted device, conforming to the five-tuple rules, will be beyond the reach of traditional firewalls. This singular decision-making dimension directly leads to high false negative rates (failure to identify genuine threats) and high false positive rates (erroneously blocking normal business operations).

[0006] Secondly, the management of existing firewall policies is becoming increasingly complex and risky. With the expansion of enterprise networks and the continuous increase in business applications, the number of firewall policies is exploding. Over time, this inevitably leads to a large number of "zombie policies" that were not cleaned up due to service shutdowns, "shadow policies" that are overridden by higher-priority rules and never take effect, and "redundant policies" with overlapping functions. These chaotic policies not only reduce the firewall's packet processing performance, but more seriously, they greatly increase the difficulty of policy auditing and changes. When adjusting policies, administrators find it difficult to accurately assess the potential chain reactions of changes, and are highly susceptible to introducing new security vulnerabilities due to configuration errors, creating a dilemma where the more policies there are, the greater the risk.

[0007] To address these issues, the industry has explored various approaches. For example, Chinese invention patent CN108418801A discloses a firewall policy optimization method based on big data analysis, which primarily adjusts the policy order to optimize performance by analyzing the policy hit rate in firewall logs. Another example is Chinese invention patent CN109413020B, which discloses a method for configuring policies based on network session information, aiming to generate policies according to actual traffic conditions. However, these existing solutions still have limitations: they are essentially "post-hoc optimizations" or passive adaptations to existing policies or known traffic. Their data analysis sources are relatively singular, mainly limited to logs generated by the firewall itself, lacking the ability to fuse and analyze multi-source heterogeneous data. Furthermore, the techniques employed are mostly statistical or traditional machine learning, which struggles to capture deep-seated temporal dependencies and entity correlations in complex attack behaviors. Therefore, they all fail to predict potential threats and cannot fundamentally solve the problem of defense lag.

[0008] Furthermore, even when existing technologies contain concepts related to automated policy management, their mechanisms are typically isolated and rigid. For example, some solutions might propose setting a fixed time-to-live (TTL) for temporary policies, automatically revoking them upon expiration. This mechanism is essentially a "blind," one-way time-triggered mechanism. It cannot perceive real-time changes in threat status, leading to two serious technical flaws: first, if the threat is eliminated within the TTL, the zombie policy will continue to exist, unnecessarily blocking normal business access; second, if the threat persists after the TTL expires, the sudden invalidation of the policy will expose the network to risk again, resulting in a lack of continuity in defense. The root cause of these flaws is that the policy management mechanism and threat detection mechanism are separate and non-linked, lacking an input source that can provide real-time, continuous, and quantitative feedback on risk status. Therefore, there is still an urgent need in the field for a truly adaptive defense technology that can deeply couple advanced risk prediction capabilities with policy lifecycle management.

[0009] Therefore, there is an urgent need in this field for a new firewall policy adaptation technology that can break through the limitations of static rules, integrate multi-dimensional data for in-depth analysis, and achieve threat prediction and proactive defense. Summary of the Invention

[0010] The technical problem to be solved by this invention is to overcome the shortcomings of existing firewall policy configuration technologies, such as defense lag, weak context awareness, and complex management.

[0011] To address the aforementioned technical problems, one aspect of the present invention provides a method for dynamic firewall policy adaptation based on big data. This method first collects multi-source heterogeneous data from the network. To comprehensively and three-dimensionally depict network activity, this multi-source heterogeneous data includes at least network traffic logs, authentication logs, and terminal activity logs. Subsequently, based on the collected multi-source heterogeneous data, a dynamic network entity graph is constructed in real time, with network entities as nodes and the interactions between these entities as edges. This step effectively connects isolated data points, forming a panoramic view of network activity with deep contextual relationships.

[0012] Next, the method utilizes a pre-defined temporal graph attention network model to process the time series of the dynamic network entity graph. This model can deeply analyze the interaction structure between entities and its changes over time, thereby outputting a behavioral fingerprint vector that accurately represents the current behavioral state of each monitored network entity. By calculating the deviation between this behavioral fingerprint vector and the entity's pre-stored behavioral baseline, the system can obtain a quantified risk score for the network entity. When the risk score of a network entity exceeds a preset risk threshold, it indicates that it may have potential attacks or abnormal behavior. At this time, the system will automatically generate one or more temporary security policies to control the access behavior of the network entity based on the network entity's risk score, the importance of the entity's own assets, and the potential attack intent determined by the system in conjunction with the attack knowledge base. Finally, in order to achieve adaptive defense and a clean policy set, the system will perform lifecycle management on all automatically generated temporary security policies. This lifecycle management is not a simple, fixed-duration timed task, but a dynamic closed-loop control process directly driven by the real-time risk score output by the prediction and quantification engine. This management includes continuous monitoring of the policy within its preset validity period, and the ability to automatically revoke, intelligently renew, or dynamically adjust the temporary policy based on real-time and continuous changes in the risk status of network entities, thus forming a rapid-response, self-regulating closed-loop control system.

[0013] In one specific implementation, the preset temporal graph attention network model structurally includes a graph attention layer and a temporal attention layer. Accordingly, the steps for processing the time series of a dynamic network entity graph using this model can be as follows: First, the dynamically evolving network entity graph is segmented according to a preset time window to form a sequence of graph snapshots; second, for each graph snapshot in the sequence, the graph attention layer is used to aggregate the feature information of each node within the snapshot and its neighboring nodes. This step effectively captures and generates node representations that characterize the spatial structural features of the network entity at the current time; finally, the sequence composed of these node representations is input into the temporal attention layer. Utilizing the powerful sequence information capture capability of the temporal attention layer, the system learns and understands the behavioral evolution patterns and long-term dependencies of the network entities in the time dimension, and ultimately outputs a behavioral fingerprint vector that comprehensively reflects the spatiotemporal characteristics.

[0014] Furthermore, to enhance the accuracy of risk identification, the collected multi-source heterogeneous data may also include external threat intelligence. After automatically generating a temporary security policy, the method may also include a deployment and verification step, in which the generated temporary security policy is distributed to one or more firewall execution points in the network through a preset network management interface, such as a RESTful API provided by a next-generation firewall vendor or the standard NETCONF protocol, and after distribution, the temporary security policy is verified to have been successfully deployed and taken effect by reading the status or rereading the configuration.

[0015] In an optional implementation, the lifecycle management of temporary security policies can be further refined. Specifically, the management steps may include: within the preset validity period of the temporary security policy, if the system continuously monitors that the risk score of the relevant network entity has fallen and stabilized below a preset security threshold, then the threat is determined to be eliminated, and the temporary security policy is proactively revoked in advance to restore normal business access as soon as possible. Simultaneously, if the system monitors that the risk score of the relevant network entity is still higher than the risk threshold when the preset validity period of the temporary security policy is about to expire, then the threat is determined to still exist, and the validity period of the temporary security policy is automatically renewed to ensure the continuity of defense.

[0016] In another optional implementation, the specific steps for automatically generating a temporary security policy may include: First, matching the reported network entity's risk score, identified potential attack intent, and other information with a pre-defined, administrator-configurable policy template library to find the most suitable policy template for the current risk scenario; then, filling the parameters reserved in the matched policy template with specific information related to the network entity in the alarm event, such as IP address, user account, and target port, and instantiating it in this way to generate a complete, specific, and executable temporary security policy.

[0017] To achieve the above method, another aspect of the present invention provides a firewall dynamic policy adaptation system based on big data. The system includes: a data fusion module, used to collect multi-source heterogeneous data from the network, wherein the multi-source heterogeneous data includes at least network traffic logs, identity authentication logs, and terminal activity logs; and based on the multi-source heterogeneous data, to construct in real time a dynamic network entity graph with network entities as nodes and the interaction behaviors between the network entities as edges; The prediction and quantization engine is used to process the time series of the dynamic network entity graph using a preset time series graph attention network model to obtain a behavioral fingerprint vector representing the current behavioral state of the network entity, and to calculate the risk score of the network entity based on the deviation between the behavioral fingerprint vector and the pre-stored behavioral baseline. The policy generation module is used to automatically generate a temporary security policy to control the access behavior of a network entity when the risk score of the network entity exceeds a preset risk threshold, based on the network entity's risk score, asset importance, and attack intent; and The lifecycle management module is used to manage the lifecycle of the temporary security policy. The lifecycle management includes monitoring the temporary security policy within its preset validity period and automatically performing update, renewal, or revocation operations on the temporary security policy based on changes in the risk status of the network entity.

[0018] Specifically, the preset temporal graph attention network model in the prediction and quantization engine structurally includes a graph attention layer and a temporal attention layer. This engine is specifically configured to: segment the dynamic network entity graph into a sequence of graph snapshots; process each graph snapshot using the graph attention layer to generate node representations characterizing spatial structural features; and input the node representation sequence into the temporal attention layer to capture temporal evolution patterns and ultimately output behavioral fingerprint vectors.

