Security policy recommendation method and device based on urgent calculation, equipment and medium

Abstract

The invention relates to a security policy recommendation method and device based on urgent calculation, equipment and a storage medium. The method comprises the following steps: collecting security activity data, wherein the security activity data comprises file circulation data, equipment access record data and violation event data; extracting feature data related to urgency calculation from the security activity data; performing urgency calculation based on the feature data to obtain an urgency type and a corresponding urgency score; acquiring a preset security policy generation template corresponding to the urgency type and the urgency score; and generating a recommended target security policy based on the security policy generation template.

Description

Security strategy recommendation method, apparatus, equipment, and medium based on urgency calculation Technical Field

[0001] This invention relates to the field of computer technology, and in particular to a method, apparatus, device, and storage medium for recommending security strategies based on urgency calculation. Background Technology

[0002] As digital transformation deepens, enterprise information systems face increasingly complex and diverse security threats. To address these threats, administrators rely on various security strategies to control risks. Traditional security strategy configuration and adjustment primarily depend on administrators' personal experience in manually analyzing logs and alerts, followed by manual policy formulation. This method is inefficient, suffers from long response delays, and, limited by individual experience, makes it difficult to guarantee the accuracy and consistency of the strategies.

[0003] While existing technologies offer solutions for automatically recommending security strategies—for example, patent application CN120449079A discloses a security strategy recommendation method—this method constructs a subject domain feature matrix and an object type feature matrix based on context-aware information. It then clusters the subject domain feature matrix into domains and the object type feature matrix into object types, resulting in two recommendation rules. The intersection of these two rules yields the recommended security strategy. However, this approach relies on static permission similarity for clustering and recommendation, lacking awareness and response to dynamic security events (such as violations) and their urgency.

[0004] Patent application CN119496663A discloses an access control policy recommendation method. This method classifies and determines business relationships based on access information and an access control policy model, generates policies based on these relationships, determines an initial access control policy, evaluates the initial access control policy against preset indicators, determines the indicator evaluation results, and recommends access control policies based on these results. This approach focuses on generating whitelist policies based on asset access relationships and preset indicators, but it does not consider the dynamic risks of security incidents (such as violations) and their urgency.

[0005] Therefore, how to quantify the urgency of risks based on security activity data and generate timely security strategies has become a technical problem that urgently needs to be solved by those skilled in the art. Summary of the Invention

[0006] In view of the above, the present invention provides a security policy recommendation method, apparatus, device and storage medium based on urgency calculation, the purpose of which is to solve the above-mentioned technical problems.

[0007] In a first aspect, the present invention provides a security policy recommendation method based on urgency calculation. The method includes: collecting security activity data, including file transfer data, device access record data, and violation event data; extracting feature data related to urgency calculation from the security activity data; performing urgency calculation based on the feature data to obtain urgency type and corresponding urgency score, wherein the urgency calculation is used to quantify the severity, probability of occurrence, and urgency of improvement of security events; obtaining a preset security policy generation template corresponding to the urgency type and urgency score; and generating a recommended target security policy based on the security policy generation template.

[0008] In some embodiments, extracting feature data related to urgency calculation from security activity data includes: preprocessing the security activity data; extracting key features from the preprocessed data using feature engineering methods; the key features include resource flow frequency, equipment behavior anomaly indicators, and event time series patterns; and normalizing the extracted key features to obtain the feature data.

[0009] In some embodiments, the step of extracting key features from the preprocessed data using feature engineering methods includes: obtaining the file identifier, source address, target address, and timestamp from the file flow data; for each file identifier, counting the number of times the file identifier flows from a single source address to different target addresses within a preset time window to obtain the initial flow count; and based on the initial flow count and the duration of the preset time window, calculating the average flow count per unit time to determine the resource flow frequency.

[0010] In some embodiments, the step of extracting key features from the preprocessed data using feature engineering methods includes: obtaining the access time, access location, and access duration of the target device in a historical period from the device access record data, and generating a behavioral baseline for the target device; obtaining access behavior data of the target device in the current period; calculating the deviation between the access behavior data in the current period and the behavioral baseline, and using the deviation as an indicator of abnormal device behavior.

