Firewall policy auditing method based on policy hypergraph construction and loop feature mining
By constructing a policy hypergraph and extracting loop features, the semantic understanding and topological integrity issues of firewall policy auditing in existing technologies are solved, achieving efficient and accurate firewall policy auditing. It can identify potential attack paths and excessive privilege risks, reducing the difficulty of operation and maintenance.
Patent Information
- Authority / Receiving Office
- CN · China
- Patent Type
- Applications(China)
- Current Assignee / Owner
- Filing Date
- 2026-01-06
- Publication Date
- 2026-04-07
- Estimated Expiration
- Not applicable · inactive patent
AI Technical Summary
Existing technologies struggle to simultaneously ensure the accuracy of semantic understanding, the integrity of logical topology, and real-time performance under high concurrency when processing massive amounts of firewall policies. This results in audit results that are out of sync with actual business scenarios, high computational complexity, feature dilution, and poor dynamic reasoning capabilities.
We employ a strategy-based hypergraph construction and loop feature mining approach. By decomposing user requests into multiple atomic retrieval subtasks, we construct a dynamic hypergraph. We then extract the feature matrix of strategy nodes using graph sampling and loop structure, and combine this with a large model for auditing to identify potential attack paths and excessive privilege risks.
It enables efficient and accurate auditing of firewall policies, can directly reproduce hacker attack paths, automatically lock policy nodes with complex connections in the network, reduce the difficulty of handling by operation and maintenance personnel, and improve the real-time performance and accuracy of auditing.
Smart Images
Figure CN121814432A_ABST
Abstract
Description
Technical Field
[0001] This invention relates to the fields of network security and artificial intelligence, and in particular to a firewall policy auditing method based on policy hypergraph construction and loop feature mining. Background Technology
[0002] Faced with massive access control policies, existing auditing technologies have mainly gone through the following three stages of development. Although each has solved certain problems, significant technical limitations still exist: 1. First type of technology: Traditional formal verification and static rule analysis techniques. Technology description: Early firewall auditing mainly relied on formal verification methods, with representative tools such as Fireman and Margrave. This type of technology usually uses binary decision graphs (BDD) or geometric models to transform firewall policies into mathematical models, and uses set operations to detect policy reachability and logical conflicts. Problems solved: Solved the problem of automated detection of explicit conflicts between policies (such as blocking and redundancy), and has deterministic logical judgment. Limitations: Lack of semantic understanding: Unable to understand the natural language business intent in policy notes (such as "HR system accesses the financial database"), leading to a disconnect between audit results and actual business scenarios. High computational complexity: Faced with large-scale dynamic networks, the computational complexity of static analysis algorithms often increases exponentially, making it difficult to meet real-time auditing needs.
[0003] 2. Second Category of Technologies: General Large Language Models and Retrieval Enhancement Generation Technology. Technology Description: In recent years, products such as Microsoft Security Copilot have attempted to introduce large language models into security operations, utilizing RAG technology to retrieve and generate policies as an external knowledge base. Problems Solved: It introduces natural language processing capabilities, lowers the interaction threshold for operations personnel, and can handle certain unstructured semantic information. Limitations: Context vs. Accuracy: Firewall policies are high-density structured text, resulting in huge token consumption (100 policies ≈ 15,000 tokens). Full input can easily lead to the "Lost in the Middle" phenomenon, failing to capture key information. Low Numerical Sensitivity (Semantic Drift): General embedding models are trained based on textual semantic distance and are extremely insensitive to numerical features such as IP addresses (e.g., unable to effectively distinguish between logically isolated 192.168.1.1 and 1.2), leading to severe logical illusions. Loss of Topology: Traditional vector retrieval loses the "many-to-many" cross-coverage relationship between the source IP set and the destination IP set in the policy, easily generating a large amount of "pseudo-connection" noise.
