Network isolation method, nonvolatile storage medium and computer equipment

Abstract

The invention discloses a network isolation method, a nonvolatile storage medium and computer equipment. The method comprises the following steps: obtaining respective state detection results of a plurality of networks in a target network security system; based on the respective state detection results of the plurality of networks, determining a first abnormal network which is attacked in the plurality of networks; determining a target isolation strategy between the first abnormal network and other networks based on the attack type and the attack intensity of the attack on the first abnormal network, the target isolation strategy comprises the steps of adding an isolation executor used for executing isolation between the first abnormal network and other networks, stopping a running initial isolation executor and starting a target isolation executor or adjusting the running resource utilization rate of the first abnormal network; and based on the target isolation strategy, executing isolation between the first abnormal network and other networks. According to the invention, the technical problems of low resource utilization rate and incapability of coping with complex and changeable scenes in the current static isolation technology are solved.

Description

Technical Field

[0001] This invention relates to the field of network security, and more specifically, to a network isolation method, a non-volatile storage medium, and a computer device. Background Technology

[0002] Traditional cybersecurity competition platforms, such as CTF (Capture the Flag) competition platforms, largely rely on virtualization or network isolation technologies to provide participants with independent tracks, forming multiple independent competition networks. However, with the continuous evolution of cybersecurity threats, these platforms have revealed limitations in handling multi-track scenarios, such as parallel competition and penetration testing in areas like the internet, connected vehicles, drones, and cloud services. Specifically, the static isolation strategies of traditional platforms, based on fixed virtualization environments or network segments, are inefficient in resource allocation and load management, making it difficult to adapt to the complex changes in multi-track competitions.

[0003] There is currently no effective solution to the above problems. Summary of the Invention

[0004] This invention provides a network isolation method, a non-volatile storage medium, and a computer device to at least address the technical problems of low resource utilization and inability to cope with complex and ever-changing scenarios in current static isolation technologies.

[0005] According to one aspect of the present invention, a network isolation method is provided, comprising: acquiring state detection results of multiple networks in a target network security system, wherein the multiple networks are isolated from each other; determining a first abnormal network among the multiple networks that has been attacked based on the state detection results of the multiple networks; determining a target isolation strategy between the first abnormal network and other networks based on the attack type and attack intensity of the attack on the first abnormal network, wherein the other networks are networks other than the first abnormal network among the multiple networks, and the target isolation strategy includes: adding an isolation execution entity for performing isolation between the first abnormal network and other networks, stopping the running initial isolation execution entity and starting the target isolation execution entity, or adjusting the operating resource utilization rate of the first abnormal network, wherein the operating resource utilization rate is the share of the operating resources of the first abnormal network in the total operating resources; and performing isolation between the first abnormal network and other networks based on the target isolation strategy.

[0006] Optionally, the target isolation strategy includes adding an isolation execution unit to perform isolation between the first abnormal network and other networks, stopping the running initial isolation execution unit and starting the target isolation execution unit, or the target isolation strategy includes adding an isolation execution unit to perform isolation between the first abnormal network and other networks and adjusting the operating resource utilization of the first abnormal network, or the target isolation strategy includes stopping the running initial isolation execution unit and starting the target isolation execution unit and adjusting the operating resource utilization of the first abnormal network.

[0007] Optionally, determining the target isolation strategy between the first abnormal network and other networks based on the attack type and attack intensity of the attack on the first abnormal network further includes: determining multiple initial isolation strategies between the first abnormal network and other networks based on the attack type and attack intensity of the attack on the first abnormal network; calculating the reward value of each of the multiple initial isolation strategies based on a preset reward function, wherein the reward function is used to characterize the defense performance of the initial isolation strategy against the attack; and determining the target isolation strategy among the multiple initial isolation strategies based on the reward values ​​of each of the multiple initial isolation strategies.

[0008] Optionally, based on a preset reward function, the reward values ​​of each of the multiple initial isolation strategies are calculated. The reward function is used to characterize the defensive performance of the initial isolation strategy against attacks, including: determining the resource utilization rate of the first abnormal network, the success rate of the first abnormal network being attacked, and the latency time of the first abnormal network affected by the attack after executing multiple initial isolation strategies; and weighting and summing the resource utilization rate of the first abnormal network, the success rate of the first abnormal network being attacked, and the latency time of the first abnormal network affected by the attack after executing multiple initial isolation strategies to obtain the reward value of each of the multiple initial isolation strategies.

[0009] Optionally, based on the reward values ​​of each of the multiple initial isolation strategies, a target isolation strategy is determined among the multiple initial isolation strategies, including: comparing the reward values ​​of each of the multiple initial isolation strategies; and selecting the initial isolation strategy with the largest reward value among the multiple initial isolation strategies as the target isolation strategy.

[0010] Optionally, after identifying the first abnormal network among multiple networks, the state detection results of each of the other networks are obtained again; based on the state detection results of each of the other networks, the second abnormal network that has been attacked is identified among the other networks, wherein the second abnormal network is a network that has a business relationship with the first abnormal network, and the attack on the second abnormal network is a cross-domain attack based on the first abnormal network; based on the attack type and attack intensity of the cross-domain attack, a defense strategy is determined in a preset rule base, wherein the defense strategy includes an execution switching strategy and / or a runtime resource adjustment strategy; based on the defense strategy, the second abnormal network is adjusted.

[0011] Optionally, the attack behavior against the first abnormal network is evaluated based on the defense success rate of the first abnormal network, the complexity of the vulnerabilities exploited by the first abnormal network, and the number of networks affected by the attack on the first abnormal network, and an evaluation result is obtained.

[0012] According to another aspect of the present invention, a non-volatile storage medium is also provided, the non-volatile storage medium including a stored program, wherein, when the program is running, it controls the device where the non-volatile storage medium is located to execute any of the above-described network isolation methods.

[0013] According to another aspect of the present invention, a computer device is also provided, the computer device including a processor for running a program, wherein the program executes any of the network isolation methods described above during runtime.

[0014] According to another aspect of the present invention, a computer program product is also provided, including a computer program that, when executed by a processor, implements any of the network isolation methods described above.