[0011] In some embodiments, the step of extracting key features from the preprocessed data using feature engineering methods includes: obtaining the event occurrence timestamps and event types from the violation event data; performing cluster analysis on the event occurrence timestamps based on the event types to identify high-frequency event type clusters that are periodic in the time dimension; and extracting statistical features of the time intervals of the high-frequency event type clusters, using the statistical features as the event time series pattern.

[0012] In some embodiments, the step of calculating urgency based on the feature data to obtain an urgency type and a corresponding urgency score includes: determining urgency calculation parameters based on the feature data; the urgency calculation parameters include a severity parameter, an occurrence probability parameter, and an improvement urgency parameter; establishing an urgency calculation model based on the urgency calculation parameters and calculating a preliminary urgency score; determining the corresponding urgency type according to the score range to which the preliminary urgency score belongs; and weighting and correcting the preliminary urgency score based on the weight coefficient corresponding to the urgency type to obtain the urgency score.

[0013] In some embodiments, obtaining a preset security policy generation template corresponding to the urgency type and urgency score includes: querying a basic policy template matching the urgency type from a policy knowledge base, wherein the basic policy template includes policy actions, implementation scope variables, and implementation condition variables; determining a policy strength parameter and an effective time limit parameter corresponding to the urgency score from a policy parameter mapping table based on the urgency score; and filling the policy strength parameter and the effective time limit parameter into the corresponding variables of the basic policy template to generate the security policy generation template.

[0014] Secondly, the present invention provides a security policy recommendation device based on urgency calculation. This device includes: a collection module for collecting security activity data, including file transfer data, device access record data, and violation event data; an extraction module for extracting feature data related to urgency calculation from the security activity data; a calculation module for performing urgency calculation based on the feature data to obtain an urgency type and a corresponding urgency score, wherein the urgency calculation is used to quantify the severity, probability of occurrence, and urgency of improvement of a security event; an acquisition module for acquiring a preset security policy generation template corresponding to the urgency type and urgency score; and a generation module for generating a recommended target security policy based on the security policy generation template.

[0015] Thirdly, the present invention provides an electronic device, including a processor, a communication interface, a memory, and a communication bus, wherein the processor, the communication interface, and the memory communicate with each other through the communication bus; the memory is used to store computer programs; and the processor, when executing the program stored in the memory, implements the steps of the security policy recommendation method based on urgency calculation as described in any embodiment of the first aspect.

[0016] Fourthly, a computer-readable storage medium is provided having a computer program stored thereon, which, when executed by a processor, implements the steps of the security policy recommendation method based on urgency calculation as described in any embodiment of the first aspect.

[0017] Compared with the prior art, the above-mentioned technical solutions provided by the embodiments of the present invention have the following advantages: (1) By quantifying the urgency of risks through dynamic security activity data, and automatically generating targeted and timely security strategies accordingly, an automated decision-making link from security event data to differentiated and executable strategies is realized, significantly improving response efficiency. (2) By quantifying the severity, probability of occurrence and urgency of improvement of events, the abstract concept of urgency is transformed into specific urgency scores and urgency types, so that strategy recommendations no longer rely on vague experience judgments, but are based on objective data, greatly improving the accuracy and reliability of recommendations. (3) Based on the matching strategy templates and parameters of scores and types, the generated strategies are both flexible and interpretable, and can provide response strength and time limits that are precisely matched with the threat level, avoiding insufficient or excessive response. Attached Figure Description

[0018] The accompanying drawings, which are incorporated in and form part of this specification, illustrate embodiments consistent with the invention and, together with the description, serve to explain the principles of the invention.

[0019] To more clearly illustrate the technical solutions in the embodiments of the present invention or the prior art, the drawings used in the description of the embodiments or the prior art will be briefly introduced below. Obviously, for those skilled in the art, other drawings can be obtained based on these drawings without creative effort.

[0020] Figure 1 is a flowchart of a preferred embodiment of the security policy recommendation method based on urgency calculation of the present invention; Figure 2 is a module diagram of a preferred embodiment of the security policy recommendation device based on urgency calculation of the present invention; Figure 3 is a schematic diagram of a preferred embodiment of the electronic device of the present invention; The realization of the purpose, functional features and advantages of the present invention will be further explained in conjunction with the embodiments and with reference to the accompanying drawings. Detailed Implementation

[0021] To make the objectives, technical solutions, and advantages of this invention clearer, the invention will be further described in detail below with reference to the accompanying drawings and embodiments. It should be understood that the specific embodiments described herein are merely illustrative and not intended to limit the invention. All other embodiments obtained by those skilled in the art based on the embodiments of this invention without inventive effort are within the scope of protection of this invention.