[0004] 3. The third category of technology: Graph neural network analysis technology based on the full static graph. Technology description: Some research has begun to attempt to use graph neural networks or hypergraphs to model network configurations, trying to capture high-order relationships between policy entities. Problems solved: Compared to traditional databases, graph models can more naturally express network topology and complex dependencies between entities. Limitations: Difficulty in maintaining data consistency: Most current methods rely on pre-training of the full graph. In live network environments where policies change frequently, maintaining the full graph requires complex read-write locking mechanisms, which can easily lead to thread blocking and performance bottlenecks under high concurrency. Feature dilution (oversmoothing): In the full graph, there are a large number of "super nodes" with extremely high connection counts (such as "Any" or gateway IPs). During message passing, the core features of local business policies are greatly diluted by the noise of these super nodes, resulting in a lack of specificity in the analysis results.
[0005] In summary, existing technologies struggle to simultaneously ensure the accuracy of semantic understanding, the integrity of logical topology, and real-time performance under high concurrency when dealing with massive amounts of firewall policies. Summary of the Invention
[0006] To address the aforementioned shortcomings in existing technologies, this invention provides a firewall policy auditing method based on policy hypergraph construction and loop feature mining, which solves the problems of existing technologies having difficulty in integrating precise features and semantic features, and having poor dynamic reasoning capabilities.
[0007] To achieve the aforementioned objectives, the technical solution adopted by this invention is: a firewall policy auditing method based on policy hypergraph construction and loop feature mining, comprising: S1: Decompose the user request into multiple atomic retrieval subtasks, generate them based on logical dependencies, and obtain the retrieval execution plan; S2: Use tools to match the retrieval execution plan with the policy library to obtain a set of candidate firewall policies; S3: Construct a dynamic hypergraph based on a set of candidate firewall policies; S4: Graph sampling and subgraph extraction based on node degree: Sampling of dynamic hypergraph to obtain multiple local subgraphs; S5: Utilize loop structure extraction and attack pattern mapping, and use graph algorithms to extract paths in local subgraphs to obtain a policy node feature matrix containing closed loop paths and long chain paths. S6: Utilize the large-scale analysis model to process the feature matrix of policy nodes, obtain the firewall policy audit results, and complete the audit of firewall policies.
[0008] Further, S3 includes: Each specific policy in the candidate firewall policy set is treated as a node and analyzed. If two policies share the same source address set or destination address set, a connection is established. If the destination address set of one policy intersects with the source address set of another policy, a directed connection is established to obtain the connection relationship. By using a specific address object as a hyperedge, all policy nodes involving that address are connected to obtain the relationship structure between the address and the policy. Dynamic hypergraphs are constructed based on connection relationships and association structures.
[0009] Further, S4 includes: S410: Based on the degree of all policy nodes in the dynamic hypergraph, select the multiple policy nodes with the highest degree for sampling to obtain the core anchor points; S420: Extract the core anchor point and all neighboring nodes directly connected to the core anchor point to obtain multiple high-density local subgraphs.
[0010] Further, S410 includes: Based on the degree of all policy nodes in the dynamic hypergraph, select the policy nodes with the highest degree and use an asset-centric sampling algorithm to obtain the core anchor points.
[0011] Furthermore, the expression for the core anchor point is: ; ; in, Indicates the core anchor point. This represents the i-th strategy. Represents the strategy node, Indicates the source IP address of the policy. ( ) represents the target IP address of the strategy. Represents the set of core asset addresses. express, This represents the j-th strategy.
[0012] Further, S420 includes: Based on the core anchor point and all neighboring nodes directly connected to the core anchor point, k-hop neighborhood sampling is performed to obtain the induced subgraph; The closed-loop structure of the induced subgraph is extracted, and the threat is classified based on the topological features of the graph, resulting in multiple high-density local subgraphs.
[0013] Furthermore, the expression for the local subgraph is: ; in, - This represents the individual firewall policy nodes that make up this local loop subgraph. express, express, ( () represents the set of target IP addresses for strategy k. ( The set of source IP addresses for strategy k+1.
[0014] Furthermore, the expression for the strategy node feature matrix is: ; in, This represents the feature matrix of the policy nodes in the (l+1)th layer. Represents a non-linear activation function. Represents the policy node degree matrix. Represents the hypergraph incidence matrix. Represents the hyperedge weight matrix. Represents the hypermarginality matrix. Represents the transpose of the hypergraph incidence matrix. This represents the feature matrix of the policy nodes in layer l. This represents the learnable parameter matrix.