[0019] Furthermore, the data fusion module can also be configured to collect external threat intelligence to enrich the dimensions of data analysis. The system may also include a policy execution module, which is configured to receive temporary security policies generated by the policy generation module and distribute them to one or more firewall execution points for execution via a preset network management interface.

[0020] In one specific implementation, the lifecycle management module is specifically configured to: generate an instruction to prematurely revoke the policy when the risk is detected to have been eliminated during the validity period of the temporary security policy; and generate an instruction to automatically renew the policy when the risk is detected to continue as the validity period is about to end.

[0021] In another specific implementation, the policy generation module is specifically configured to: match the policy template library based on the specific information of the risk event, and instantiate and generate a specific temporary security policy by filling in parameters.

[0022] In summary, the core of this invention lies in constructing an automated, closed-loop network security defense system that integrates data fusion and intelligent response. First, it integrates multi-source heterogeneous data and constructs a dynamic network entity graph, providing a comprehensive and context-rich data foundation for deep behavioral analysis. Based on this, a temporal graph attention network model is specifically employed. This model can simultaneously and profoundly understand the behavioral patterns of network entities from both spatial and temporal dimensions, establishing accurate behavioral baselines and enabling predictive risk scoring of potential threats. When a high-risk event is predicted, the system can automatically generate a refined, lifecycle-based temporary security policy based on the severity and intent of the risk, and then distribute it to the firewall for execution. The entire process, from policy generation and deployment to final automatic cleanup, is managed in a closed loop, achieving real-time, intelligent, and adaptive adjustment of the firewall's defense posture.

[0023] Compared with the prior art, the present invention, through the above technical solution, can bring at least the following beneficial effects: First, this invention achieves a shift from passive defense to proactive prediction, significantly improving the timeliness of defense. Utilizing an advanced temporal graph attention network model for deep modeling and baseline learning of network behavior, this invention can predict potential threats by identifying subtle deviations in behavioral patterns before attacks cause substantial damage. This proactive risk perception capability allows defensive actions to be implemented much earlier, effectively compressing the attack window and fundamentally solving the problem of delayed defense in existing technologies.

[0024] Second, this invention makes decisions based on multi-dimensional context, significantly improving the accuracy of threat identification. By integrating heterogeneous data from multiple sources, such as network traffic, authentication, endpoint activity, and even external threat intelligence, and constructing a dynamic network entity graph, this invention allows security decisions to move beyond isolated network quintuple information and instead be based on a deep understanding of the complete interactive relationships between "user-device-application." This enables the system to effectively distinguish between advanced threats disguised as normal traffic and internal anomalous behavior, significantly reducing the false negative rate while avoiding false alarms caused by overly broad rules.

[0025] Third, this invention achieves automation, adaptability, and self-cleaning of policies, significantly reducing management complexity. It transforms security policies from static configuration items into agile response measures that dynamically change with risk. The innovative lifecycle management mechanism ensures that temporary policies can be generated on demand and expire when needed, guaranteeing rapid response to sudden threats and fundamentally preventing the formation of policy swamps through automated cleanup mechanisms, thus ensuring the long-term simplicity, efficiency, and maintainability of the firewall policy set. More importantly, this invention deeply couples the policy lifecycle with the real-time risk scoring output of the T-GAT model, constructing an integrated intelligent closed loop of "perception-response-verification." This mechanism enables defense actions to accurately match the actual duration of threats, avoiding defense interruptions due to premature policy expiration and preventing unnecessary impacts on business operations due to policy redundancy, achieving an optimal dynamic balance between security and business continuity. Attached Figure Description

[0026] To more clearly illustrate the technical solutions in the embodiments of the present invention or the prior art, the drawings used in the description of the embodiments or the prior art will be briefly introduced below. Obviously, the drawings described below are only some embodiments of the present invention. For those skilled in the art, other drawings can be obtained based on these drawings without creative effort.

[0027] Figure 1 This is a schematic diagram of the overall architecture of a firewall dynamic policy adaptation system based on big data, provided by an embodiment of the present invention.

[0028] Figure 2 This is a flowchart of a firewall dynamic policy adaptation method based on big data, provided by an embodiment of the present invention.

[0029] Figure 3 This is a schematic diagram of the internal structure of a temporal graph attention network (T-GAT) model provided according to an embodiment of the present invention.

[0030] Figure 4 This is a detailed schematic diagram of a dynamic strategy generation and lifecycle management process provided according to an embodiment of the present invention.

[0031] Figure 5 This is a schematic diagram of system deployment and data flow in a specific application scenario according to an embodiment of the present invention.

[0032] Figure 6 This is a time series diagram illustrating the evolution of a target entity's risk score over time in an attack scenario, according to an embodiment of the present invention.

[0033] Figure 7 This is a schematic diagram comparing the performance of the technical solution of the present invention and the prior art in multiple key performance dimensions according to an embodiment of the present invention. Detailed Implementation

[0034] The technical solutions of the embodiments of the present invention will be clearly and completely described below with reference to the accompanying drawings. Obviously, the described embodiments are only some embodiments of the present invention, and not all embodiments. All other embodiments obtained by those skilled in the art based on the embodiments of the present invention without creative effort are within the scope of protection of the present invention.

[0035] It should be noted that, in the description of this invention, unless otherwise explicitly specified and limited, the terms "installation," "connection," and "linking" should be interpreted broadly. For example, they can refer to a fixed connection, a detachable connection, or an integral connection; they can refer to a mechanical connection or an electrical connection; they can refer to a direct connection or an indirect connection through an intermediate medium; and they can refer to the internal connection of two components. Those skilled in the art can understand the specific meaning of the above terms in this invention according to the specific circumstances.

[0036] Example 1 This embodiment provides a firewall dynamic policy adaptation system based on big data. Please refer to [link / reference]. Figure 1 , Figure 1 This is a schematic diagram of the overall architecture of a big data-based firewall dynamic policy adaptation system according to an embodiment of the present invention. Logically, the system mainly consists of four cooperating core modules: a multi-source heterogeneous data fusion module 100, an attack intent prediction and risk quantification engine 200, a dynamic policy generation and lifecycle management module 300, and a policy execution and feedback module 400.

[0037] The multi-source heterogeneous data fusion module 100 serves as the data foundation and information hub of the entire system. Its function is to collect extensive data from various data sources across the entire network, transforming the raw, fragmented, and diverse data into high-quality, structured information suitable for subsequent intelligent analysis through a series of standardized processing flows. In a specific implementation, the input data sources for this module may include: network traffic data obtained through network splitters (TAPs) or switch mirror ports; NetFlow or sFlow logs generated by network devices (such as firewalls and routers); domain name resolution logs from DNS servers; user login and permission verification logs from identity authentication servers (such as Active Directory or LDAP); host process activity and file access logs reported by the Endpoint Detection and Response (EDR) system; and external commercial or open-source threat intelligence subscribed through API interfaces. This module performs real-time ETL (Extract, Transform, Load) processing on the collected data, including data format parsing, entity association and contextual information enrichment between multiple data sources, and data field standardization and unification. The final output of this module is a data structure in the form of a dynamically updated network entity graph, which is continuously fed to the attack intent prediction and risk quantification engine 200.

[0038] In one specific implementation, the module is internally designed as three closely cooperating hierarchical subsystems: a data acquisition layer 110, a data processing layer 120, and a data storage and association layer 130.

[0039] The data acquisition layer 110 is responsible for connecting with various data sources across the entire network to achieve broad-spectrum, seamless acquisition of security-related data. To ensure the depth and breadth of the analysis, this invention is designed to support the acquisition of, but is not limited to, the following key data sources: Network traffic data: This is obtained by monitoring mirrored ports (SPAN / RSPAN) on switches or using network splitters (TAPs) to acquire raw traffic packets (PCAP); or by receiving standardized flow logs exported from network devices such as routers, switches, and firewalls, such as NetFlow (v5 / v9), sFlow, and IPFIX. This type of data provides the underlying facts of network connectivity and forms the basis for building behavioral models.

[0040] Device log data: Logs from security devices such as firewalls, intrusion detection systems (IDS / IPS), web application firewalls (WAF), and proxy servers are collected in real time via standard Syslog protocols, SNMP traps, or vendor-specific APIs. These logs record critical information such as security events, policy violations, and access control.

[0041] Identity and Authentication Data: This data is integrated with enterprise identity and access management (IAM) systems, such as security logs from Microsoft Active Directory (AD) domain controllers, authentication logs from LDAP servers, and accounting logs from Radius servers. This type of data accurately maps network-layer IP addresses to real-world user identities, user groups, and device affiliations, making it crucial for context-aware analytics.