[0022] It should be noted that the descriptions involving "first," "second," etc., in this invention are for descriptive purposes only and should not be construed as indicating or implying their relative importance or implicitly specifying the number of technical features indicated. Therefore, a feature defined with "first" or "second" may explicitly or implicitly include at least one of that feature. Furthermore, the technical solutions of the various embodiments can be combined with each other, but this must be based on the ability of those skilled in the art to implement them. If the combination of technical solutions is contradictory or impossible to implement, it should be considered that such a combination of technical solutions does not exist and is not within the scope of protection claimed by this invention.

[0023] Referring to Figure 1, a flowchart illustrating an embodiment of the security policy recommendation method based on urgency calculation of the present invention is shown. This method is executed by an electronic device, which can be implemented by a software system and / or a hardware system. The security policy recommendation method based on urgency calculation includes: Step 101, collecting security activity data, which includes file transfer data, device access record data, and violation event data.

[0024] Security activity data refers to records of security-related activities within a computer system or network, including logs or information on various operations, events, and states. For example, in an enterprise network security monitoring system, security activity data may include file transfer records, device connection logs, and security incident reports.

[0025] File circulation data refers to records of activities such as file transfer, sharing, and modification within or between systems, including information such as file source, destination, transfer time, and operation type. For example, a record of an employee downloading a confidential file from an internal server to their personal device includes the filename, downloader's identity, and download timestamp.

[0026] Device access log data refers to records of devices connecting to a network or system, including information such as device identification, connection time, connection location, and device type. For example, a record of an external visitor's laptop accessing the company's wireless network using temporary credentials includes the device's MAC address, access time, and access permission level.

[0027] Violation incident data refers to records of events that violate security policies or rules, including information such as event type, time of occurrence, entities involved, and degree of impact. For example, an event detecting multiple failed login attempts includes the attempting accounts, the number of failures, and the source IP address.

[0028] In some embodiments, security-related data can be collected from various data sources using security devices, logging systems, or monitoring tools.

[0029] Step 102: Extract feature data related to urgency calculation from the security activity data.

[0030] Urgency calculation is a custom calculation method used to quantify the severity, probability of occurrence, and urgency of improvement of security incidents in order to assess the urgency and priority of security incidents.

[0031] Feature data refers to attributes or variables extracted from raw data for specific calculations or analyses.

[0032] In some embodiments, the collected security activity data can be parsed and transformed. Through data preprocessing and analysis techniques, features related to urgency of computation can be filtered, transformed, or calculated. Specifically, this may include operations such as data cleaning, feature selection, and feature engineering.

[0033] In some embodiments, extracting feature data related to urgency calculation from security activity data may include the following operation: S11, preprocessing the security activity data.

[0034] Preprocessing refers to the cleaning, transformation, and integration of raw data to improve data quality and make it more suitable for subsequent analysis.

[0035] Preprocessing operations include handling missing fields, correcting inconsistent data formats, unifying timestamps from different data sources, removing duplicate records, and filtering out irrelevant noise data.

[0036] S12, using feature engineering methods, extract key features from the preprocessed data; the key features include resource flow frequency, equipment behavior anomaly indicators, and event time series patterns.

[0037] Feature engineering is a technique for identifying, extracting, transforming, and constructing meaningful, quantifiable features from raw data. Feature engineering methods include statistical computation, pattern recognition algorithms, and time window analysis.

[0038] Resource circulation frequency refers to the number of times a specific resource (such as files, data, network connections, etc.) is accessed, transmitted, or manipulated within a specific time period. It is used to measure the activity and attention a resource receives.

[0039] Device behavior anomaly index is a metric used to quantify the degree to which a specific device's behavior pattern deviates from a preset normal behavior pattern or historical baseline behavior pattern. For example, if an internal server suddenly attempts to download a large file from an external IP address at 2 AM, its behavior anomaly index is higher compared to its usual pattern of only receiving data from internal IP addresses during working hours.