[0015] The beneficial effects of this invention are as follows: This invention provides a firewall policy auditing method based on policy hypergraph construction and loop feature mining. By constructing address relay relationships and extracting loops, it can directly reproduce the attack path of hackers using multi-layer firewall policies to perform multi-level hops (pivots). Through degree-based sampling, it can automatically identify the hub policies with the most complex connection relationships in the network. These policies are often the inevitable paths for hackers to perform lateral scanning of the internal network. Loop analysis of these policies can effectively identify the hidden dangers of excessive privileges. Compared with the obscure neural network vector distance, this invention finally outputs a specific path description of "A->B->C", which allows operation and maintenance personnel to intuitively see how traffic penetrates the network, greatly reducing the difficulty of handling. Attached Figure Description
[0016] This specification will be further described by way of exemplary embodiments, which will be described in detail with reference to the accompanying drawings. These embodiments are not limiting; in these embodiments, the same reference numerals denote the same structures, wherein: Figure 1 This is an exemplary flowchart of a firewall policy auditing method based on policy hypergraph construction and loop feature mining, as shown in some embodiments of this specification. Figure 2 This is an exemplary schematic diagram of a two-stage filtering retrieval method according to some embodiments of this specification; Figure 3 This is an exemplary schematic diagram of a firewall auditing agent framework based on a hypergraph neural network, as shown in some embodiments of this specification. Figure 4 This is an exemplary schematic diagram of a firewall policy auditing system based on a multi-agent architecture, as shown in some embodiments of this specification. Detailed Implementation
[0017] The specific embodiments of the present invention are described below to enable those skilled in the art to understand the present invention. However, it should be understood that the present invention is not limited to the scope of the specific embodiments. For those skilled in the art, various changes are obvious as long as they are within the spirit and scope of the present invention as defined and determined by the appended claims. All inventions utilizing the concept of the present invention are protected.
[0018] Example Figure 1 This is an exemplary flowchart illustrating a firewall policy auditing method based on policy hypergraph construction and loop feature mining, according to some embodiments of this specification. Figure 1 As shown, the process includes the following steps. In some embodiments, the process may be executed by a processor.
[0019] S1: Decompose the user request into multiple atomic retrieval subtasks, generate them based on logical dependencies, and obtain the retrieval execution plan.
[0020] The retrieval execution plan is the retrieval subtask after keyword extraction.
[0021] In some embodiments, the processor can receive a user's natural language audit request based on the Agent's query intent understanding and task orchestration, and the system calls the retrieval Agent for processing. Specifically, the processor can utilize the retrieval Agent to first decompose complex user questions (such as "find all policies that may be used to launch attacks from the test area to the core database") into multiple atomic retrieval subtasks; the Agent generates a retrieval execution plan based on the logical dependencies of the subtasks. For example, the user inputs "query all policies open to the test area database". The LLM extracts keywords, such as: destination port 3306 (exact), description containing "test" (semantic).
[0022] In some embodiments, the processor can dynamically extract the corresponding precise keywords (such as source IP network segment, destination port, protocol type) from the original query for each subtask using the retrieval agent, and automatically select the appropriate retrieval tool (such as SQL retrieval tool, full-text retrieval tool, log retrieval tool).
[0023] S2: Use tools to match the retrieval execution plan with the policy library to obtain a set of candidate firewall policies.
[0024] A strategy library is a database containing a massive number of strategies.
[0025] The candidate firewall policy set is a small set of firewall policies that are highly relevant to the business scenario.
[0026] In some embodiments, the processor can perform initial screening (hard filtering) based on tool calls. The Agent, according to the execution plan, concurrently or sequentially calls the retrieval tool to perform precise matching within the existing policy library, obtaining a preliminary set of candidate policies. This step reduces the massive policy library to a small set highly relevant to the business scenario. For example, it calls a graph database retrieval tool to find all policy nodes with Port=3306, returning a candidate policy set S0.
[0027] S3: Construct a dynamic hypergraph based on a set of candidate firewall policies.
[0028] A dynamic hypergraph is a dynamically changing hypergraph with address and policy association structures.
[0029] In some embodiments, the processor can analyze each specific policy in the candidate firewall policy set as a node. If two policies share the same source address set and destination address set, a connection is established. If the destination address set of one policy intersects with the source address set of another policy, a directed connection is established to obtain the connection relationship. The specific address object is used as a hyperedge to connect all policy nodes involving that address to obtain the address and policy association structure. Based on the connection relationship and association structure, a dynamic hypergraph is constructed.