[0015] In this embodiment of the invention, a network isolation method is employed. This involves acquiring the state detection results of multiple networks within a target network security system, where these networks are isolated from each other. Based on the state detection results of each network, a first abnormal network under attack is identified. Based on the attack type and intensity of the attack on the first abnormal network, a target isolation strategy is determined between the first abnormal network and other networks. These other networks are those excluding the first abnormal network. The target isolation strategy includes: adding an isolation execution entity to perform isolation between the first abnormal network and other networks; stopping the currently running initial isolation execution entity and starting the target isolation execution entity; or adjusting the operational resource utilization rate of the first abnormal network, where operational resource utilization is the share of the first abnormal network's operational resources in the total operational resources. Based on the target isolation strategy, isolation between the first abnormal network and other networks is executed, achieving the goal of dynamically adjusting the isolation strategy between networks. This improves the efficiency, adaptability, and security of the network security system, thereby solving the technical problems of low resource utilization and inability to cope with complex and changing scenarios inherent in current static isolation technologies. Attached Figure Description

[0016] The accompanying drawings, which are included to provide a further understanding of the invention and form part of this application, illustrate exemplary embodiments of the invention and, together with their description, serve to explain the invention and do not constitute an undue limitation thereof. In the drawings:

[0017] Figure 1A hardware structure block diagram of a computer terminal for implementing a network isolation method is shown.

[0018] Figure 2 This is a flowchart illustrating a network isolation method provided according to an embodiment of the present invention;

[0019] Figure 3 This is a structural block diagram of a network isolation system provided according to an optional embodiment of the present invention. Detailed Implementation

[0020] To enable those skilled in the art to better understand the present invention, the technical solutions of the present invention will be clearly and completely described below with reference to the accompanying drawings of the embodiments of the present invention. Obviously, the described embodiments are only some embodiments of the present invention, and not all embodiments. Based on the embodiments of the present invention, all other embodiments obtained by those skilled in the art without creative effort should fall within the scope of protection of the present invention.

[0021] It should be noted that the terms "first," "second," etc., in the specification, claims, and accompanying drawings of this invention are used to distinguish similar objects and are not necessarily used to describe a specific order or sequence. It should be understood that such data can be interchanged where appropriate so that the embodiments of the invention described herein can be implemented in orders other than those illustrated or described herein. Furthermore, the terms "comprising" and "having," and any variations thereof, are intended to cover a non-exclusive inclusion; for example, a process, method, system, product, or apparatus that comprises a series of steps or units is not necessarily limited to those steps or units explicitly listed, but may include other steps or units not explicitly listed or inherent to such processes, methods, products, or apparatus.

[0022] According to an embodiment of the present invention, a network isolation method embodiment is provided. It should be noted that the steps shown in the flowchart in the accompanying drawings can be executed in a computer system such as a set of computer-executable instructions. Furthermore, although a logical order is shown in the flowchart, in some cases, the steps shown or described may be executed in a different order than that shown here.

[0023] The method embodiment provided in Embodiment 1 of this application can be executed on a mobile terminal, computer terminal, or similar computing device. Figure 1 A hardware block diagram of a computer terminal for implementing a network isolation method is shown. Figure 1As shown, the computer terminal 10 may include one or more processors (shown as 102a, 102b, ..., 102n in the figure) (the processor may include, but is not limited to, a microprocessor MCU or a programmable logic device FPGA, etc.) and a memory 104 for storing data. In addition, it may also include: a display, an input / output interface (I / O interface), a universal serial bus (USB) port (which may be included as one of the ports of a BUS bus), a network interface, a power supply, and / or a camera. Those skilled in the art will understand that... Figure 1 The structure shown is for illustrative purposes only and does not limit the structure of the aforementioned electronic device. For example, computer terminal 10 may also include... Figure 1 The more or fewer components shown, or having the same Figure 1 The different configurations shown.

[0024] It should be noted that the aforementioned one or more processors and / or other data processing circuits are generally referred to herein as "data processing circuits". These data processing circuits may be embodied, in whole or in part, in software, hardware, firmware, or any other combination thereof. Furthermore, the data processing circuits may be a single, independent processing module, or may be integrated, in whole or in part, into any other element within the computer terminal 10. As involved in the embodiments of this application, the data processing circuits serve as a processor control mechanism (e.g., selection of a variable resistor termination path connected to an interface).

[0025] The memory 104 can be used to store software programs and modules of application software, such as the program instruction / data storage device corresponding to the network isolation method in this embodiment of the invention. The processor executes various functional applications and data processing by running the software programs and modules stored in the memory 104, thereby realizing the network isolation method of the application described above. The memory 104 may include high-speed random access memory, and may also include non-volatile memory, such as one or more magnetic storage devices, flash memory, or other non-volatile solid-state memory. In some instances, the memory 104 may further include memory remotely located relative to the processor, and these remote memories can be connected to the computer terminal 10 via a network. Examples of the above-mentioned networks include, but are not limited to, the Internet, corporate intranets, local area networks, mobile communication networks, and combinations thereof.

[0026] The display can be, for example, a touchscreen liquid crystal display (LCD) that allows the user to interact with the user interface of the computer terminal 10.

[0027] Figure 2 This is a flowchart illustrating the network isolation method provided according to an embodiment of the present invention, as shown below. Figure 2 As shown, the method includes the following steps:

[0028] Step S201: Obtain the status detection results of multiple networks in the target network security system, wherein the multiple networks are isolated from each other.

[0029] In this step, in this embodiment, the target network security system can refer to a network security competition platform. Therefore, multiple networks can be multiple tracks for contestants to compete in. For each track, a state detection mechanism can be deployed. This mechanism can monitor various key indicators in the network in real time, including but not limited to: resource usage, such as the utilization rate of resources such as CPU, memory, bandwidth, and storage; security events, i.e., whether attack behaviors have been detected, such as DDoS (Distributed Denial of Service) attacks, SQL (Structured Query Language) injection, lateral movement, etc.

[0030] Step S202: Based on the state detection results of each of the multiple networks, determine the first abnormal network among the multiple networks that has been attacked.

[0031] In this step, the anomaly detection algorithm can be triggered immediately when any indicator deviates from the normal range or pattern. This algorithm can be based on statistical analysis to identify and classify abnormal behavior. For example, it can analyze collected real-time data to identify deviations from normal behavior patterns; or it can judge the suddenness and pattern changes of anomalies by comparing the differences between current and historical data. When the state detection mechanism detects abnormal behavior in a network, it can mark it as the first abnormal network under attack. For example, if traffic in the cloud service sector suddenly surges, exceeding the normal business range by several times, accompanied by a large number of requests from abnormal IPs in the same geographical location, and resource monitoring shows a sharp increase in CPU and bandwidth utilization, exceeding pre-set thresholds, and checking system logs reveals a large number of abnormal login attempts, further confirming the possibility of an attack, then based on the detection and analysis results, the cloud service sector is marked as the first abnormal network.

[0032] Step S203: Based on the attack type and attack intensity of the first abnormal network, determine the target isolation strategy between the first abnormal network and other networks. The other networks are networks other than the first abnormal network among multiple networks. The target isolation strategy includes: adding an isolation execution entity to perform isolation between the first abnormal network and other networks, stopping the running initial isolation execution entity and starting the target isolation execution entity, or adjusting the operating resource utilization rate of the first abnormal network. The operating resource utilization rate is the share of the operating resources of the first abnormal network in the total operating resources.