[0040] Event time series patterns refer to the regular characteristics of the order, interval, cycle, or trend of security events occurring over time.

[0041] In some embodiments, feature engineering methods can be applied to analyze, calculate, and transform preprocessed security activity data to extract key features characterizing the security situation.

[0042] In some embodiments, the step of extracting key features from the preprocessed data using feature engineering methods may include: S21, obtaining the file identifier, source address, destination address, and timestamp from the file transfer data.

[0043] File transfer data refers to the recorded data generated by operations such as file transfer, sharing, copying, or moving in a computer system or network.

[0044] A file identifier is a string or code used to uniquely distinguish different files; it can be a filename, a file hash value, or a globally unique identifier.

[0045] The source address refers to the network location, device identifier, or storage location of the starting point of the file transfer operation.

[0046] The destination address refers to the network location, device identifier, or storage location of the file transfer operation.

[0047] A timestamp is a time information that records the specific date and time when a file transfer operation occurs.

[0048] In some embodiments, the values ​​of the file identifier field, source address field, destination address field, and timestamp field contained in each record can be read or parsed from the preprocessed file flow data records.

[0049] S22, for each file identifier, count the number of times the file identifier flows from a single source address to different target addresses within a preset time window to obtain the initial number of flows.

[0050] A preset time window is a continuous period of time that is pre-defined for data statistics and analysis.

[0051] The initial flow count is the total number of times an event occurs within a preset time window, for a specific file identifier and a specific source address, that the file flows from the source address to different target addresses.

[0052] In some embodiments, the file identifier and source address can be used as a combination of conditions to filter and aggregate the preprocessed file transfer data to obtain the initial number of transfers.

[0053] S23, based on the initial number of transfers and the duration of the preset time window, calculate the average number of transfers per unit time to determine the resource transfer frequency.

[0054] The average number of cycles per unit time is the ratio obtained by dividing the initial number of cycles by the duration of the preset time window.

[0055] Resource circulation frequency refers to the final characteristic value that represents the activity level or rate of file resource circulation.

[0056] In some embodiments, the initial number of transfers for a specific file identifier and a specific source address can be divided by the duration represented by a preset time window to obtain the resource transfer frequency.

[0057] In some embodiments, the step of extracting key features from the preprocessed data using feature engineering methods may further include: S31, obtaining the access time, access location, and access duration of the target device within a historical period from the device access record data, and generating the behavioral baseline of the target device.

[0058] The target device refers to the specific device entity selected for behavioral analysis and monitoring. The historical period refers to a past timeframe used to analyze and establish reference standards for normal device behavior patterns. Access time refers to the specific moment the device connects to the network or system. Access location refers to the network address, physical port identifier, or geographical area identifier used by the device when connecting to the network. Access duration refers to the duration the device remains online after connecting and disconnecting.

[0059] A behavioral baseline is a reference standard that represents the normal or typical behavior pattern of a target device, obtained by statistical analysis or learning from its access behavior data (access time, access location, access duration) over a historical period. For example, the behavioral baseline of a target device can be described as accessing the company's internal wired network between 8:30 and 9:30 a.m. on weekdays (Monday to Friday) and disconnecting between 5:30 and 6:30 p.m., with a daily access duration of approximately 8 to 9 hours.

[0060] In some embodiments, all access records related to the target device and whose timestamps fall within the historical period can be filtered from the preprocessed device access record dataset. The values ​​of the access time, access location, and access duration fields of each record can be extracted from the filtered records. A reference standard, i.e., a behavior baseline, that can characterize the normal access behavior pattern of the target device can be constructed through statistical analysis, pattern induction, or model training.

[0061] S32, Obtain the access behavior data of the target device in the current period.

[0062] The current cycle refers to a period of time relative to the historical cycle, which is usually a recent or ongoing period that needs to be analyzed and evaluated.

[0063] Access behavior data refers to network access-related behavior information of the target device during the current period, including access time, access location, and access duration.

[0064] In some embodiments, all access records generated by the target device within the current period can be queried and extracted from the preprocessed device access record data, and relevant access time, access location and access duration information can be obtained from the access records to obtain the access behavior data of the target device in the current period.