[0030] Figure 2 The system's key technology—"two-stage retrieval"—is analyzed in detail. The first stage is "hard filtering," where the system first understands the user's natural language query, decomposes the query intent, and extracts key search conditions such as source IP and destination port. Then, it uses graph database retrieval tools to quickly filter out a preliminary set of policy candidates. The second stage is "soft matching," which constructs a hypergraph for the filtered candidate set and uses a hypergraph neural network to generate high-dimensional vector representations of the policies. By calculating the similarity of these vectors, the system further refines the most relevant Top-K policy set from the candidate set and stores the results in a cache for subsequent fast retrieval, thus achieving efficient and accurate policy retrieval.
[0031] In some embodiments, such as Figure 2As shown, the processor can construct a dynamic hypergraph model based on the candidate policy set, using the address (IP) relay relationship as a foundation, to represent the traffic relay relationship between policies. Specifically, the processor can treat each specific firewall policy as a node; if two policies share the same source IP set or destination IP set, a connection is established; if the destination IP set of policy A intersects with the source IP set of policy B, it is considered that there is a "traffic relay" or "stepping stone" relationship, and a directed connection (StrategyA->StrategyB) is established; the specific IP object is regarded as a hyperedge, connecting all policy nodes involving that IP to form an "IP-policy" association structure, thus obtaining the dynamic hypergraph.
[0032] S4: Graph sampling and subgraph extraction based on node degree. The dynamic hypergraph is sampled to obtain multiple local subgraphs.
[0033] A local subgraph is a subgraph consisting of a single core anchor node and all its directly connected neighbor nodes.
[0034] In some embodiments, the processor can perform graph sampling and subgraph extraction based on node degree: in order to focus on core risk areas, the constructed hypergraph is sampled to obtain local subgraphs.
[0035] In some embodiments, the processor may implement S4 based on the following steps.
[0036] S410: Based on the degree of all policy nodes in the dynamic hypergraph, select the policy nodes with the highest degree for sampling to obtain the core anchor points.
[0037] The core anchor point is the strategy node with the highest degree.
[0038] In some embodiments, the processor can calculate the degree of all policy nodes in the graph. The higher the degree, the more complex the IP relay relationship involved in the policy, which is often a "hub" or "bridge" in the network. The top-K policy nodes with the highest degree are selected as core anchor points.
[0039] In some embodiments, the processor can read the JSON data of S0; each node represents an independent firewall policy rule; if the destination address set of policy 1 and the source address set of policy 2 have a non-empty intersection, then a directed edge is established from policy 1 to policy 2; given the large scale of the entire network policy graph, direct calculation of loops is highly complex, so an asset-centric sampling algorithm is required; let A be the core asset IP set, and define the seed policy set S as all policies involving core assets.
[0040] In some embodiments, the processor can select multiple policy nodes with the highest degree based on the degree of all policy nodes in the dynamic hypergraph, and use an asset-centric sampling algorithm to sample them to obtain core anchor points.
[0041] In some embodiments, the expression for the core anchor point is: ; ; in, Indicates the core anchor point. This represents the i-th strategy. Represents the strategy node, Indicates the source IP address of the policy. ( ) represents the target IP address of the strategy. Represents the set of core asset addresses. express, This represents the j-th strategy.
[0042] S420: Extract the core anchor point and all neighboring nodes directly connected to the core anchor point to obtain multiple high-density local subgraphs.
[0043] In some embodiments, the processor can extract the Top-K nodes and all their directly connected neighbor nodes (first-order neighborhoods) to form several high-density local subgraphs.
[0044] In some embodiments, the processor can perform k-hop neighborhood sampling based on S to extract the induced subgraph; in the sampled subgraph G sub A depth-first search is performed to extract closed-loop structures. Threats are graded based on graph topology features; the existence of loops means that attackers can use the "head-to-tail" connection between policies to achieve loop penetration or multi-hop persistent presence in the internal network. Policy loops are defined as closed paths in the graph; the system outputs the set of all identified loops L={C1, C2…} and converts it into a natural language description (e.g., "Policy A allows access to IPx, and policy B allows IPx to access the source of policy A, forming a backlink risk"), which serves as a high-priority input for subsequent large-scale model audits; where L represents the set of loops, C1 represents the first loop, and C2 represents the second loop.