[0033] In this step, the network status is first monitored in real time using a dynamic isolation engine and a collaborative attack and defense controller, leveraging a state detection mechanism. Once abnormal behavior is detected, it is analyzed to determine the specific attack type (e.g., DDoS, SQL injection, common-mode injection) and attack intensity (low, medium, high). Based on the identified attack type and intensity, the isolation strategy between the first abnormal network and other networks is dynamically adjusted. Adjustments to the isolation method can include two aspects: adjustments to the isolation execution entity and adjustments to running resources. When facing high load or high attack intensity (e.g., large-scale DDoS attacks), if the number of backup execution entities is sufficient (e.g., if there are 3 running execution entities and at least 2 backup execution entities to meet the requirement of an odd number of execution entities), the number of execution entities used to implement the isolation strategy can be increased. If the execution entity currently responsible for isolating the first abnormal network (i.e., the initial isolation execution entity) is attacked or its performance degrades, that execution entity can be stopped, and a new target execution entity can be started. The target execution entity may be a predefined backup execution entity or an execution entity specifically configured according to the current attack type to provide more effective isolation and protection. It can also dynamically adjust the utilization of the first abnormal network's operating resources, including the allocation of critical resources such as CPU, memory, and network bandwidth. For example, when the first abnormal network suffers a high-intensity attack, its CPU resource allocation can be increased to ensure the normal operation of critical services; conversely, when the attack weakens, resource allocation can be reduced to avoid resource waste.

[0034] In adjusting the isolated executors, multiple isolated executors in the first abnormal network are initially selected and configured during the system configuration phase. Specifically, the required hardware architecture (e.g., x86, ARM, RISC-V) and operating system (e.g., Linux, Windows, RTOS) are first identified based on the service type of the track (i.e., the network). For example, the vehicle-to-everything (V2X) track can select an ARM architecture and an embedded Linux system to support the CAN (Controller Area Network) bus protocol. Then, at least three heterogeneous executors can be assigned to each track to provide redundancy and support mimicry defense mechanisms. For example, the V2X track can be configured with three ARM executors running embedded Linux, supporting the CAN protocol stack; the cloud service track can be configured with three x86 executors running Windows Server, supporting virtualization; and the drone track can be configured with three RISC-V executors running an RTOS, optimized for low-power real-time tasks.

[0035] These isolated executors run on different hardware architectures and operating systems, forming heterogeneous redundancy. In the mimicry defense strategy, each executor independently runs the same service or application, but its internal structure may differ. This way, even if one executor is attacked, the others can continue to provide isolation support, maintaining system availability and security. Upon detecting abnormal behavior or suspected attack in a certain track (i.e., the first abnormal network), one or more backup executors can be selected from the multiple isolated executors in the current network for switching, or simply additional running isolated executors can be added to enhance system security and maintain service continuity. This process involves assessing the status of existing executors and selecting the most suitable backup executor to respond to the attack.

[0036] Furthermore, when an execution switch is selected, the service of the first abnormal network is switched from the initial isolated execution entity to the target isolated execution entity. This process needs to be completed within 500 milliseconds to ensure uninterrupted service. Dynamic execution entity switching isolation technology can promptly prevent attacks from spreading across networks, protecting the system from cascading effects. Simultaneously, by leveraging the redundancy and diversity of heterogeneous execution entities, even if one execution entity is attacked, it can quickly switch to another to maintain stable system operation.

[0037] Step S204: Based on the target isolation strategy, perform isolation between the first abnormal network and other networks.

[0038] In this step, upon discovering that the first abnormal network has been attacked, the platform immediately analyzes the nature of the attack and generates a dynamic isolation strategy based on a pre-set reinforcement learning model. This strategy may involve adjusting the isolation execution unit or optimizing resource allocation through a resource scheduler to ensure efficient use of critical resources such as CPU and bandwidth. This helps to resist attacks and maintain system stability, thereby achieving effective isolation of the first abnormal network and protecting the competition environment from cascading effects.

[0039] Through the above steps, the goal of dynamically adjusting the isolation strategy between networks is achieved, thereby improving the efficiency, adaptability and security of the network security system. This solves the technical problems of low resource utilization and inability to cope with complex and ever-changing scenarios in the current static isolation technology.

[0040] As an optional embodiment, the target isolation strategy includes adding an isolation execution unit for performing isolation between the first abnormal network and other networks, stopping the running initial isolation execution unit and starting the target isolation execution unit, or the target isolation strategy includes adding an isolation execution unit for performing isolation between the first abnormal network and other networks and adjusting the operating resource utilization of the first abnormal network, or the target isolation strategy includes stopping the running initial isolation execution unit and starting the target isolation execution unit and adjusting the operating resource utilization of the first abnormal network.

[0041] Optionally, the target isolation strategy is a comprehensive response mechanism designed to achieve dynamic and efficient network isolation and resource optimization through multiple measures against attacks on the first anomalous network. The strategy not only includes adding isolation executors to isolate the first anomalous network from other networks, but may also involve stopping the currently running initial isolation executor, launching a new target isolation executor, and dynamically adjusting the resource utilization of the first anomalous network. These strategies are not used in isolation, but can be flexibly combined to form a composite defense effect based on the actual attack situation and network status. For example, when subjected to a complex lateral movement attack, the target isolation strategy may simultaneously add isolation executors, replace the initial executor with a more secure target executor, and adjust resource allocation to effectively prevent attackers from using common-mode injection and other methods to penetrate across tracks. This multi-dimensional and multi-layered response mechanism demonstrates the advanced nature and practicality of the network security competition platform design, providing a more realistic, controllable, and secure network isolation environment for the competition network system, while reducing the success rate of attacks and improving the overall defense capabilities of the system.

[0042] As an optional embodiment, determining the target isolation strategy between the first abnormal network and other networks based on the attack type and attack intensity of the first abnormal network attack further includes: determining multiple initial isolation strategies between the first abnormal network and other networks based on the attack type and attack intensity of the first abnormal network attack; calculating the reward value of each of the multiple initial isolation strategies based on a preset reward function, wherein the reward function is used to characterize the defense performance of the initial isolation strategy against the attack; and determining the target isolation strategy among the multiple initial isolation strategies based on the reward values ​​of each of the multiple initial isolation strategies.