[0042] Host and endpoint data: High-value information such as process activity, file access, registry changes, and network connections on hosts are collected through endpoint detection and response (EDR) agents or host intrusion detection system (HIDS) agents deployed on servers and employee terminals. This provides a rich micro-perspective for identifying malicious behavior originating from endpoints.

[0043] External threat intelligence data: By subscribing to open or commercial threat intelligence platforms and utilizing STIX / TAXII protocols or API interfaces, we regularly obtain the latest malware signatures, botnet C&C server IP / domain lists, phishing website URLs, and high-risk vulnerability information (CVEs). This intelligence provides important external labels for identifying known threats.

[0044] The data processing layer 120 is the core of this invention for achieving high-performance, real-time data processing. It receives massive, heterogeneous raw data streams from the acquisition layer 110 and transforms them into structured, standardized data formats. In this embodiment, this layer adopts a mature industry-standard stream processing architecture, and its main components include: Message Queue: Apache Kafka is used as the distributed message queue. All raw data collected, regardless of its source or format, is first sent as messages to different Kafka Topics. Kafka's high throughput and persistence features smooth out peak and valley traffic, ensuring decoupling between data collection and processing rates, guaranteeing system stability and zero data loss.

[0045] Real-time ETL processing engine (ETL: Extract, Transform, Load): Employs Apache Spark Streaming or Apache Flink as the distributed stream processing engine. This engine subscribes to raw data topics in Kafka and performs a series of real-time ETL operations: Parsing: Write or configure a corresponding parser for each raw log format (such as Syslog, JSON, NetFlow binary format) to extract its unstructured or semi-structured text content into key-value pairs. For example, parse the timestamp, source IP, destination IP, port, protocol, and action (permit / deny) from a firewall log.

[0046] Enrichment: Enrich the parsed fields with context. For example, using the local GeoIP library, IP addresses can be enriched with their geographic location and ASN information; using the internal asset library, IP addresses can be associated with specific server names, business applications, and responsible persons; user login names can be associated with their departments and positions; and URLs can be associated with reputation ratings from external intelligence.

[0047] Normalization: Fields expressing the same meaning from logs from different vendors and of different types are standardized into a standard data model. For example, all fields representing "source IP address," regardless of their original names (src_ip, sourceAddress, or c_ip), are uniformly named source.ip. This ensures that the upper-level analysis model can process consistent and clean data.

[0048] Session reassembly: For discrete flow records like NetFlow, multiple flow records belonging to the same network session are aggregated into a complete session flow by setting a window period and a 5-tuple hash, and the statistical characteristics of the session, such as total traffic, duration, and number of packets, are calculated.

[0049] Once the structured data has been processed, it is sent to a new, processed Topic in Kafka, awaiting further storage and analysis.

[0050] The goal of the data storage and association layer 130 is to store and organize the processed data in a way that best reveals the complex relationships between entities. Traditional relational databases or document databases suffer from performance bottlenecks when expressing many-to-many, deeply hierarchical, and dynamically changing network relationships. Therefore, this embodiment innovatively employs a graph database, such as Neo4j or JanusGraph, as the core storage engine.

[0051] Graph Model Definition: First, define a graph model for the network world. Abstract the core entities in the network as nodes, such as: User, Device, IPAddress, Application, DomainName. Abstract the interactions between entities as edges with direction and attributes, such as: User -[:LOGS_INTO]->Device, Device -[:HAS_IP]->IPAddress, IPAddress -[:ACCESSES {port: 443, protocol: 'TCP'}]->Application.

[0052] Graph Construction: Every piece of structured data output from the data processing layer 120 is transformed in real-time into add, delete, and modify operations on the graph database. For example, an AD authentication log will create or update a User node and a Device node, and create an edge LOGS_INTO between them. The edge attributes can include information such as login time and login result. A firewall allow log will create an ACCESSES edge between the IPAddress nodes corresponding to the source and destination IPs.

[0053] The value of the dynamic graph: In this way, the present invention constructs a dynamically evolving, highly interconnected Network Entity Graph. This graph not only records "who did what," but more importantly, it intuitively reveals "who is related to whom," "what this relationship is like," and "how this relationship changes over time." This graph forms the basis for in-depth analysis by the Attack Intent Prediction and Risk Quantification Engine 200, enabling the effective tracking and identification of complex, multi-hop attack chains.

[0054] The Attack Intent Prediction and Risk Quantification Engine 200 is the core of the intelligent analysis system of this invention. Its main function is to receive real-time network entity graph data streams provided by module 100 and utilize its built-in innovative Temporal Graph Attention Network (T-GAT) model to perform deep learning and modeling of the behavioral patterns of key entities monitored in the network (e.g., servers carrying core business operations, administrator accounts with high privileges, critical applications processing sensitive data, etc.). During the initial learning phase of the system or the stable operation period of the network, this engine establishes a dynamic, multi-dimensional behavioral baseline for each key entity, representing its normal activity patterns. After the system enters the real-time monitoring phase, it continuously compares the current behavioral characteristics of entities with the established behavioral baseline, detecting subtle anomalies that may indicate attacks or abuse with extremely high sensitivity. Upon detecting abnormal behavior, the engine further combines the entity's asset importance level, the specific contextual information of the behavior (such as time and geographical location), and the mapping relationship with the built-in attack knowledge base (such as the MITRE ATT&CK framework) to quantify the potential risk of the abnormal behavior and make a preliminary judgment on the attacker's possible intent. The engine's output is a structured "high-risk alert" event with a clear risk level, target entity information, and relevant evidence chain, which is immediately pushed to the dynamic policy generation and lifecycle management module 300.

[0055] The Dynamic Policy Generation and Lifecycle Management module 300 is responsible for transforming the abstract risk assessments reported by the engine 200 into specific, executable defensive actions. In a specific implementation, this module maintains a policy template library that can be flexibly configured by the administrator. This library predefines standardized response actions for different risk scenarios (e.g., lateral movement between internal hosts, suspected data leakage, server port scanning, etc.). Examples of actions include micro-segmentation of the source host, blocking access to specific ports of a specific target, forcing multi-factor authentication for visitors, and real-time mirroring of suspicious traffic to a sandbox system for in-depth analysis. Upon receiving a high-risk alert, this module automatically selects and instantiates the most suitable policy template based on the alert's detailed information (risk level, attack intent, source / destination entities, etc.), thereby generating one or more temporary security policies with high priority and precise scope. A key function of this module is assigning a preset "lifecycle" (Time-to-Live, TTL) to each generated dynamic policy. The output of this module is policy configuration instructions that conform to the target firewall specifications, such as XML data that can be transmitted via the NETCONF protocol or JSON objects that can be transmitted via a RESTful API. These instructions are then sent to the policy enforcement and feedback module 400.

[0056] The policy execution and feedback module 400 is the execution terminal of the technical solution of this invention in the network. It is typically composed of one or more firewall devices actually deployed in the network (which can be physical hardware firewalls, virtual firewalls in a virtualized environment, or security groups on a cloud platform). This module is responsible for receiving policy configuration instructions from module 300 and dynamically loading them into its own policy engine, making them effective immediately, thereby enabling precise and real-time control of network traffic. While executing policy actions, this module also undertakes the responsibility of feedback. It sends a report back to module 300 on the execution status of the policy (e.g., whether the configuration was successfully issued, the number of times the policy was hit within a certain period of time), so as to achieve closed-loop monitoring of the effect of the response actions. In addition, the firewall logs generated by this module as the network device itself are also continuously collected by the multi-source heterogeneous data fusion module 100 and input into the system as new data sources. This process constitutes a key feedback loop for the entire system to dynamically learn, continuously optimize, and self-improve.

[0057] In summary, the system of this invention forms a complete closed loop of data-driven, intelligent decision-making, and automated response through the collaborative work of the four modules mentioned above. Through this functional architecture, this invention upgrades the traditional, passively responding static firewall into an intelligent network security system capable of proactively sensing threats, continuously learning and evolving, and adaptively adjusting its defensive posture.

[0058] Please see Figure 2 This diagram illustrates the workflow of a firewall dynamic policy adaptation method based on big data, according to an embodiment of the present invention. The method mainly includes the following steps: Step S210: Collect multi-source heterogeneous data and construct a dynamic network entity graph.

[0059] This step forms the data foundation for the method of this invention. To gain a comprehensive and multi-dimensional understanding of the network environment, the system first needs to continuously and in real-time collect data related to security analysis from multiple heterogeneous data sources within the network. In one specific implementation, the data collection objects include at least: network traffic logs reflecting the basic facts of network connections, such as raw data packets obtained by monitoring traffic mirroring on network links, or flow logs such as NetFlow and sFlow generated by network devices; authentication logs that associate network behavior with specific identities, such as records of successful and failed user logins from an enterprise's internal Active Directory domain controller or LDAP server; and terminal activity logs that provide a micro-level view of host internal behavior, such as records of host process creation, network connection initiation, and file operations reported by the EDR system. Optionally, to further enhance the ability to identify known threats, external threat intelligence can also be collected, such as malicious IP address databases and lists of known command and control (C&C) server domain names.