[0045] In some embodiments, the processor can perform k-hop neighborhood sampling based on the core anchor point and all neighboring nodes directly connected to the core anchor point to obtain an induced subgraph; extract the closed-loop structure of the induced subgraph, and classify the threat based on the graph topology features to obtain multiple high-density local subgraphs.
[0046] The induced subgraph is a subgraph after k-hop neighborhood sampling.
[0047] In some embodiments, the expression for a local subgraph is: ; in, - This represents the individual firewall policy nodes that make up this local loop subgraph. express, express, ( () represents the set of target IP addresses for strategy k. ( The set of source IP addresses for strategy k+1.
[0048] S5: Utilize loop structure extraction and attack pattern mapping to extract paths using graph algorithms in local subgraphs, resulting in a policy node feature matrix containing closed-loop paths and long-chain paths.
[0049] The strategy node feature matrix is a matrix structure that includes closed-loop paths and long-chain paths.
[0050] In some embodiments, the processor can exhaustively extract all closed-loop paths and long-chain paths in the extracted local subgraph using graph algorithms (such as Depth-First Search, DFS) to obtain the policy node feature matrix. For example, the processor can perform HGNN convolution on the input feature semantics (policy name and policy annotation information embedding) and breadth level, excluding specific IP values, to obtain an updated policy vector representation, which serves as the policy node feature matrix.
[0051] In some embodiments, the expression for the policy node feature matrix is: ; in, This represents the feature matrix of the policy nodes in the (l+1)th layer. Represents a non-linear activation function. Represents the policy node degree matrix. Represents the hypergraph incidence matrix. Represents the hyperedge weight matrix. Represents the hypermarginality matrix. Represents the transpose of the hypergraph incidence matrix. This represents the feature matrix of the policy nodes in layer l. This represents the learnable parameter matrix.
[0052] Let N and C represent the policy node feature matrices of the l-th and (l+1)-th layers, respectively, with dimensions N x C (N is the number of policy nodes, and C is the feature dimension).
[0053] This represents a nonlinear activation function (such as LeakyReLU), used to introduce nonlinear transformations and enhance the expressive power of the model.
[0054] This represents the hypergraph association matrix, with dimensions N x M (M being the total number of hyperedges such as IP addresses and ports). If policy i contains object j, then Hij = 1; otherwise, it is 0. This matrix is the core of the "de-IPization" design and is responsible for implicitly encoding the network topology.
[0055] Represents the hyperedge weight matrix. The importance of adjusting different types of hyperedges (such as IP hyperedges vs. port hyperedges).
[0056] Represents the policy node degree matrix. . This represents the number of hyperedges connected by strategy i, used for normalization to prevent nodes with high degree from having excessively large features.
[0057] This represents the hyperedge degree matrix (diagonal matrix). . This represents the number of policies containing object j, used to suppress the feature weights of high-frequency objects (such as AnyIP) to prevent oversmoothing.
[0058] This represents a learnable parameter matrix used for linear transformation and feature extraction of the aggregated features.
[0059] In some embodiments, the processor can employ a lateral scanning mode to identify radial structures or short loops that are “one-to-many” and reveal potential lateral scanning behavior; or a relay breakthrough mode to identify loop structures that are “A->B->C->A” or multi-hop cascaded. Such structures reveal that traffic may bypass access control by hopping through multiple strategies at multiple levels, which is a typical “stepping stone attack” feature, and obtains all closed-loop paths and long chain paths.
[0060] In the firewall policy construction graph, there is a significant correspondence between the topology and the potential threat level. Non-loop structure (low threat): As shown in the figure, when policy nodes only exhibit simple divergent or convergent patterns (e.g., the relationship between nodes 5, 6 and node 1 in the figure), it often represents only a single-dimensional "same source" or "same destination" association. This usually corresponds to ordinary lateral scanning behavior, with a single attack path, relatively limited threat level, and easy identification. Loop structure (high threat): Conversely, closed-loop structures often reveal deeper policy coupling. This structure not only includes the "same source / same destination" characteristic, but more importantly, reveals a mixed mode of "relay attack" and "strong lateral sweep." The existence of loops means that attackers may use the jump relationships between policies to achieve looping or multi-hop access for internal network penetration. Therefore, the system marks the "looped" subgraph as a key investigation target, enabling it to prioritize the identification of complex paths with high attack potential from a massive number of policies.