[0043] Optionally, reinforcement learning models can be used as a tool to determine the target isolation strategy when the first anomalous network is attacked. Specifically, an optimization problem can be constructed. The state space defines the set of states the system can be in at any given time. For the first anomalous network, the state space can include resource utilization (e.g., CPU, bandwidth, storage usage), attack type (e.g., DDoS, SQL injection), and attack intensity (e.g., number of requests per second). These state parameters can reflect the security status and stress level of the first anomalous network in real time. The action space describes the response measures the system can take, i.e., the initial isolation strategy. For the first anomalous network, this can include adjusting resource utilization (e.g., increasing CPU from 50% to 80%), switching isolation execution units (i.e., selectively activating / deactivating backup execution units when an attack is detected, switching the service from the current execution unit to another pre-configured backup execution unit), and adding isolation execution units. Through these actions, the system can flexibly adjust resource allocation and execution unit configuration when anomalies are detected to improve defense effectiveness and system stability. The reward function is the core of the optimization problem. It defines the reward or penalty the system receives after taking a specific action. The goal is to optimize the system's response to attacks while maintaining high utilization, low attack success rate, and low latency. The reward function comprehensively considers these three objectives and associates them with the effects of actions. The reward value, calculated using preset weights, guides subsequent action selection, resulting in the final target isolation strategy. For example, when a cloud service track is under a DDoS attack with traffic reaching 1Gbps, the output of the reinforcement learning model can include adjustments to the utilization of runtime resources, such as increasing CPU to 90% and bandwidth to 1.5Gbps. It can also include actions such as switching target executors, such as activating two backup executors, with the response time of these actions kept within 200 milliseconds. Furthermore, a conflict arbitration mechanism exists when adjusting runtime resources. First, resource allocation requests can be uploaded to the blockchain to ensure transparency. Smart contracts on the blockchain automatically execute allocation rules, prioritizing resources for those with higher priority (such as tracks under attack). For example, when two tracks simultaneously request additional CPU, the smart contract allocates resources based on the attack intensity.

[0044] As an optional embodiment, based on a preset reward function, the reward values ​​of multiple initial isolation strategies are calculated respectively. The reward function is used to characterize the defense performance of the initial isolation strategy against attacks, including: determining the resource utilization rate of the first abnormal network, the success rate of the first abnormal network being attacked, and the latency time of the first abnormal network affected by the attack after executing multiple initial isolation strategies; and weighting and summing the resource utilization rate of the first abnormal network, the success rate of the first abnormal network being attacked, and the latency time of the first abnormal network affected by the attack after executing multiple initial isolation strategies, based on preset weights, to obtain the reward value of each of the multiple initial isolation strategies.

[0045] Alternatively, one possible mathematical expression for the reward function is as follows:

[0046]

[0047] in, For the reward function, To improve resource utilization, To increase the success rate of the attack, This is the delay time. , , These are preset weights for resource utilization, attack success rate, and latency, respectively. These weights can be changed based on actual needs and experience. For example, one possible weight setting could be... , , When an abnormal state of the first abnormal network is detected, the expected reward value of all possible actions in the current state (i.e., the initial isolation strategy, such as resource adjustment or execution switching) can be calculated, and the optimal action that satisfies the reward value condition can be selected.

[0048] As an optional embodiment, a target isolation strategy is determined among the multiple initial isolation strategies based on their respective reward values, including: comparing the reward values ​​of the multiple initial isolation strategies; and selecting the initial isolation strategy with the largest reward value among the multiple initial isolation strategies as the target isolation strategy.

[0049] Optionally, a reward function can be used to evaluate the effectiveness of all initial isolation strategies. This function comprehensively considers resource utilization, attack success rate, and latency after strategy execution, and numerically represents the defense performance of each strategy against attacks. After collecting the reward values ​​of each strategy, a numerical comparison is performed to identify the strategy with the highest reward value. This strategy is then determined as the target isolation strategy because it maximizes network efficiency and stability while defending against attacks.

[0050] As an optional embodiment, after identifying the first abnormal network among multiple networks, the state detection results of each of the other networks are obtained again; based on the state detection results of each of the other networks, a second abnormal network under attack is identified among the other networks, wherein the second abnormal network is a network with business association with the first abnormal network, and the attack on the second abnormal network is a cross-domain attack based on the first abnormal network; based on the attack type and attack intensity of the cross-domain attack, a defense strategy is determined in a preset rule base, wherein the defense strategy includes an execution switching strategy and / or a runtime resource adjustment strategy; based on the defense strategy, the second abnormal network is adjusted.

[0051] Optionally, after confirming the existence of the first anomalous network, the system will continue to acquire state detection results from all other network tracks to detect cross-track penetration attacks. Based on the acquired state detection results, it can be analyzed which network tracks may be subject to indirect or direct attacks based on the first anomalous network. This analysis mainly depends on the business relationships between the tracks. For example, if the first anomalous network is in the internet track, the second anomalous network may be in the cloud service track, using web vulnerabilities to obtain cloud service credentials; if the first anomalous network is in the cloud service track, the second anomalous network may be in the vehicle networking track, using API vulnerabilities to control in-vehicle devices. Only those networks that have business relationships with the first anomalous network and are therefore likely to become attack targets will be marked as second anomalous networks. The business relationships between networks and legitimate penetration paths are pre-configured and saved through a rule base.

[0052] Once the second anomalous network is identified, a defense strategy can be determined based on the type and intensity of the cross-domain attacks it suffers. The defense strategy can be determined using a pre-defined rule base, with each different attack type and intensity corresponding to a specific defense strategy. For example, if the input attack type is a DDoS attack, the output defense strategy would be to increase the number of execution instances to five and increase bandwidth to 2Gbps; if the input attack type is vulnerability exploitation, the output defense strategy would be to switch to execution instances with different architectures (e.g., from x86 to ARM); if the input attack type is lateral movement, the output defense strategy would be to isolate the attacked network and restrict its external communication.

[0053] In the application scenario of a cybersecurity competition platform, the above steps can be applied to cross-city penetration attacks. For example, a contestant might compromise the internet track to obtain credentials for the cloud service track. The contestant's attack process involves obtaining credentials through SQL injection and then using those credentials to execute Remote Code Execution (RCE) attacks on the cloud service track. When abnormal login behavior caused by the contestant's attack is detected, the execution entity can be switched, SDN rules updated, and internet track traffic restricted. Therefore, the contestant's attack is blocked, and the contestant gains points for successfully penetrating a track.

[0054] As an optional embodiment, the attack behavior against the first abnormal network is evaluated based on the defense success rate of the first abnormal network, the complexity of the vulnerability exploited by the first abnormal network, and the number of networks affected by the attack on the first abnormal network, and an evaluation result is obtained.

[0055] Optionally, in the application scenario of a cybersecurity competition platform, the attack behavior of contestants can be evaluated. The mathematical expression of a possible evaluation algorithm is as follows:

[0056]

[0057] in, The score is given for the attack behavior. This represents the number of times the first anomalous network was successfully attacked. This represents the total number of attacks on the first abnormal network. To improve the success rate of defense, For vulnerability complexity, The number of networks affected. , , These are preset weights for defense success rate, vulnerability complexity, and number of networks, respectively. Defense success rate reflects the effectiveness of the attack defense against the attacker's attack. Vulnerability complexity can be scored using the CVSS (Common Vulnerability Scoring System), ranging from 0 to 10. The number of networks affected by the attack is the number of penetration tests; for example, 2 means affecting 2 tests.