[0060] After collecting this raw data, it needs to undergo a series of processing steps to construct a dynamic network entity graph for analysis. Specifically, this process includes: first, real-time parsing of raw logs in different formats to extract structured key fields; second, enriching the extracted information with context, such as associating an IP address with its geographical location, ASN information, and the device name and service affiliation corresponding to that IP in the internal asset database; third, data normalization, unifying fields expressing the same semantics from different data sources into standard names and formats; and finally, loading the processed structured data into a graph database in real-time. In this graph database, various entities in the network, such as users, devices, IP addresses, applications, and domain names, are abstracted as nodes in the graph, while interactions between entities, such as users logging into devices and IP addresses accessing applications, are abstracted as edges with direction and attributes. By continuously transforming newly collected data into creation, update, or deletion operations on nodes and edges in the graph, the system constructs and maintains a network entity graph that dynamically reflects all network entities and their interactions.

[0061] Step S220: Use a time-series graph attention network model for behavior analysis and risk scoring.

[0062] After constructing the dynamic network entity graph, the process moves to the core step of risk prediction. Existing technologies often employ single-dimensional analysis methods when dealing with such problems. For example, they use recurrent neural networks (RNNs) or long short-term memory networks (LSTMs) to analyze the time-series logs of individual entities, but this ignores the complex interactions between entities; or they use static graph neural networks (GNNs) to analyze the network topology at a specific point in time, but this fails to capture the dynamic evolution of behavior. Step S220 of this invention is designed to overcome these limitations. Its core lies in utilizing a pre-defined, deeply optimized Temporal Graph Attention Network (T-GAT) model to model and score network behavior in a spatiotemporal fusion manner.

[0063] Please refer to it again. Figure 3 The figure illustrates the internal structure of the T-GAT model. In a preferred embodiment, the T-GAT model structurally includes at least one graph attention (GAT) layer 310 and one temporal attention layer 330. Its working mechanism aims to answer a core question: whether a network entity behaves correctly at the current moment depends not only on its own past behavior sequence, but also strongly on the state and history of other entities interacting with it at this moment.

[0064] The specific processing flow for this step is as follows: First, the system slices the continuously evolving dynamic network entity graph output from step S210 according to a preset time window (e.g., every 1 minute), forming a series of discrete graph snapshot sequences {G(tn), ..., G(t-1), G(t)}. This sequence is the input to the T-GAT model, providing the model with raw information in both time and space dimensions.

[0065] Subsequently, the model performs spatial feature aggregation on each graph snapshot G(τ) in the sequence. This task is accomplished by the Graph Attention (GAT) layer 310. The GAT layer is designed because, in a complex network topology, the influence of a node's neighbors on its own state varies. For example, for a server, normal access to the database and a scanning attempt from an unknown external IP should be given drastically different importance when defining its current security state. The GAT layer achieves this differentiated information aggregation by introducing a self-attention mechanism. Specifically, for any target node i in graph G(τ), the GAT layer computes an attention coefficient e_ij for it and each of its neighboring nodes j. This coefficient characterizes the importance of node j's feature information to node i. This coefficient can be computed using a shared, learnable attention function a, such as a single-layer feedforward neural network whose inputs are the feature vectors h_i and h_j of nodes i and j: e_ij = a(W h_i, W h_j), where W is a learnable linear transformation weight matrix. To facilitate coefficient comparison, GAT uses the Softmax function to normalize the attention coefficients of all neighbors of node i, obtaining the final attention weight α_ij. Then, the updated feature representation h_i' of node i is the result of a linear combination of the features of all its neighboring nodes based on the attention weight α_ij, further processed by a non-linear activation function σ (such as ELU): h_i'(τ) = σ(Σ_{j ∈ N_i} α_ij(τ) W h_j(τ)). Through one or more layers of GAT processing, the model can generate a node representation 320 for each node in the graph that deeply understands its local topological environment and aggregates important neighbor information, i.e., h_i(τ).

[0066] Next, the model needs to capture temporal patterns in these temporally continuous node representations {h_i(tn), ..., h_i(t-1), h_i(t)}. This task is accomplished by the temporal attention layer 330. The design philosophy of this layer is that the predictive value of an entity's historical behavior to its current state varies. For example, a user's normal actions yesterday during the day may be far less valuable in predicting their abnormal login behavior this morning than multiple failed login attempts five minutes ago. In a preferred implementation, this layer can adopt the Encoder structure from the Transformer model. This structure is also based on a self-attention mechanism, but operates on time series. It calculates the temporal attention weights between the representation of node i at the current time t and its representations at all historical times t'. This means the model can autonomously learn a long-term, dynamic temporal dependency, identifying periodic patterns (such as peak traffic hours during rush hour) and abrupt change patterns. After processing by the temporal attention layer, the node representations at different historical moments are weighted and summed according to their importance, ultimately outputting a high-dimensional "behavioral fingerprint" embedding vector 340, denoted as z_i(t), which contains both current spatial topology information and historical key behavioral patterns. This vector is the core output of the model, comprehensively depicting the spatiotemporal behavioral state of network entity i at time t in a highly condensed and abstract way.

[0067] The training process aims to teach the model how to generate behavioral fingerprints that effectively distinguish between "normal" and "abnormal" behavior. In a typical unsupervised or self-supervised learning scenario, the training phase utilizes a large amount of data collected during peacetime (i.e., without known attacks). The training objective can be to predict the future. For example, given a sequence of behavioral fingerprints of an entity over a past period {z_i(tn), ..., z_i(t-1)}, the model is tasked with predicting its behavioral fingerprint z_i(t) at the next time step t. The loss function can be defined as the distance between the predicted vector and the true vector (e.g., mean squared error). By repeatedly training on a large amount of normal data and minimizing this loss function, the T-GAT model is forced to learn the inherent patterns, periodicity, and correlations of normal network entity behavior. A well-trained model will have a small prediction error when faced with normal, predictable behavior; however, when an entity exhibits behavior deviating from its usual pattern (e.g., a server suddenly begins scanning), this behavior is unpredictable and has never been seen in the model's "experience," thus leading to a large prediction error.

[0068] Finally, during the real-time monitoring phase, the system transforms this prediction error, or similar reconstruction error, into a continuous anomaly score between 0 and 100. This score is further combined with the entity's asset importance level (e.g., an anomaly of a core database server is more concerning than an anomaly of a regular test machine) and the contextual information of the behavior (e.g., abnormal operations outside of working hours), resulting in a precise final, actionable risk score. It is precisely because the "behavioral fingerprint" provided by the T-GAT model deeply understands the spatiotemporal context that the method of this invention can so accurately distinguish between real, potential threats and benign business fluctuations, thus providing a solid and reliable foundation for subsequent strategic decisions.

[0069] Step S230: Assess the risks and generate a temporary security policy.

[0070] The system continuously monitors the risk scores of all critical network entities. In this step, the system determines whether a network entity's risk score exceeds a preset risk threshold. This threshold can be adjusted according to the enterprise's security policy, for example, set to 75 points (out of 100).

[0071] If an entity's risk score does not exceed the threshold, its behavior is considered acceptable, and the process returns to step S210 to continue data collection and monitoring. If the risk score exceeds the threshold, the system determines that a high-risk event has occurred and immediately triggers the policy generation process. Specifically, the system automatically matches the reported risk event details, such as the risk score and the potential attack intent determined by engine 200 (e.g., lateral movement, data theft), against a preset policy template library, selecting the most suitable response template for the current scenario. Subsequently, the system fills the template parameters with the specific entity information from the risk event (e.g., source IP, destination IP, user account), instantiating one or more specific, executable, and high-priority temporary security policies.

[0072] In one specific implementation, to achieve standardized and controllable responses, a policy template library that can be pre-configured and expanded by the administrator can be set up. This library stores a series of parameterized response plans, each template defining a risk scenario and its corresponding recommended defensive actions. A typical policy template includes the following fields: Template ID: A unique template identifier.

[0073] Trigger Condition: Defines the condition that must be met to activate this template. This can be a compound logical expression, such as: (Risk_Score>85) AND (ATT&CK_Tactic == 'LateralMovement'), or (Risk_Score>70) AND (Asset_Criticism== 'High').

[0074] Policy Parameters: Defines the variables that need to be dynamically populated from threat alert events when generating specific policies, such as...<Source_Entity> ,<Destination_Entity> ,<Destination_Port> , <protocol>wait.

[0075] Policy Action: Defines the specific operation to be performed at the policy enforcement point (firewall). This invention supports actions at various granularities, including but not limited to: DENY: Completely blocks network connections between specified entities.

[0076] REDIRECT_TO_MFA: Redirects the user's access request to the Multi-Factor Authentication (MFA) page for two-factor authentication.