[0061] S6: Utilize the large-scale analysis model to process the feature matrix of policy nodes, obtain the firewall policy audit results, and complete the audit of firewall policies.
[0062] Firewall policy audit results are the final audit report reflecting whether there are compliance risks (such as bypassing the quarantine zone, unauthorized lateral movement) in the path.
[0063] In some embodiments, the processor can transform the extracted topology (policy node feature matrix) into text understandable by the large language model. Specifically, the processor can convert loop paths in the policy node feature matrix into natural language description sequences (e.g., "Policy ID: 101 (Allow test zone access to jump server) -> IP overlap -> Policy ID: 205 (Allow jump server access to core library)"). The flattened path description is used as Prompt input for large model analysis. The model, combined with policy notes and business descriptions, determines whether the path poses compliance risks (such as bypassing quarantine zones or unauthorized lateral movement) and generates a final audit report.
[0064] Figure 3 The core analysis engine of the audit system was highlighted. The system's input sources include user query intent, audit history, and a hypergraph structure stored in the cache. The analysis process integrates traditional rule-based analysis methods with deep learning methods based on hypergraph neural networks, working in parallel. The analysis engine executes multiple tasks, including path tracing, zombie policy identification, high-risk / overlapping / cross-policy identification, policy attribution inference, least privilege compliance detection, and policy equivalence analysis, by calling various functional modules (toolkits). Finally, the system integrates the analysis results and outputs an audit report and specific optimization suggestions.
[0065] Figure 4The system's data flow and workflow are described from a macro perspective. First, the system receives traffic information and policy files, which are stored and managed through a graph database. After the user inputs the audit objectives, the system extracts semantic and key information through a "two-stage retrieval" module, using hard filtering (graph database retrieval) and soft matching (hypergraph neural network) techniques to obtain relevant data. Subsequently, the analysis module uses a toolkit to process this data and performs a comprehensive assessment based on audit history records. Finally, the generated audit analysis results and optimization suggestions are not only fed back to the user but also used to optimize existing policy files and the graph database, and stored in the history record module, forming a closed-loop self-optimization system.
[0066] In some embodiments, such as Figure 3 and Figure 4 As shown, the processor can calculate policy feature vectors and store them in a vector cache, awaiting analysis based on hypergraph features. Without requiring user input of specific queries, the system automatically performs batch dynamic graph construction on all policies of a firewall; it obtains high-dimensional vectors of all policies after HGNN convolution. Inputting an isolated forest model; if the path length of policy A is significantly shorter than the average (easily isolated), it is identified as an outlier; analysis reveals that policy A's characteristics are "source IP=Any, destination port=Any," connecting numerous hyperedges in the hypergraph, causing its vector magnitude and direction to differ significantly from normal policies (typically, policies only connect a few specific IPs); policy A is automatically marked as "violating the principle of least privilege," and an audit report is generated and fed back to the user.
[0067] Actual cybersecurity strategies are not isolated; high-risk strategies often exhibit a strongly correlated clustered distribution. Full Coverage: Extracting the loop structure typically naturally includes the core strategy set. Because logical errors or attack paths between strategies are usually continuous and interdependent, loop extraction can completely capture these strongly correlated strategy sets, avoiding the omission of critical nodes. Automatic Noise Reduction: For "isolated" strategies outside the loop, their hub role in the overall attack chain is weak due to their lack of deep interaction with other strategies (i.e., inability to form a closed loop). This method automatically filters out this secondary information by prioritizing loop extraction, allowing security auditors to focus on truly destructive strategy combinations, thereby significantly improving audit efficiency.