[0058] For example, a competitor conquers one track ( ), penetrating into the second track ( ), defense success rate 80% ( Therefore, the calculation result is All contestants' actions are automatically archived and traceable, and contestants can view their score details in real time. The weights in the scoring algorithm can be dynamically optimized based on the difficulty of the competition.

[0059] As an optional embodiment, when the network security system is a network security competition platform and multiple networks represent multiple tracks, initial resources and execution units are first allocated to each track. Then, contestants trigger competition challenges and launch attacks, and the platform records the contestants' actions. The platform dynamically adjusts the runtime resources and execution units based on the attack behavior. Finally, the contestants' final scores are calculated according to a preset evaluation algorithm. For example, if a contestant breaches the internet track and attempts to penetrate the cloud service track, the platform increases resources for the cloud service track, switches execution units, and successfully defends against the attack. The final score is calculated based on the success and complexity of the attack.

[0060] It should be noted that, for the sake of simplicity, the foregoing method embodiments are all described as a series of actions. However, those skilled in the art should understand that the present invention is not limited to the described order of actions, because according to the present invention, some steps can be performed in other orders or simultaneously. Furthermore, those skilled in the art should also understand that the embodiments described in the specification are preferred embodiments, and the actions and modules involved are not necessarily essential to the present invention.

[0061] Through the above description of the embodiments, those skilled in the art can clearly understand that the network isolation method according to the above embodiments can be implemented by means of software plus necessary general-purpose hardware platform. Of course, it can also be implemented by hardware, but in many cases the former is a better implementation method. Based on this understanding, the technical solution of the present invention, or the part that contributes to the prior art, can be embodied in the form of a software product. This computer software product is stored in a storage medium (such as ROM / RAM, magnetic disk, optical disk) and includes several instructions to cause a terminal device (which may be a mobile phone, computer, server, or network device, etc.) to execute the methods described in the various embodiments of the present invention.

[0062] According to an optional embodiment of the present invention, a network isolation system for applying the above-described network isolation method is also provided. Figure 3 This is a structural block diagram of a network isolation system provided by an optional embodiment of the present invention, such as... Figure 3 As shown, this network isolation system comprises four modules: a dynamic isolation engine, a resource scheduler, a collaborative attack and defense controller, and an automated scoring system. The modules are connected by bidirectional arrows, representing the interaction between data flow and control flow. For example, the dynamic isolation engine requests resources from the resource scheduler, and the collaborative attack and defense controller shares attack and defense data with the automated scoring module. The network isolation system will be described below.

[0063] The dynamic isolation engine is used to obtain the state detection results of multiple networks in the target network security system. These networks are isolated from each other. Based on the state detection results of each network, the engine identifies the first abnormal network that has been attacked and, based on the target isolation policy, performs isolation between the first abnormal network and other networks.

[0064] Optionally, the dynamic isolation engine is the core module of the system, designed to provide independent and dynamically adjustable virtualized environments for different networks (such as the Internet, vehicle-to-everything (V2X) networks, drones, cloud services, etc.). It achieves secure isolation and efficient resource management through the coordination of hardware isolation, software-defined networking (SDN), and resource scheduling. Specifically, the dynamic isolation engine can obtain the status detection results of multiple networks within the target network security system in real time, analyze the detection data, and when the load changes or an attack is detected, send a request to the resource scheduler for further analysis and control. Based on the resource scheduler's decision, it dynamically isolates the track networks.

[0065] The main functions of the dynamic isolation engine may also include: a heterogeneous execution pool that supports multiple architectures (such as x86, ARM, RISC-V) and operating systems (such as Linux, Windows, RTOS) to achieve mimicry defense; hardware-level isolation that utilizes Intel SGX or AMD SEV technology to ensure the security of memory and computing resources; and an SDN controller that dynamically manages traffic through software-defined networking to restrict unauthorized cross-network communication.

[0066] Hardware-level isolation can be configured using Intel SGX (Intel Software Guard Extensions) or AMD SEV (AMD Secure Encrypted Virtualization) technologies to create a secure enclave for each network track. Sensitive data (such as keys and configurations) is then encrypted and stored within the enclave, where core business logic also runs, ensuring isolation from the outside world. During system operation, the integrity of the enclave is periodically checked via remote authentication to ensure the isolated environment has not been tampered with. In the preparation phase, the dynamic isolation engine can launch heterogeneous execution entities for each network track and activate the enclave, loading pre-configured traffic rules into the SDN controller to enforce network isolation.

[0067] In the initial phase of system operation, the dynamic isolation engine can configure the SDN (Software Defined Networking) controller and set initial isolation rules via the OpenFlow protocol. These initial isolation rules are preset traffic isolation policies that block all cross-channel traffic. Exception rules can also be defined according to business needs; for example, allowing HTTPS traffic (requiring authentication) between the internet channel and the cloud service channel. The isolation rule templates are dynamic, allowing for rapid adjustments in case of abnormal traffic. New rules need to be deployed within seconds and can be flexibly configured according to business requirements.

[0068] A resource scheduler is used to determine the target isolation strategy between the first abnormal network and other networks based on the attack type and attack intensity of the first abnormal network. The other networks are networks other than the first abnormal network among multiple networks. The target isolation strategy includes: increasing the isolation execution entity for performing isolation between the first abnormal network and other networks, stopping the running initial isolation execution entity and starting the target isolation execution entity, or adjusting the operating resource utilization rate of the first abnormal network. The operating resource utilization rate is the share of the operating resources of the first abnormal network in the total operating resources.

[0069] Optionally, the resource scheduler can dynamically determine the switching of executors and resource allocation based on reinforcement learning to ensure efficient system operation. The primary responsibility of the resource scheduler is to optimize resource allocation across multiple network tracks on the platform, and, in the event of a security incident, select one or more executors from among those associated with the first anomalous network as target isolation executors, instructing them to perform isolation operations, or simply adding more isolation executors. For example, when a cloud service track encounters a DDoS attack, the resource scheduler can use reinforcement learning analysis to determine the need to increase CPU and bandwidth, and activate two backup executors. During the preparation phase, the dynamic isolation engine can be connected to the resource scheduler to support real-time resource allocation requests, while setting initial parameters such as resource quotas and priorities for each network.