[0065] S33, calculate the deviation between the access behavior data in the current period and the behavior baseline, and use the deviation as the device behavior anomaly indicator.

[0066] Deviation is a quantitative value used to measure the degree of difference or non-compliance between access behavior data in the current period and the historical behavior baseline.

[0067] Equipment behavior anomaly indicators are feature values ​​ultimately used to characterize the degree of abnormality in the behavior of the target equipment.

[0068] In some embodiments, the access behavior data of the target device in the current period can be compared with its historical behavior baseline. For example, by using predefined rules or algorithms, the degree of difference between the current behavior and the expected pattern of the baseline in each dimension can be calculated, and the difference can be integrated into a numerical metric, namely the deviation.

[0069] In some embodiments, the step of extracting key features from the preprocessed data using feature engineering methods may further include: S41, obtaining the event occurrence timestamp and event type from the violation event data.

[0070] The event timestamp refers to the specific date and time when the violation event was recorded or detected by the system.

[0071] Event type is a classification and labeling of a violation event based on its nature, attack method, or scope of impact. For example, violation event types may include "brute-force attack", "malware alert", "unauthorized access attempt", and "data breach alert".

[0072] In some embodiments, the event timestamp field and event type field contained in each record can be read or parsed from the preprocessed violation event data.

[0073] S42, Based on the event type, perform cluster analysis on the event occurrence timestamps to identify high-frequency event type clusters that are periodic in the time dimension.

[0074] Cluster analysis is a data analysis method used to group a set of data objects according to a certain similarity measure.

[0075] Periodicity in the time dimension refers to the characteristic of events repeating regularly at certain time intervals along the time axis. High-frequency event type clusters refer to sets of events identified through cluster analysis that belong to the same event type, occur frequently, and exhibit periodic or dense characteristics in their time distribution.

[0076] In some embodiments, violation event data can be grouped according to event type. For each event type, a clustering analysis algorithm is applied to the event occurrence timestamp data of all events under that type to discover the clustering pattern of timestamps on the time axis. Events that are close in time or follow a certain periodic pattern are aggregated into the same cluster. From all the generated clusters, the clusters containing a large number of events (high frequency) and whose timestamp distribution shows obvious periodic patterns (e.g., daily periodicity, weekly periodicity) are selected, which are the high-frequency event type clusters.

[0077] S43, For the high-frequency event type cluster, extract the statistical features of its time interval, and use the statistical features as the event time series pattern.

[0078] Statistical characteristics are quantitative indicators that describe the distribution characteristics of a set of data, obtained after performing mathematical statistical calculations on the data. For example, statistical characteristics may include the mean, median, maximum, minimum, standard deviation, and variance of time intervals.

[0079] Event time series patterns refer to the numerical characteristics that are ultimately obtained to characterize the occurrence patterns of high-frequency event type clusters in the time dimension.

[0080] In some embodiments, for each identified high-frequency event type cluster, the difference between the timestamps of adjacent events after all events in the cluster are sorted in chronological order of occurrence can be calculated to obtain a series of time interval values. Statistical calculation methods can be applied to this series of time interval values ​​to extract one or more statistical features that can describe their distribution characteristics. The set of statistical features obtained is the event time series pattern corresponding to the high-frequency event type cluster.

[0081] S13, the extracted key features are normalized to obtain the feature data.

[0082] Normalization is used to map feature values ​​of different dimensions and ranges to a unified, standard scale using linear or nonlinear methods. Feature data refers to the set of features used for urgent calculations after normalization.

[0083] In some embodiments, a normalization algorithm can be applied to the extracted key features, namely resource flow frequency, equipment behavior anomaly indicators, and event time series patterns, to transform the original values ​​of each key feature to a predetermined, common numerical range. Common normalization methods include min-max normalization and Z-score normalization.

[0084] Step 103: Based on the feature data, perform urgency calculation to obtain the urgency type and corresponding urgency score. The urgency calculation is used to quantify the severity, probability of occurrence, and urgency of improvement of security incidents.

[0085] Urgency type refers to the category of a security incident based on its nature or characteristics, used to identify the type or priority level of the incident. Urgency score is used to reflect the degree of urgency of a security incident.