[0077] RATE_LIMIT: Limits the connection rate from a specific entity to combat DDoS attacks or brute-force attacks.

[0078] MIRROR_TO_ANALYSIS: Mirrors suspicious traffic to a network splitter or sandbox system for deep packet inspection or malware behavior analysis without interrupting the original session.

[0079] ISOLATE: Places high-risk endpoints (by their IP address) into an isolated VLAN, restricting their access to specific repair servers.

[0080] Default TTL: Sets a default validity period for the policy generated based on this template, such as 7200 seconds (2 hours).

[0081] Upon receiving a threat alert event, the policy generation logic is triggered: 1. Alarm Event Analysis: The system first analyzes the incoming structured alarm events and extracts all key information, including risk score, source / destination entities (IP, user, device ID, etc.), affected applications or ports, and determined attack intent (ATT&CK mapping), etc.

[0082] 2. Template Matching: The system will match the parsed alarm information with the "trigger conditions" of all templates in the policy template library one by one. One or more templates may be matched. In this case, the system will select the optimal template based on preset priority rules (e.g., more specific trigger conditions take precedence over broader conditions).

[0083] 3. Policy Instantiation: After selecting a template, the system will populate the specific entity information from the alarm event into the template's "Policy Parameters". For example, if the alarm event is {Source_IP: '10.1.1.5', Destination_IP: '10.2.2.10', Destination_Port: 3306, Risk_Score: 90}, and it matches the DENY template for database scanning, then a specific policy rule will be instantiated: "Deny access from source IP 10.1.1.5 to destination IP 10.2.2.10 on TCP port 3306".

[0084] 4. Priority setting: To ensure that dynamically generated policies can cover and take precedence over any potentially lenient static policies (e.g., a rule that allows the entire network segment to access the database), this module assigns a very high priority to all generated dynamic policies (e.g., placing them at the top of the policy list).

[0085] 5. Formatted Output: Finally, the instantiated specific policy rules are formatted into corresponding configuration instructions according to the configuration specifications of the target firewall (policy enforcement module 400), such as an XML data block of the NETCONF protocol or a JSON object of a RESTful API.

[0086] Step S240: Deploy, manage, and eventually revoke the temporary security policy.

[0087] Please see Figure 4 This diagram illustrates the detailed process of dynamic policy generation and lifecycle management. After a temporary security policy is generated in step S230, it does not enter a simple linear "configure-wait-delete" process. Instead, it enters a highly intelligent lifecycle that is continuously and dynamically controlled by the real-time risk score output in step S220. The technical necessity of this mechanism lies in the fact that the T-GAT model can provide a continuous and quantitative risk score stream, making it possible to perform refined and adaptive closed-loop management of the policy's lifecycle.

[0088] First, in step S410, the system assigns an initial lifespan to the temporary policy, namely a preset time-to-live (TTL). For example, the TTL can be set to 2 hours. Here, the TTL is more often considered a "maximum tolerance time" or "checkpoint" rather than a hard termination time. Simultaneously, the policy is deployed to one or more firewall execution points via a preset network management interface.

[0089] Next, in step S420, the system continuously monitors the policy during its validity period. The monitoring mainly includes two aspects: first, the execution status of the policy, such as the number of hits; and second, the subsequent changes in the risk scores of the network entities managed by the policy. This monitoring not only records the number of hits, but more importantly, it continuously receives the latest risk scores for the managed entities from step S220.

[0090] Then, the process proceeds to the judgment stage in step S430. The system will determine whether the risk to the relevant entity has been eliminated. For example, if the risk score of the entity continues to fall below a preset security threshold (such as 30 points) within the validity period, the threat can be determined to be eliminated. If so, the process will directly jump to step S460 to prematurely execute the policy revocation, that is, to delete the temporary policy from the firewall.

[0091] If the risk is not eliminated, the process proceeds to step S440 to determine if the policy's validity period is about to expire. If the validity period has not expired, the process returns to step S420 to continue monitoring. If the validity period is about to expire, the process proceeds to step S450 to further determine if the risk still persists. For example, it determines whether the entity's risk score is still higher than the risk threshold that initially triggered the policy. If yes, it indicates that the threat still exists, and the process proceeds to step S440 to determine if the TTL is about to expire. If no, it returns to S420 to continue the monitoring loop. If yes, the process proceeds to the "risk persistence" judgment step in step S450. This step is the core of ensuring defense continuity, and it again relies on real-time risk scores. The system determines whether the entity's risk score is still higher than the risk threshold that initially triggered the policy. If the answer is "yes," it indicates that the threat is still active, and simple expiration and revocation will expose the network to risk again. Therefore, the system triggers intelligent renewal, resetting or extending the policy's TTL in step S455, and then returns to step S420 to continue monitoring. This is another key feature that distinguishes this invention from the prior art: it dynamically binds the detection capability of T-GAT with the validity period of the strategy, thus achieving seamless continuation of defense.

[0092] If, in step S450, it is determined that the risk is no longer persistent (e.g., the risk score has decreased but still has not reached the security threshold), or if, in step S430, the risk has not been eliminated and the validity period has ended normally, the process will eventually proceed to step S460 to perform the policy revocation operation and remove the temporary policy from the firewall. Ultimately, the process will only proceed to step S460 to perform the policy revocation after the risk has not been eliminated but is no longer persistent (e.g., the risk has significantly decreased but has not reached the security threshold) or after the risk has been eliminated.

[0093] Through the above steps, the method of the present invention forms an automated and intelligent closed-loop control process from risk prediction to response and handling, and then to strategy cleanup.

[0094] Example 2 This embodiment provides a big data-based dynamic policy adaptation system for firewalls. The system may physically or logically include one or more servers, storage devices, and network devices. At the software implementation level, the system includes a data fusion module, a prediction and quantification engine, a policy generation module, a lifecycle management module, and an optional policy execution module. These modules work together to achieve predictive awareness and automated response to network threats.

[0095] The primary responsibility of the data fusion module is to construct and maintain a comprehensive, real-time, and context-rich dynamic network entity graph, providing a high-quality data foundation for subsequent intelligent analysis. In a specific implementation, this data fusion module can be further divided into three sub-modules: a data acquisition sub-module, a data processing sub-module, and a graph construction sub-module.

[0096] The data acquisition submodule is responsible for interfacing with data sources across the entire network. It can integrate various data acquisition adapters, such as a Syslog receiver for receiving Syslog logs, a NetFlow collector for processing NetFlow / sFlow binary data, and an API client for pulling data from cloud platforms or threat intelligence sources via API interfaces. These adapters are configured to concurrently acquire data from multiple sources, including network traffic logs, authentication logs, endpoint activity logs, and optional external threat intelligence sources.

[0097] The data processing submodule receives the raw data stream from the acquisition submodule and performs real-time ETL processing on it. This submodule can be implemented based on a distributed stream processing framework, such as Apache Spark Streaming or Apache Flink. On top of this framework, a series of data processing logics are deployed, including parsers for resolving different log formats, context enrichers for enriching IP geolocation or asset information, and data normalizers for unifying fields from different data sources. Through the processing of this submodule, the raw, heterogeneous data is transformed into a structured, uniformly formatted data event stream.

[0098] The graph construction submodule is the core of the data fusion module. It subscribes to the data event stream output by the data processing submodule and is responsible for reflecting these events in real-time to a graph database, such as Neo4j or JanusGraph. This submodule maintains a graph model definition (Schema), which predefines the types of network entities (such as node types like User, Device, IP Address, etc.) and the types of interactions between them (such as edge types like LOGS_INTO, ACCESSES, etc.). Whenever a new data event is received, this submodule transforms it into atomic operation instructions (such as CREATE, MERGE, DELETE) on the graph database, thereby dynamically constructing and updating the dynamic network entity graph.

[0099] The core component of the prediction and quantization engine is a pre-built and offline-trained Temporal Graph Attention Network (T-GAT) model. This engine is configured to periodically or event-drivenly analyze the dynamic network entity graph to output a risk assessment of the network entity's behavior.

[0100] In a specific implementation, the prediction and quantization engine may contain the following functional units: The graph serialization unit is responsible for reading graph data from the graph database and organizing it into a graph snapshot sequence according to a preset time window (e.g., 1 minute).

[0101] The model inference unit is a runtime instance of the T-GAT model. This unit receives a sequence of graph snapshots output by the graph serialization unit and performs forward inference computation. Its internal graph attention layer first processes each graph snapshot, learning the importance of neighboring nodes through a self-attention mechanism and performing weighted aggregation to generate node representations that characterize spatial topological features. Subsequently, its temporal attention layer processes the sequence of these node representations, again learning the influence of historical behavior patterns on the current state through a self-attention mechanism, ultimately outputting a behavioral fingerprint vector that comprehensively reflects the spatiotemporal behavioral characteristics of the entity. This unit can be accelerated using a GPU to meet real-time requirements.