[0070] The collaborative attack and defense controller is used to, after identifying the first abnormal network among multiple networks, acquire the status detection results of each of the other networks; based on the status detection results of each of the other networks, identify the second abnormal network among the other networks that has been attacked, wherein the second abnormal network is a network with business connections to the first abnormal network, and the attack on the second abnormal network is a cross-domain attack based on the first abnormal network; based on the attack type and attack intensity of the cross-domain attack, determine the defense strategy in a preset rule base, wherein the defense strategy includes an execution unit switching strategy and / or a runtime resource adjustment strategy; and adjust the second abnormal network based on the defense strategy.

[0071] Optionally, the collaborative attack and defense controller can dynamically adjust its defense strategy based on the attack type and intensity faced by the second abnormal network (i.e., the network whose abnormal behavior is detected besides the first abnormal network), ensuring that the system can adapt to the ever-changing network attack and defense environment. For example, the collaborative attack and defense controller's functions may include a cross-domain penetration rule base for defining legitimate penetration paths; and a dynamic policy adjustment module that can optimize defense strategies in real time based on attack behavior. Additionally, the collaborative attack and defense controller can instruct the SDN controller to adjust rules based on the attack type.

[0072] An automated scoring system is used to evaluate attacks against the first anomalous network based on the success rate of defense against attacks on the first anomalous network, the complexity of vulnerabilities exploited by the attacks on the first anomalous network, and the number of networks affected by the attacks on the first anomalous network, and to obtain evaluation results.

[0073] Optionally, in the application scenario of a cybersecurity competition platform, an automated scoring system can provide a fair and objective evaluation of contestants' attacks on the first anomalous network, ensuring the fairness and professionalism of the competition. By comprehensively considering factors such as attack success rate, vulnerability exploitation complexity, and cross-track impact, an evaluation algorithm is applied to calculate a score for each attack. The scoring results can be updated and displayed to contestants in real time, while also retaining detailed records of each score for later review or dispute resolution. The scoring system can dynamically adjust weights based on the actual difficulty of the competition and the contestants' offensive and defensive capabilities, ensuring the flexibility and adaptability of the scoring system.

[0074] It should be noted that the dynamic isolation engine and resource scheduler described above correspond to steps S201 to S204 in the embodiments, and the implementation examples and application scenarios are the same, but are not limited to the content disclosed in the above embodiments. It should also be noted that the above system can run on the computer terminal 10 provided in the embodiments.

[0075] Embodiments of the present invention may provide a computer device. Optionally, in this embodiment, the computer device may be located in at least one of a plurality of network devices in a computer network. The computer device includes a memory and a processor.

[0076] The memory can be used to store software programs and modules, such as the program instructions / modules corresponding to the network isolation method and system in this embodiment of the invention. The processor executes various functional applications and data processing by running the software programs and modules stored in the memory, thereby realizing the aforementioned network isolation method. The memory may include high-speed random access memory, and may also include non-volatile memory, such as one or more magnetic storage devices, flash memory, or other non-volatile solid-state memory. In some instances, the memory may further include memory remotely located relative to the processor, and these remote memories can be connected to a computer terminal via a network. Examples of the aforementioned networks include, but are not limited to, the Internet, corporate intranets, local area networks, mobile communication networks, and combinations thereof.

[0077] The processor can invoke information and application programs stored in memory via a transmission device to perform the following steps: acquiring the state detection results of multiple networks in the target network security system, wherein the multiple networks are isolated from each other; based on the state detection results of the multiple networks, identifying the first abnormal network among the multiple networks that has been attacked; based on the attack type and attack intensity of the first abnormal network, determining the target isolation strategy between the first abnormal network and other networks, wherein the other networks are the networks other than the first abnormal network among the multiple networks, and the target isolation strategy includes: adding an isolation execution entity for performing isolation between the first abnormal network and other networks, stopping the running initial isolation execution entity and starting the target isolation execution entity, or adjusting the operating resource utilization rate of the first abnormal network, wherein the operating resource utilization rate is the share of the operating resources of the first abnormal network in the total operating resources; and performing isolation between the first abnormal network and other networks based on the target isolation strategy.

[0078] Optionally, the processor may also execute program code with the following steps: the target isolation strategy includes adding an isolation execution unit for performing isolation between the first abnormal network and other networks, stopping the running initial isolation execution unit and starting the target isolation execution unit; or the target isolation strategy includes adding an isolation execution unit for performing isolation between the first abnormal network and other networks and adjusting the operating resource utilization of the first abnormal network; or the target isolation strategy includes stopping the running initial isolation execution unit and starting the target isolation execution unit and adjusting the operating resource utilization of the first abnormal network.

[0079] Optionally, the processor may also execute program code for the following steps: determining a target isolation strategy between the first abnormal network and other networks based on the attack type and attack intensity of the attack on the first abnormal network; further comprising: determining multiple initial isolation strategies between the first abnormal network and other networks based on the attack type and attack intensity of the attack on the first abnormal network; calculating the reward value of each of the multiple initial isolation strategies based on a preset reward function, wherein the reward function is used to characterize the defensive performance of the initial isolation strategy against the attack; and determining a target isolation strategy among the multiple initial isolation strategies based on the reward values ​​of each of the multiple initial isolation strategies.

[0080] Optionally, the processor may also execute program code with the following steps: Calculate the reward value of each of the multiple initial isolation strategies based on a preset reward function, wherein the reward function characterizes the defensive performance of the initial isolation strategy against attacks, including: determining the resource utilization rate of the first abnormal network, the success rate of the first abnormal network being attacked, and the latency time of the first abnormal network affected by the attack after executing multiple initial isolation strategies; and weightedly summing the resource utilization rate of the first abnormal network, the success rate of the first abnormal network being attacked, and the latency time of the first abnormal network affected by the attack after executing multiple initial isolation strategies to obtain the reward value of each of the multiple initial isolation strategies.

[0081] Optionally, the processor may also execute program code that performs the following steps: determining a target isolation policy among multiple initial isolation policies based on their respective reward values, including: comparing the reward values ​​of the multiple initial isolation policies; and selecting the initial isolation policy with the largest reward value among the multiple initial isolation policies as the target isolation policy.

[0082] Optionally, the processor may also execute program code for the following steps: after identifying the first abnormal network among multiple networks, obtain the status detection results of each of the other networks; based on the status detection results of each of the other networks, identify the second abnormal network among the other networks that has been attacked, wherein the second abnormal network is a network that has a business relationship with the first abnormal network, and the attack on the second abnormal network is a cross-domain attack based on the first abnormal network; based on the attack type and attack intensity of the cross-domain attack, determine a defense strategy in a preset rule base, wherein the defense strategy includes an execution unit switching strategy and / or a runtime resource adjustment strategy; and adjust the second abnormal network based on the defense strategy.