[0086] In some embodiments, predefined algorithms or models can be used to analyze feature data to calculate urgency scores and classify urgency types.

[0087] In some embodiments, the urgency calculation based on the feature data to obtain the urgency type and the corresponding urgency score may include the following operation: S51, determining urgency calculation parameters based on the feature data; the urgency calculation parameters include severity parameters, occurrence probability parameters, and improvement urgency parameters.

[0088] Urgency calculation parameters are specific input variables set for urgency calculation, used to quantify different dimensions of a security event. Severity parameters represent the magnitude and depth of the negative impact that a security event, if it occurs or has already occurred, may or may not have caused. Occurrence probability parameters represent the likelihood that a specific security event will occur in the future or is currently occurring, given the current characteristics and context. Improvement urgency parameters represent the urgency and time sensitivity of improvement measures needed to address identified security risks or vulnerabilities.

[0089] In some embodiments, severity parameters, probability of occurrence parameters, and urgency of improvement parameters can be derived or calculated from the input feature data through predefined rules, mapping relationships, or calculation functions.

[0090] S52, establish an urgency calculation model based on the urgency calculation parameters, and calculate the preliminary urgency score.

[0091] The urgency calculation model is a processing framework or mathematical relationship that takes severity parameters, occurrence probability parameters, and improvement urgency parameters as inputs, and outputs a comprehensive quantitative score through specific calculation logic or functions.

[0092] In some embodiments, a pre-defined calculation model can be constructed, which defines the combination relationship and calculation rules among the severity parameter, the probability of occurrence parameter, and the urgency of improvement parameter. The specific values ​​of the severity parameter, the probability of occurrence parameter, and the urgency of improvement parameter are substituted into the model, and the calculation process defined by the model is executed. The calculation result is the preliminary urgency score.

[0093] S53, determine the corresponding urgency type based on the score range to which the preliminary urgency score belongs.

[0094] A score interval is a pre-defined, continuous subrange within the initial urgency score range, with each subrange corresponding to a specific classification. Urgency type refers to the category to which a security incident is assigned based on the score interval to which its initial urgency score belongs, used to identify the level of urgency of the incident.

[0095] In some embodiments, the calculated preliminary urgency score can be compared with multiple predefined score intervals to determine which score interval the score value falls within, and the category identifier pre-associated with the score interval can be identified as the urgency type corresponding to the current security event.

[0096] S54, Based on the weight coefficients corresponding to the urgency type, the preliminary urgency score is weighted and corrected to obtain the urgency score.

[0097] The weighting factor is an adjustment factor associated with each urgency type, used to ultimately amplify or reduce the initial urgency score to reflect the differences in the final urgency of different types of events.

[0098] In some embodiments, based on the determined urgency type, the pre-configured weight coefficient for that urgency type can be found, and the initial urgency score can be multiplied by the weight coefficient to calculate the urgency score.

[0099] Step 104: Obtain a preset security policy generation template corresponding to the urgency type and urgency score.

[0100] Security policy generation templates are predefined frameworks or structures used to generate specific security policy recommendations based on input parameters, including policy content and execution steps.

[0101] In some embodiments, templates matching a given urgency type and urgency score can be retrieved from a storage location, including a database, configuration file, or rule base. Templates are organized as lookup tables, mapping tables, or configuration files, where the keys are the urgency type and score range, and the values ​​are policy templates.

[0102] In some embodiments, obtaining a preset security policy generation template corresponding to the urgency type and urgency score may include the following operations: S61, querying a basic policy template matching the urgency type from a policy knowledge base, wherein the basic policy template includes policy actions, implementation scope variables and implementation condition variables.

[0103] A policy knowledge base is a database or rule base that stores and manages knowledge related to security policies. It contains predefined security policy frameworks or patterns that are available in various scenarios.

[0104] A basic policy template is a policy framework or blueprint stored in the policy knowledge base for a specific type of security issue. It contains the core content of the policy and adjustable parameter placeholders. Policy actions are the specific security measures or operational instructions that need to be executed, as specified in the basic policy template. Scope variables are parameterized placeholders in the basic policy template used to specify the target objects or domains to which the policy applies; their specific values ​​need to be determined when generating the policy.