[0102] The anomaly scoring unit receives the behavioral fingerprint vector output by the model inference unit. This unit maintains a pre-stored behavioral baseline for each monitored entity. This baseline can be the cluster centers of the entity's normal behavioral fingerprint vectors generated during model training, a probability density function, or the normal pattern space of an autoencoder. The anomaly scoring unit generates a continuous anomaly score by calculating the deviation of the real-time behavioral fingerprint vector from this baseline.

[0103] The risk quantification unit builds upon the anomaly scoring system. It comprehensively considers the severity of the anomaly given by the anomaly scoring unit, the asset importance level of the entity obtained from the graph database, and the potential attack intent obtained by mapping the current anomalous behavior pattern to the built-in ATT&CK attack framework. Finally, through a configurable weighted model or decision tree, it calculates a more comprehensive and instructive final risk score, which is then packaged into a high-risk alert event and output. For example: Risk_Score = w1 * Anomaly_Score + w2 * Asset_Value + w3 * Context_Factor, where w1, w2, and w3 are weighting coefficients, and Context_Factor is a contextual risk factor calculated based on time, location, and ATT&CK mapping.

[0104] In a preferred embodiment, the risk quantification unit, in addition to calculating the anomaly deviation based on the T-GAT model, also incorporates an attack pattern matching engine. This engine matches the behavioral feature vector (or its associated original log sequence) output by T-GAT with the behavioral feature rules in the ATT&CK knowledge base.

[0105] Specifically, although T-GAT identifies 'anomalies' through unsupervised learning, in order to determine the 'intent,' the system maps the underlying operation logs (such as specific port access, frequent login failures) within the time window that constitutes the anomaly to TTPs (tactics, techniques, and processes) in the ATT&CK matrix. For example, when a high anomaly score is detected when a large number of connections are initiated to port 445 of different internal network IPs within a short period of time, it is mapped to the 'lateral movement' tactic.

[0106] Ultimately, high-risk alert events include a quantitative 'risk score' (from T-GAT) and a qualitative 'attack intent' (from rule mapping), thereby supporting precise matching of policy templates.

[0107] The policy generation module is responsible for translating high-risk alerts into specific defensive actions. In a typical implementation, this module mainly consists of two parts: a policy template library and a policy instantiation engine.

[0108] The strategy template library is a database or configuration file that can be configured and managed by the administrator. It stores a series of strategy templates. Each template defines a mapping relationship between a type of risk scenario (trigger condition) and a set of response actions. The parameters in the template are reserved variables, waiting to be populated with specific information.

[0109] The policy instantiation engine is a rules engine. It subscribes to high-risk alert events published by the prediction and quantification engine. Whenever an alert is received, the engine parses the alert content and uses its information (such as risk score and attack intent) to match the triggering conditions in the policy template library. Once a match is successful, the engine extracts entity information from the alert (such as source / destination IP, user, etc.) and uses this information to populate the parameters in the template, thereby instantiating and generating a complete, executable temporary security policy. This policy is typically assigned a very high priority to ensure it can cover any potentially conflicting, more lenient existing static policies.

[0110] The lifecycle management module ensures the system's agility and self-cleaning capabilities, which is crucial for achieving adaptive defense. In one specific implementation, this module maintains an internal state table called a "dynamic policy inventory," recording all temporary security policies generated by the system and currently active, along with their metadata (such as associated entities, risk events, and time-to-live). This module operates through the following mechanisms: When the policy generation module generates a new temporary policy, it notifies the lifecycle management module. This module then registers the policy in the inventory and starts a corresponding countdown timer (TTL).

[0111] This module continuously obtains the latest risk scores of the entities involved in the strategies it manages from the prediction and quantification engine. It has built-in decision-making logic: if the risk of an entity drops below the safety threshold before the countdown ends, it immediately generates a revocation command and notifies the strategy execution module to delete the strategy, simultaneously removing it from the list. If the risk of an entity remains high just before the countdown ends, it resets the strategy's countdown, i.e., performs a "renewal" operation, and updates the TTL information in the list. If the countdown ends normally without triggering any of the above conditions, the module will also generate and send a revocation command.

[0112] This module connects to the prediction and quantization engine via shared memory or a high-speed message bus. It doesn't passively wait for the TTL to run out, but acts as an active decision-maker. It treats the risk score time series output by the T-GAT model as a feedback signal and the firewall policy's TTL as a control variable, forming a negative feedback loop. When the risk score is high, the TTL is increased to maintain control; when the risk score is low, the TTL is decreased until it reaches zero (cancellation), thus maximizing the utilization efficiency of defense resources.

[0113] The policy enforcement module is an optional integrated module, or it can be a firewall device provided by a third party that is separate from this system.

[0114] In an integrated implementation, this module provides a unified southbound interface layer. This layer encapsulates the details of interacting with firewalls of different brands and types (such as physical firewalls from Cisco, Palo Alto Networks, and Fortinet, or security groups in cloud environments). When it receives policy configuration commands (create, delete) from the policy generation module or lifecycle management module, this module translates these unified commands into vendor-specific API calls or configuration languages ​​(such as NETCONF), and pushes these configurations to one or more target firewall execution points through a secure management channel, thereby completing the deployment and revocation of policies. This module can also be responsible for reading back status information from the firewall to verify the success of the operation and providing feedback to other modules.

[0115] Through the precise construction and collaborative operation of the above modules, the system of this invention can fully realize all functions from data acquisition, risk prediction, strategy generation to closed-loop management.

[0116] Example 3 This embodiment aims to provide a specific deployment and application example of the big data-based firewall dynamic policy adaptation system disclosed in this invention in a typical enterprise data center network environment. This embodiment will detail the relevant technical requirements, hardware environment selection, key parameter settings, and policy configuration process. Through a simulated internal threat event, it will demonstrate the complete processing flow of this system and the excellent technical results achieved.

[0117] This embodiment is set in the production data center network of a medium-sized enterprise. This network environment has the following typical characteristics: Network partitioning: The network is divided into multiple security zones, such as the Web Services Zone (DMZ), Application Services Zone, Core Database Zone, and R&D Testing Zone. Access control between these zones is achieved through a core firewall.

[0118] Business Requirements: The developer servers in the R&D testing area need conditional access to certain databases in the core database area for data synchronization and testing. The existing firewall policy, for ease of management, has a relatively broad rule configured, allowing the entire R&D testing area network segment (10.10.20.0 / 24) to access the MySQL port (TCP / 3306) of the core database server (IP: 10.10.100.50).

[0119] Security Challenges: The company faces increasing internal threat risks, particularly concerned that if a server in the R&D testing zone is compromised by an external attacker, the attacker could use that server as a springboard to scan, probe, and attack the core database. Existing static firewall policies are unable to effectively identify and block such attacks originating from within the "trusted" zone.

[0120] Technical Requirements: A system needs to be deployed that can continuously monitor the access behavior of the R&D test server to the core database without changing the existing business processes; can automatically detect abnormal access patterns based on behavioral baselines (such as brute-force attacks and port scanning outside of working hours); and can automatically, temporarily, and accurately block the attack source after a threat is detected, and automatically restore access permissions after the threat is eliminated to avoid permanent impact on normal business operations.

[0121] To meet the above technical requirements, the system of this invention was deployed in the enterprise's network environment. Please refer to... Figure 5 This figure is a schematic diagram of system deployment and data flow in a specific application scenario of this embodiment.

[0122] Hardware Environment: The system's core computing modules—the data fusion module 100, the attack intent prediction and risk quantification engine 200, and the dynamic policy generation and lifecycle management module 300—are centrally deployed on a computing cluster consisting of three high-performance servers. Each server is configured with the following specifications: two 64-core CPUs, 512GB of memory, a 20TB NVMe SSD array, and dual 10 Gigabit Ethernet cards. This cluster provides ample computing resources for big data processing and deep learning model training and inference.

[0123] Data Acquisition: Port Mirroring (SPAN) is configured on the core switch of the data center to mirror all network traffic 510 between the R&D testing area and the core database area to a dedicated data acquisition node in the data fusion module 100 in real time. Simultaneously, firewall logs 520 from the core firewall (policy enforcement and feedback module 400) and user authentication logs 530 from the domain controller (Active Directory) are sent to the data fusion module 100 in real time via the Syslog protocol.

[0124] System Integration: The dynamic policy generation and lifecycle management module 300 establishes a secure API connection 540 with the core firewall 400 via a dedicated management network (e.g., using a RESTful API via HTTPS). Through this connection, the system can issue policy configuration commands and obtain feedback on policy execution status.

[0125] Specific reference Figure 5 In this embodiment of the invention, the deployment and data flow of the system form a complete information loop. At the business level, the development server (10.10.20.101) located in the R&D testing area initiates access to the database server (10.10.100.50) located in the core database area, and this access traffic must pass through the core switch.