[0083] Optionally, the processor may also execute program code that performs the following steps: evaluates the attack behavior against the first abnormal network based on the defense success rate of the first abnormal network being attacked, the complexity of the vulnerability exploited by the first abnormal network being attacked, and the number of networks affected by the attack on the first abnormal network, and obtains the evaluation result.

[0084] This invention provides a network isolation method. It involves acquiring the state detection results of multiple networks within a target network security system, where these networks are isolated from each other. Based on the state detection results of each network, a first abnormal network under attack is identified. Based on the attack type and intensity of the attack on the first abnormal network, a target isolation strategy is determined between the first abnormal network and other networks. These other networks are those excluding the first abnormal network. The target isolation strategy includes: adding an isolation execution entity to perform isolation between the first abnormal network and other networks; stopping the currently running initial isolation execution entity and starting the target isolation execution entity; or adjusting the resource utilization rate of the first abnormal network, where the resource utilization rate is the share of the first abnormal network's operating resources in the total operating resources. Based on the target isolation strategy, isolation between the first abnormal network and other networks is executed. This method achieves the goal of dynamically adjusting the isolation strategy between networks, thereby improving the efficiency, adaptability, and security of the network security system. It also solves the technical problems of low resource utilization and inability to cope with complex and changing scenarios inherent in current static isolation technologies.

[0085] Those skilled in the art will understand that all or part of the steps in the various methods of the above embodiments can be implemented by a program instructing the hardware related to the terminal device. The program can be stored in a non-volatile storage medium, which may include: flash drive, read-only memory (ROM), random access memory (RAM), disk or optical disk, etc.

[0086] Embodiments of the present invention also provide a non-volatile storage medium. Optionally, in this embodiment, the non-volatile storage medium can be used to store the program code executed by the network isolation method provided in the above embodiments.

[0087] Optionally, in this embodiment, the non-volatile storage medium may be located in any computer terminal in a group of computer terminals in a computer network, or in any mobile terminal in a group of mobile terminals.

[0088] Optionally, in this embodiment, the non-volatile storage medium is configured to store program code for performing the following steps: obtaining the state detection results of multiple networks in the target network security system, wherein the multiple networks are isolated from each other; determining the first abnormal network among the multiple networks that has been attacked based on the state detection results of the multiple networks; determining the target isolation strategy between the first abnormal network and other networks based on the attack type and attack intensity of the first abnormal network, wherein the other networks are the networks other than the first abnormal network among the multiple networks, and the target isolation strategy includes: adding an isolation execution entity for performing isolation between the first abnormal network and other networks, stopping the running initial isolation execution entity and starting the target isolation execution entity, or adjusting the operating resource utilization rate of the first abnormal network, wherein the operating resource utilization rate is the share of the operating resources of the first abnormal network in the total operating resources; and performing isolation between the first abnormal network and other networks based on the target isolation strategy.

[0089] Optionally, in this embodiment, the non-volatile storage medium is configured to store program code for performing the following steps: the target isolation strategy includes adding an isolation execution unit for performing isolation between the first abnormal network and other networks, stopping the running initial isolation execution unit and starting the target isolation execution unit; or the target isolation strategy includes adding an isolation execution unit for performing isolation between the first abnormal network and other networks and adjusting the operating resource utilization of the first abnormal network; or the target isolation strategy includes stopping the running initial isolation execution unit and starting the target isolation execution unit and adjusting the operating resource utilization of the first abnormal network.

[0090] Optionally, in this embodiment, the non-volatile storage medium is configured to store program code for performing the following steps: determining a target isolation strategy between the first abnormal network and other networks based on the attack type and attack intensity of the attack on the first abnormal network, further including: determining multiple initial isolation strategies between the first abnormal network and other networks based on the attack type and attack intensity of the attack on the first abnormal network; calculating the reward value of each of the multiple initial isolation strategies based on a preset reward function, wherein the reward function is used to characterize the defense performance of the initial isolation strategy against the attack; and determining a target isolation strategy among the multiple initial isolation strategies based on the reward values ​​of each of the multiple initial isolation strategies.

[0091] Optionally, in this embodiment, the non-volatile storage medium is configured to store program code for performing the following steps: calculating the reward value of each of the multiple initial isolation strategies based on a preset reward function, wherein the reward function is used to characterize the defense performance of the initial isolation strategy against attacks, including: determining the operating resource utilization rate of the first abnormal network, the success rate of the first abnormal network being attacked, and the latency time of the first abnormal network affected by the attack after executing the multiple initial isolation strategies; and weighting and summing the operating resource utilization rate of the first abnormal network, the success rate of the first abnormal network being attacked, and the latency time of the first abnormal network affected by the attack after executing the multiple initial isolation strategies based on preset weights to obtain the reward value of each of the multiple initial isolation strategies.

[0092] Optionally, in this embodiment, the non-volatile storage medium is configured to store program code for performing the following steps: determining a target isolation policy among multiple initial isolation policies based on the reward values ​​of each of the multiple initial isolation policies, including: comparing the magnitudes of the reward values ​​of each of the multiple initial isolation policies; and selecting the initial isolation policy with the largest reward value among the multiple initial isolation policies as the target isolation policy.

[0093] Optionally, in this embodiment, the non-volatile storage medium is configured to store program code for performing the following steps: after identifying a first abnormal network among multiple networks, the status detection results of each of the other networks are obtained again; based on the status detection results of each of the other networks, a second abnormal network under attack is identified among the other networks, wherein the second abnormal network is a network with business association with the first abnormal network, and the attack on the second abnormal network is a cross-domain attack based on the first abnormal network; based on the attack type and attack intensity of the cross-domain attack, a defense strategy is determined in a preset rule base, wherein the defense strategy includes an execution switching strategy and / or a runtime resource adjustment strategy; and based on the defense strategy, the second abnormal network is adjusted.

[0094] Optionally, in this embodiment, the non-volatile storage medium is configured to store program code for performing the following steps: evaluating the attack behavior against the first abnormal network based on the defense success rate of the first abnormal network being attacked, the complexity of the vulnerability exploited by the first abnormal network being attacked, and the number of networks affected by the attack on the first abnormal network, and obtaining the evaluation result.

[0095] Embodiments of the present invention also provide a computer program product, including a computer program. Optionally, in this embodiment, when the computer program is executed by a processor, it can: acquire the state detection results of multiple networks in a target network security system, wherein the multiple networks are isolated from each other; based on the state detection results of the multiple networks, determine a first abnormal network among the multiple networks that has been attacked; based on the attack type and attack intensity of the attack on the first abnormal network, determine a target isolation strategy between the first abnormal network and other networks, wherein the other networks are networks other than the first abnormal network among the multiple networks, and the target isolation strategy includes: adding an isolation execution entity for performing isolation between the first abnormal network and other networks, stopping the running initial isolation execution entity and starting the target isolation execution entity, or adjusting the operating resource utilization rate of the first abnormal network, wherein the operating resource utilization rate is the share of the operating resources of the first abnormal network in the total operating resources; and performing isolation between the first abnormal network and other networks based on the target isolation strategy.