[0105] In some embodiments, the calculated urgency type can be used as a query condition or index key to perform retrieval and matching operations in a preset strategy knowledge base to find the basic strategy template associated with that urgency type. The strategy knowledge base stores a variety of basic strategy templates, each of which is pre-bound to one or more urgency types. After executing the query, the most relevant or directly matching basic strategy template for the current urgency type can be returned.

[0106] S62, Based on the urgency score, determine the strategy strength parameter and effective time limit parameter corresponding to the urgency score from the strategy parameter mapping table.

[0107] The strategy parameter mapping table is a predefined lookup table or set of mapping rules that reflects the correspondence between urgency scores and specific strategy control parameters.

[0108] The strategy strength parameter is a level or value determined based on the urgency score, used to adjust the intensity of strategy actions. The effective time limit parameter is a timeframe determined based on the urgency score, requiring the strategy to be deployed or produce results within a specified period.

[0109] In some embodiments, the calculated urgency score can be used as input to look up a pre-configured strategy parameter mapping table. In this mapping table, by comparing the numerical range of the urgency score or by calculating through a mapping function, the specific value or level of the strategy strength parameter uniquely corresponding to the score, as well as the specific value of the effective time limit parameter, can be determined.

[0110] S63, fill the policy strength parameter and the effective time limit parameter into the corresponding variables of the basic policy template to generate the security policy generation template.

[0111] The security policy generation template is a policy template with complete parameter values ​​that has been filled in.

[0112] Step 105: Generate a recommended target security policy based on the security policy template.

[0113] A target security strategy is a security measure or action plan generated based on a specific context.

[0114] In some embodiments, urgency type and urgency score can be used as parameters to fill into the security policy generation template to generate specific security policy recommendations.

[0115] Referring to Figure 2, this is a schematic diagram of the functional modules of the security strategy recommendation device 100 based on urgency calculation of the present invention.

[0116] The security policy recommendation device 100 based on urgency calculation described in this invention is installed in an electronic device. Depending on its functions, the security policy recommendation device 100 based on urgency calculation includes a data acquisition module 110, an extraction module 120, a calculation module 130, an acquisition module 140, and a generation module 150. These modules can also be referred to as units, which are a series of computer program segments that can be executed by the processor of an electronic device and perform a fixed function, and are stored in the memory of the electronic device.

[0117] In this embodiment, the functions of each module / unit are as follows: A data acquisition module 110 is used to acquire security activity data, including file transfer data, device access record data, and violation event data; an extraction module 120 is used to extract feature data related to urgency calculation from the security activity data; a calculation module 130 is used to perform urgency calculation based on the feature data to obtain urgency type and corresponding urgency score, wherein the urgency calculation is used to quantify the severity, probability of occurrence, and urgency of improvement of security events; an acquisition module 140 is used to acquire a preset security policy generation template corresponding to the urgency type and urgency score; and a generation module 150 is used to generate a recommended target security policy based on the security policy generation template.

[0118] The specific implementation of the security policy recommendation device based on urgency calculation of the present invention is largely the same as the specific implementation of the security policy recommendation method based on urgency calculation described above, and will not be repeated here.

[0119] Referring to FIG3, a schematic diagram of a preferred embodiment of the electronic device of the present invention is shown.

[0120] The electronic device includes a processor 111, a communication interface 112, a memory 113, and a communication bus 114. The processor 111, communication interface 112, and memory 113 communicate with each other via the communication bus 114. The memory 113 stores computer programs, such as a security policy recommendation program based on urgency calculation. In some embodiments, the processor 111 may be a central processing unit (CPU), a controller, a microcontroller, a microprocessor, or other data processing chip. The processor 111 is typically used to control the overall operation of the electronic device, such as performing data interaction or communication-related control and processing. In this embodiment, the processor 111 is used to run program code stored in the memory 113 or process data.

[0121] The communication interface 112 may optionally include a standard wired interface or a wireless interface (such as a Wi-Fi interface). The communication interface 112 may also be used to establish a communication connection between the electronic device and other electronic devices.