[0126] The data acquisition process is as follows: First, the core switch, through port mirroring, sends the raw network traffic between the two zones as data stream 510 to the data fusion module 100 in the system cluster of this invention in real time. Simultaneously, the core firewall 400 and the Active Directory domain controller, as key nodes in the network, also push their generated firewall access logs and user authentication logs as data streams 520 and 530, respectively, to the data fusion module 100 in real time via protocols such as Syslog. Thus, module 100 completes the multi-dimensional acquisition of behavioral data.

[0127] The intelligent analysis and response process is as follows: After processing by module 100, the data flows within the system cluster to the prediction and quantification engine 200 for risk assessment. Once engine 200 detects high-risk behavior, it generates an alarm and notifies the dynamic policy generation and lifecycle management module 300. Module 300 then generates a temporary policy and, through the management network, distributes the policy configuration command as control flow 540 to the core firewall 400 via a secure API interface.

[0128] The feedback and closed-loop process is as follows: After the core firewall 400 executes the policy, its own logs (such as policy hit logs) will be continuously collected by module 100 as a new data source (part of data flow 520), realizing the monitoring of the response effect and forming a closed loop for system learning and optimization.

[0129] Before the system is officially launched, key parameters need to be set and configured: Model Training: The system first enters a two-week learning mode. During this period, the prediction and quantization engine 200 uses collected historical data to perform unsupervised training on the T-GAT model, establishing a behavioral baseline for accessing the core database for each server (identified by its IP address) in the R&D test area. This baseline includes not only statistical characteristics such as connection frequency and traffic volume, but more importantly, it learns the spatiotemporal patterns of its connection behavior.

[0130] Risk threshold setting: Based on the enterprise's security policy, the risk score threshold that triggers the policy generation is set to 75, and the security threshold for determining that the threat has been eliminated is set to 30.

[0131] Policy Template Configuration: In the policy generation module 300, configure a policy template targeting "database credential guessing attacks". The trigger condition for this template is set to Risk_Score>75 AND ATT&CK_Tactic == 'CredentialAccess'. Its response action is DENY, and the source IP, destination IP, and destination port of the policy are defined parameterized. The default time-to-live (TTL) of this template is set to 3600 seconds (1 hour).

[0132] After system configuration, it enters 24 / 7 continuous monitoring mode. Now, we simulate a scenario where at 3:05 AM on a certain Thursday, a development server (IP: 10.10.20.101) in the R&D test area begins a brute-force attack on the core database server (10.10.100.50) due to the implantation of a malicious script.

[0133] (1) Risk Detection and Scoring: After the malicious attack began, the development server initiated thousands of connection attempts to the database port 3306 within a short period. The data fusion module 100 captured these abnormal traffic and updated the network entity graph. The T-GAT model of the prediction and quantification engine 200 immediately detected the server's current behavioral fingerprint, which deviated significantly from its normal behavior baseline of almost no access during the early morning hours. The engine quickly improved the server's risk score from the daily single digits to 93.

[0134] (2) Automated response: Please refer to Figure 6 This figure illustrates the time-series evolution of the risk score of the target entity (server 10.10.20.101) over time in this attack scenario. At time T0 (3:05:00 AM), the attack began, and the risk score curve started to rise sharply. At time T1 (3:05:12 AM), the score exceeded the risk threshold of 75 points. At this point, the policy generation module 300 was activated, successfully matched the preset policy template, and generated a temporary security policy: "{priority: 1, source_ip: '10.10.20.101', destination_ip: '10.10.100.50', destination_port: 3306, action: 'deny', ttl: 3600}". This policy was immediately distributed to the core firewall 400 via API.

[0135] (3) Threat Containment and Policy Management: From time T1, attack traffic is completely blocked by the firewall. Over the following hour (3600 seconds), as the attack source is isolated, Engine 200 detects that the server's risk score begins to slowly decline. However, since it has not fallen below the security threshold of 30 by the end of its validity period (time T2), the lifecycle management module 300 automatically renews the policy. The server's risk score only finally returns to a normal level (after time T3) after the enterprise's security administrator, based on system alerts, investigates and removes malicious scripts. Once the score falls below the security threshold, the lifecycle management module will proactively revoke the temporary policy and restore normal access permissions. Please note... Figure 6 The processing logic at time T2 (the expiration / renewal time) is as follows: Although the preset one-hour period has elapsed, the system does not blindly renew. Instead, it rereads the risk score output by the T-GAT model at time T2. Since the attack has not completely stopped and the risk score is still above 75, this real-time output signal from the T-GAT model directly triggers the 'watchdog' mechanism of the lifecycle management module, forcibly resetting the policy's TTL countdown. This mechanism ensures that the defense policy will not disappear as long as T-GAT considers a threat to exist.

[0136] To more intuitively and objectively demonstrate the beneficial effects achieved by the technical solution of this invention, please refer to [link / reference needed]. Figure 7 . Figure 7 It is a set of composite charts that, through three independent sub-charts, provide a detailed data comparison of the effects of the technical solution of this invention and two existing technical solutions on three key performance dimensions.

[0137] Existing technical solution A: In this comparison, it represents the traditional baseline solution that relies solely on network administrators to manually configure and maintain static firewall policies.

[0138] Existing technical solution B: In this comparison, it represents an improved solution based on offline batch statistical analysis of firewall historical logs for macroscopic anomaly detection.

[0139] The technical solution of this invention is the dynamic policy adaptation scheme based on real-time data fusion and temporal graph attention network model, which is fully described in this embodiment.

[0140] Figure 7 The overall structure comprises three sub-graphs from left to right, corresponding to three evaluation dimensions: threat detection performance, threat response timeliness, and policy management overhead. son Figure 7 a (Left): Threat Detection Performance Comparison. This sub-figure uses a set of grouped bar charts to show the threat detection and false positives of three schemes when handling equal amounts of mixed network traffic (including known attacks, unknown attack variants, and normal service traffic). The vertical axis represents the standardized event count. As shown in the figure, the higher the number of "Detected Real Threats (TP)," the higher the recall and precision of the scheme; while the lower the number of "Generated False Positives (FP)," the smaller the impact of the scheme on normal services. It can be clearly observed from the figure that the blue bars of the present invention are the highest, indicating that it can detect the vast majority of real threats; at the same time, its green bars are the lowest of the three schemes, almost close to zero, which is due to its deep understanding of the spatiotemporal context of entity behavior, enabling it to accurately distinguish between attacks and benign anomalies. In contrast, Scheme A can hardly detect unknown threat variants, while Scheme B, although it has some detection capability, produces a high number of false positives due to the limitations of its analysis model.

[0141] son Figure 7 b (middle): Comparison of Mean Threat Response Time (MTTR). This sub-chart compares the average time, in minutes, required for three solutions to be contained by effective defense measures from the first appearance of a threat. The vertical axis represents time. As shown in the figure, the shorter the response time, the more agile the defense, and the greater the losses that can be recovered for the enterprise. The average response time of the technical solution of this invention is only in the minutes range, thanks to its near real-time risk prediction capabilities and fully automated strategy generation and deployment closed loop. Solution B, due to offline analysis, has a response time in the hours range. Solution A, on the other hand, relies entirely on manual discovery, assessment, and action, and has the longest response time, typically in the hours or even days range.

[0142] son Figure 7 c (Right side): Comparison of policy management overhead. This sub-chart uses a set of grouped bar charts to quantify and compare the overhead of the three solutions in policy management within a specific operation and maintenance cycle (e.g., one month). The vertical axis represents the number of times. "Monthly number of manual policy operations" reflects the frequency with which administrators need to manually intervene to add, delete, and modify policies. "Number of configuration errors caused" reflects the risk of security vulnerabilities introduced due to the complexity of manual operations. As shown in the figure, the technical solution of this invention shows significant advantages in both indicators, with minimal manual operation (limited to initial template fine-tuning) and almost no configuration errors. This is due to its high degree of automation and policy lifecycle management mechanism, which greatly liberates manpower and improves security. In contrast, solutions A and B both require a large amount of manual intervention and are accompanied by significant risks of configuration errors.

[0143] In summary, through the detailed description of this embodiment and the objective data comparison with existing technical solutions, it is fully and clearly demonstrated that the technical solution of this invention has a high degree of feasibility. In practical applications, it can achieve significant progress and beneficial effects far exceeding those of existing technologies in terms of the accuracy of threat detection, the agility of response, and the degree of automation of management.

[0144] In summary, the system of the present invention, through the close collaboration of the above modules, transforms the user's simple drag-and-drop operation on the graphical interface into a series of precise, automatic, and interconnected background configurations, ultimately achieving the rapid and reliable construction of a virtual-real combined target range environment.