[0096] The sequence numbers of the above embodiments of the present invention are for descriptive purposes only and do not represent the superiority or inferiority of the embodiments.

[0097] In the above embodiments of the present invention, the descriptions of each embodiment have different focuses. For parts not described in detail in a certain embodiment, please refer to the relevant descriptions of other embodiments.

[0098] In the several embodiments provided in this application, it should be understood that the disclosed technical content can be implemented in other ways. The system embodiments described above are merely illustrative; for example, the division of units can be a logical functional division, and in actual implementation, there may be other division methods. For instance, multiple units or components may be combined or integrated into another system, or some features may be ignored or not executed. Furthermore, the displayed or discussed mutual coupling, direct coupling, or communication connection may be through some interfaces; the indirect coupling or communication connection of units or modules may be electrical or other forms.

[0099] The units described as separate components may or may not be physically separate. The components shown as units may or may not be physical units; that is, they may be located in one place or distributed across multiple units. Some or all of the units can be selected to achieve the purpose of this embodiment according to actual needs.

[0100] Furthermore, the functional units in the various embodiments of the present invention can be integrated into one processing unit, or each unit can exist physically separately, or two or more units can be integrated into one unit. The integrated unit can be implemented in hardware or as a software functional unit.

[0101] If the integrated unit is implemented as a software functional unit and sold or used as an independent product, it can be stored in a non-volatile storage medium. Based on this understanding, the technical solution of the present invention, in essence, or the part that contributes to the prior art, or all or part of the technical solution, can be embodied in the form of a software product. This computer software product is stored in a storage medium and includes several instructions to cause a computer device (which may be a personal computer, server, or network device, etc.) to execute all or part of the steps of the methods described in the various embodiments of the present invention. The aforementioned storage medium includes various media capable of storing program code, such as USB flash drives, read-only memory (ROM), random access memory (RAM), portable hard drives, magnetic disks, or optical disks.

[0102] The above description is only a preferred embodiment of the present invention. It should be noted that for those skilled in the art, several improvements and modifications can be made without departing from the principle of the present invention, and these improvements and modifications should also be considered within the scope of protection of the present invention.

Claims

1. A network isolation method, characterized in that, include: Obtain the status detection results of multiple networks in the target network security system, wherein the multiple networks are isolated from each other; Based on the state detection results of the multiple networks, the first abnormal network among the multiple networks that has been attacked is identified. Based on the attack type and attack intensity of the first abnormal network, a target isolation strategy is determined between the first abnormal network and other networks. The other networks are the networks other than the first abnormal network among the plurality of networks. The target isolation strategy includes: adding an isolation execution unit for performing isolation between the first abnormal network and the other networks, stopping the running initial isolation execution unit and starting the target isolation execution unit, or adjusting the operating resource utilization rate of the first abnormal network. The operating resource utilization rate is the share of the operating resources of the first abnormal network in the total operating resources. Based on the target isolation strategy, isolation is performed between the first abnormal network and the other networks.

2. The method according to claim 1, characterized in that, The target isolation strategy includes adding an isolation execution unit for performing isolation between the first abnormal network and the other networks, stopping the running initial isolation execution unit and starting the target isolation execution unit, or the target isolation strategy includes adding an isolation execution unit for performing isolation between the first abnormal network and the other networks, and adjusting the operating resource utilization of the first abnormal network, or the target isolation strategy includes stopping the running initial isolation execution unit and starting the target isolation execution unit, and adjusting the operating resource utilization of the first abnormal network.

3. The method according to claim 1, characterized in that, The step of determining the target isolation strategy between the first abnormal network and other networks based on the attack type and attack intensity of the first abnormal network also includes: Based on the attack type and attack intensity of the first abnormal network, multiple initial isolation strategies are determined between the first abnormal network and the other networks. Based on a preset reward function, the reward value of each of the multiple initial isolation strategies is calculated, wherein the reward function is used to characterize the defensive performance of the initial isolation strategy against attacks; The target isolation strategy is determined from among the multiple initial isolation strategies based on the reward values ​​of each of the multiple initial isolation strategies.

4. The method according to claim 3, characterized in that, The reward value for each of the multiple initial isolation strategies is calculated based on a preset reward function, wherein the reward function characterizes the defensive performance of the initial isolation strategy against attacks, including: After executing the multiple initial isolation strategies, determine the resource utilization rate of the first abnormal network, the success rate of the first abnormal network being attacked, and the delay time of the first abnormal network being affected by the attack. Based on preset weights, the resource utilization rate of the first abnormal network after the multiple initial isolation policies, the success rate of the first abnormal network being attacked, and the delay time of the first abnormal network affected by the attack are weighted to obtain the reward value of each of the multiple initial isolation policies.

5. The method according to claim 3, characterized in that, The step of determining the target isolation strategy from the plurality of initial isolation strategies based on their respective reward values ​​includes: Compare the reward values ​​of the various initial isolation strategies; The initial isolation strategy with the largest reward value among the multiple initial isolation strategies is taken as the target isolation strategy.

6. The method according to claim 1, characterized in that, Also includes: After identifying the first abnormal network among the plurality of networks, the state detection results of the other networks are then obtained. Based on the state detection results of the other networks, a second abnormal network that has been attacked is identified among the other networks. The second abnormal network is a network that has a business relationship with the first abnormal network, and the attack on the second abnormal network is a cross-domain attack based on the first abnormal network. Based on the attack type and intensity of the cross-domain attack, a defense strategy is determined in a preset rule base, wherein the defense strategy includes an execution switching strategy and / or a runtime resource adjustment strategy. Based on the aforementioned defense strategy, adjustments are made to the second abnormal network.

7. The method according to claim 1, characterized in that, Also includes: The attack behavior against the first abnormal network is evaluated based on the defense success rate of the first abnormal network, the complexity of the vulnerabilities exploited by the first abnormal network, and the number of networks affected by the attack on the first abnormal network, and the evaluation results are obtained.

8. A non-volatile storage medium, characterized in that, The non-volatile storage medium includes a stored program, wherein, when the program is executed, it controls the device where the non-volatile storage medium is located to perform the network isolation method according to any one of claims 1 to 7.

9. A computer device, characterized in that, include: Memory and processor The memory stores computer programs; The processor is configured to execute a computer program stored in the memory, wherein the computer program, when executed, causes the processor to perform the network isolation method according to any one of claims 1 to 7.

10. A computer program product, comprising a computer program, characterized in that, When the computer program is executed by the processor, it implements the network isolation method according to any one of claims 1 to 7.

Images