[0068] In some embodiments of this specification, a firewall policy auditing method based on policy hypergraph construction and loop feature mining is provided. By constructing address relay relationships and extracting loops, it can directly reproduce the attack path of hackers using multi-layer firewall policies to perform multi-level pivoting. Through degree-based sampling, it can automatically identify the hub policies with the most complex connection relationships in the network. These policies are often the inevitable paths for hackers to perform lateral scanning of the internal network. Loop analysis of these policies can effectively identify the hidden dangers of excessive privileges. Compared with the obscure neural network vector distance, the present invention finally outputs a specific path description of "A->B->C", which allows operation and maintenance personnel to intuitively see how traffic penetrates the network, greatly reducing the difficulty of handling.
Claims
1. A firewall policy auditing method based on policy hypergraph construction and loop feature mining, characterized in that, include: S1: Decompose the user request into multiple atomic retrieval subtasks, generate them based on logical dependencies, and obtain the retrieval execution plan; S2: Use tools to match the retrieval execution plan with the policy library to obtain a set of candidate firewall policies; S3: Construct a dynamic hypergraph based on a set of candidate firewall policies; S4: Graph sampling and subgraph extraction based on node degree: Sampling of dynamic hypergraph to obtain multiple local subgraphs; S5: Utilize loop structure extraction and attack pattern mapping, and use graph algorithms to extract paths in local subgraphs to obtain a policy node feature matrix containing closed loop paths and long chain paths. S6: Utilize the large-scale analysis model to process the feature matrix of policy nodes, obtain the firewall policy audit results, and complete the audit of firewall policies.
2. The firewall policy auditing method based on policy hypergraph construction and loop feature mining according to claim 1, characterized in that, S3 includes: Each specific policy in the candidate firewall policy set is treated as a node and analyzed. If two policies share the same source address set or destination address set, a connection is established. If the destination address set of one policy intersects with the source address set of another policy, a directed connection is established to obtain the connection relationship. By using a specific address object as a hyperedge, all policy nodes involving that address are connected to obtain the relationship structure between the address and the policy. Dynamic hypergraphs are constructed based on connection relationships and association structures.
3. The firewall policy auditing method based on policy hypergraph construction and loop feature mining according to claim 1, characterized in that, S4 includes: S410: Based on the degree of all policy nodes in the dynamic hypergraph, select the policy nodes with the highest degree for sampling to obtain the core anchor points; S420: Extract the core anchor point and all neighboring nodes directly connected to the core anchor point to obtain multiple high-density local subgraphs.
4. The firewall policy auditing method based on policy hypergraph construction and loop feature mining according to claim 3, characterized in that, S410 includes: Based on the degree of all policy nodes in the dynamic hypergraph, select the policy nodes with the highest degree and use an asset-centric sampling algorithm to obtain the core anchor points.
5. The firewall policy auditing method based on policy hypergraph construction and loop feature mining according to claim 4, characterized in that, The expression for the core anchor point is: ； ； in, Indicates the core anchor point. This represents the i-th strategy. Represents the strategy node, Indicates the source IP address of the policy. ( ) represents the target IP address of the strategy. Represents the set of core asset addresses. express, This represents the j-th strategy.
6. The firewall policy auditing method based on policy hypergraph construction and loop feature mining according to claim 3, characterized in that, The S420 includes: Based on the core anchor point and all neighboring nodes directly connected to the core anchor point, k-hop neighborhood sampling is performed to obtain the induced subgraph; The closed-loop structure of the induced subgraph is extracted, and the threat is classified based on the topological features of the graph, resulting in multiple high-density local subgraphs.
7. The firewall policy auditing method based on policy hypergraph construction and loop feature mining according to claim 6, characterized in that, The expression for the local subgraph is: ； in, - This represents the individual firewall policy nodes that make up this local loop subgraph. express, express, ( () represents the set of target IP addresses for strategy k. ( The set of source IP addresses for strategy k+1.
8. The firewall policy auditing method based on policy hypergraph construction and loop feature mining according to claim 1, characterized in that, The expression for the feature matrix of the strategy node is: ； in, This represents the feature matrix of the policy nodes in the (l+1)th layer. Represents a non-linear activation function. Represents the policy node degree matrix. Represents the hypergraph incidence matrix. Represents the hyperedge weight matrix. Represents the hypermarginality matrix. Represents the transpose of the hypergraph incidence matrix. This represents the feature matrix of the policy nodes in layer l. This represents the learnable parameter matrix.