[0145] In the above embodiments, implementation can be achieved, in whole or in part, through software, hardware, firmware, or any combination thereof. When implemented using software, it can be implemented, in whole or in part, as a computer program product. The computer program product includes one or more computer programs. When the computer program is loaded and executed on a computer, all or part of the processes or functions described in the embodiments of this disclosure are generated. The computer can be a general-purpose computer, a special-purpose computer, a computer network, or other programmable device. The computer program can be stored in a computer-readable storage medium or transferred from one computer-readable storage medium to another. For example, the computer program can be transferred from one website, computer, server, or data center to another via wired (e.g., coaxial cable, fiber optic, digital subscriber line (DSL)) or wireless (e.g., infrared, wireless, microwave, etc.) means. The computer-readable storage medium can be any available medium accessible to a computer or a data storage device such as a server or data center that integrates one or more available media. The available media may be magnetic media (e.g., floppy disks, hard disks, magnetic tapes), optical media (e.g., high-density digital video discs (DVDs)), or semiconductor media (e.g., solid-state disks (SSDs)).

[0146] Those skilled in the art will understand that the various numerical designations such as "first," "second," etc., used in this disclosure are merely for the convenience of description and are not intended to limit the scope of the embodiments of this disclosure, nor do they indicate the order of events.

[0147] At least one in this disclosure can also be described as one or more, and multiple can be two, three, four or more, and this disclosure does not impose any limitation. In the embodiments of this disclosure, for a technical feature, the technical features in that technical feature are distinguished by "first", "second", "third", "A", "B", "C" and "D", etc., and there is no sequential order or size order among the technical features described by "first", "second", "third", "A", "B", "C" and "D".

[0148] The correspondences shown in the tables of this disclosure can be configured or predefined. The values ​​of the information in each table are merely examples and can be configured to other values; this disclosure is not limiting. When configuring the correspondences between information and parameters, it is not necessarily required to configure all the correspondences shown in each table. For example, the correspondences shown in some rows of the tables in this disclosure may not be configured. Furthermore, appropriate modifications and adjustments can be made based on the above tables, such as splitting, merging, etc. The names of the parameters shown in the headers of the above tables can also use other names that the communication device can understand, and the values ​​or representations of the parameters can also use other values ​​or representations that the communication device can understand. In the implementation of the above tables, other data structures can also be used, such as arrays, queues, containers, stacks, linear lists, pointers, linked lists, trees, graphs, structures, classes, heaps, hash tables, or hash tables, etc.

[0149] The predefined terms in this disclosure can be understood as defined, pre-defined, stored, pre-stored, pre-negotiated, pre-configured, solidified, or pre-burned. Those skilled in the art will recognize that the units and algorithm steps of the various examples described in conjunction with the embodiments disclosed herein can be implemented in electronic hardware, or a combination of computer software and electronic hardware. Whether these functions are implemented in hardware or software depends on the specific application and design constraints of the technical solution. Those skilled in the art can use different methods to implement the described functions for each specific application, but such implementation should not be considered beyond the scope of this disclosure.

[0150] Those skilled in the art will understand that, for the sake of convenience and brevity, the specific working processes of the systems, devices, and units described above can be referred to the corresponding processes in the foregoing method embodiments, and will not be repeated here.

[0151] The above description is merely a specific embodiment of this disclosure, but the scope of protection of this disclosure is not limited thereto. Any variations or substitutions that can be easily conceived by those skilled in the art within the scope of the technology disclosed in this disclosure should be included within the scope of protection of this disclosure. Therefore, the scope of protection of this disclosure should be determined by the scope of the claims.< / protocol>

Claims

1. A method for dynamic policy adaptation of firewalls based on big data, characterized in that, Includes the following steps: Collect multi-source heterogeneous data from the network, wherein the multi-source heterogeneous data includes at least network traffic logs, identity authentication logs, and terminal activity logs; Based on the multi-source heterogeneous data, a dynamic network entity graph is constructed in real time, with network entities as nodes and the interaction behaviors between the network entities as edges. Using a pre-defined temporal graph attention network model, the time series of the dynamic network entity graph is processed to obtain a behavioral fingerprint vector representing the current behavioral state of the network entity. Based on the deviation between the behavioral fingerprint vector and the pre-stored behavioral baseline, the risk score of the network entity is calculated. When the risk score of the network entity exceeds a preset risk threshold, a temporary security policy for controlling the access behavior of the network entity is automatically generated based on the risk score, asset importance, and attack intent of the network entity. as well as The lifecycle of the temporary security policy is managed, including monitoring the temporary security policy within its preset validity period and automatically updating, renewing, or revoking the temporary security policy based on changes in the risk status of the network entity. If, during the preset validity period of the temporary security policy, the risk score of the network entity is detected to be continuously lower than the preset security threshold, the temporary security policy will be revoked in advance. If, when the preset validity period of the temporary security policy is about to expire, the risk score of the network entity is still detected to be higher than the risk threshold, the validity period of the temporary security policy is automatically renewed. Furthermore, the risk score time series output by the time-series graph attention network model is regarded as a feedback signal, and the validity period (TTL) of the temporary security policy is regarded as a control variable, forming a negative feedback adjustment loop. When the risk score is still higher than the risk threshold, the validity period (TTL) is increased to maintain control. When the risk score continues to be lower than the security threshold, the validity period (TTL) is decreased until it reaches zero and the temporary security policy is revoked.

2. The method according to claim 1, characterized in that, The preset temporal graph attention network model includes a graph attention layer and a temporal attention layer; The step of processing the time series of the dynamic network entity graph using a preset time-series graph attention network model specifically includes: The dynamic network entity graph is divided into a snapshot sequence according to a preset time window; For each graph snapshot, the feature information of neighboring nodes within the graph snapshot is aggregated using the graph attention layer to generate a node representation characterizing the spatial structural features of the network entities; and The sequence of node representations is input into the temporal attention layer, which captures the behavioral evolution pattern of the network entity in the time dimension to output the behavioral fingerprint vector.

3. The method according to claim 1, characterized in that, The multi-source heterogeneous data also includes external threat intelligence; Following the step of automatically generating temporary security policies, the method further includes: The temporary security policy is distributed to one or more firewall execution points through a preset network management interface, and the deployment of the temporary security policy is verified.

4. The method according to claim 1, characterized in that, The step of automatically generating a temporary security policy specifically includes: Based on the risk score of the network entity and the identified attack intent, a policy template is matched from a preset policy template library; and Information related to the network entity is populated into the parameters of the policy template to instantiate and generate the temporary security policy.

5. A firewall dynamic policy adaptation system based on big data, characterized in that, include: The data fusion module is used to collect multi-source heterogeneous data in the network, which includes at least network traffic logs, identity authentication logs, and terminal activity logs. Based on the multi-source heterogeneous data, a dynamic network entity graph is constructed in real time, with network entities as nodes and the interaction behaviors between the network entities as edges. The prediction and quantization engine is used to process the time series of the dynamic network entity graph using a preset time series graph attention network model to obtain a behavioral fingerprint vector representing the current behavioral state of the network entity, and to calculate the risk score of the network entity based on the deviation between the behavioral fingerprint vector and the pre-stored behavioral baseline. The policy generation module is used to automatically generate a temporary security policy for controlling the access behavior of the network entity when the risk score of the network entity exceeds a preset risk threshold, based on the risk score, asset importance, and attack intent of the network entity. as well as The lifecycle management module is used to manage the lifecycle of the temporary security policy. The lifecycle management includes monitoring the temporary security policy within its preset validity period and automatically performing update, renewal, or revocation operations on the temporary security policy based on changes in the risk status of the network entity. The lifecycle management module is connected to the prediction and quantization engine via shared memory or a high-speed message bus to continuously acquire the latest risk scores of the network entities involved in the temporary security policy. During the preset validity period of the temporary security policy, when the risk score of the network entity is continuously lower than a preset security threshold, an instruction is generated to prematurely revoke the temporary security policy. When the preset validity period of the temporary security policy is about to end, and the risk score of the network entity is still higher than the risk threshold, an instruction is generated to automatically renew the temporary security policy. Furthermore, the risk score time series output by the time-series graph attention network model is considered as a feedback signal, and the TTL (Time To Live) of the temporary security policy is considered as a control variable, forming a negative feedback adjustment loop. When the risk score is still higher than the risk threshold, the TTL is increased to maintain control; when the risk score is continuously lower than the security threshold, the TTL is decreased until it reaches zero and the temporary security policy is revoked.

6. The system according to claim 5, characterized in that, The preset temporal graph attention network model in the prediction and quantization engine includes a graph attention layer and a temporal attention layer; The prediction and quantization engine is specifically used for: The dynamic network entity graph is divided into a snapshot sequence according to a preset time window; For each graph snapshot, the feature information of neighboring nodes within the graph snapshot is aggregated using the graph attention layer to generate a node representation that characterizes the spatial structure features of the network entity. as well as The sequence of node representations is input into the temporal attention layer, which captures the behavioral evolution pattern of the network entity in the time dimension to output the behavioral fingerprint vector.

Images