[0122] The memory 113 includes at least one type of readable storage medium, including flash memory, hard disk, multimedia card, card-type memory (e.g., SD or DX memory), random access memory (RAM), static random access memory (SRAM), read-only memory (ROM), electrically erasable programmable read-only memory (EEPROM), programmable read-only memory (PROM), magnetic memory, magnetic disk, optical disk, etc. In some embodiments, the memory 113 may be an internal storage unit of the electronic device, such as the hard disk or memory of the electronic device. In other embodiments, the memory 113 may also be an external storage device of the electronic device, such as a plug-in hard disk, smart media card (SMC), secure digital (SD) card, flash card, etc. of the electronic device. Of course, the memory 113 may include both internal storage units and external storage devices of the electronic device. In this embodiment, the memory 113 is typically used to store the operating system and various computer programs installed on the electronic device, such as the program code of a security policy recommendation program based on urgency calculation. In addition, the memory 113 can also be used to temporarily store various types of data that have been output or will be output.

[0123] Figure 3 shows only an electronic device with components 111-114, but it should be understood that it is not required to implement all of the components shown, and more or fewer components may be implemented instead.

[0124] In one embodiment of the present invention, when the processor 111 executes the program stored in the memory 113, it implements the security policy recommendation method based on urgency calculation provided in any of the foregoing method embodiments, including: collecting security activity data, the security activity data including file flow data, device access record data, and violation event data; extracting feature data related to urgency calculation from the security activity data; performing urgency calculation based on the feature data to obtain urgency type and corresponding urgency score, wherein the urgency calculation is used to quantify the severity, probability of occurrence, and urgency of improvement of security events; obtaining a preset security policy generation template corresponding to the urgency type and urgency score; and generating a recommended target security policy based on the security policy generation template.

[0125] For a detailed explanation of the above steps, please refer to the flowchart in Figure 1 above, which illustrates an embodiment of the security policy recommendation method based on urgency calculation.

[0126] Furthermore, this invention also proposes a computer-readable storage medium that is both non-volatile and volatile. This computer-readable storage medium is any one or any combination of several of the following: hard disk, multimedia card, SD card, flash memory card, SMC, read-only memory (ROM), erasable programmable read-only memory (EPROM), portable compact disc read-only memory (CD-ROM), USB memory, etc. The computer-readable storage medium includes a data storage area and a program storage area. The program storage area stores a security policy recommendation program based on urgency calculation. When executed by a processor, the security policy recommendation program based on urgency calculation performs the following operations: collecting security activity data, including file flow data, device access record data, and violation event data; extracting feature data related to urgency calculation from the security activity data; performing urgency calculation based on the feature data to obtain an urgency type and a corresponding urgency score, wherein the urgency calculation is used to quantify the severity, probability of occurrence, and urgency of improvement of security events; obtaining a preset security policy generation template corresponding to the urgency type and urgency score; and generating a recommended target security policy based on the security policy generation template.

[0127] The specific implementation of the computer-readable storage medium of the present invention is largely the same as the specific implementation of the security policy recommendation method based on urgency calculation described above, and will not be repeated here.

Claims

1. A security policy recommendation method based on urgency calculation, characterized in that, The method includes: collecting security activity data, including file transfer data, device access record data, and violation event data; extracting feature data related to urgency calculation from the security activity data; performing urgency calculation based on the feature data to obtain urgency type and corresponding urgency score, wherein the urgency calculation is used to quantify the severity, probability of occurrence, and urgency of improvement of security events; obtaining a preset security policy generation template corresponding to the urgency type and urgency score; and generating a recommended target security policy based on the security policy generation template.

2. The security policy recommendation method based on urgency calculation as described in claim 1, characterized in that, The step of extracting feature data related to urgency calculation from security activity data includes: preprocessing the security activity data; extracting key features from the preprocessed data using feature engineering methods; the key features include resource flow frequency, abnormal equipment behavior indicators, and event time series patterns; and normalizing the extracted key features to obtain the feature data.

3. The security policy recommendation method based on urgency calculation as described in claim 2, characterized in that, The feature engineering method extracts key features from the preprocessed data, including: obtaining the file identifier, source address, target address, and timestamp from the file flow data; for each file identifier, counting the number of times the file identifier flows from a single source address to different target addresses within a preset time window to obtain the initial flow count; and based on the initial flow count and the duration of the preset time window, calculating the average flow count per unit time to determine the resource flow frequency.

4. The security policy recommendation method based on urgency calculation as described in claim 2, characterized in that, The step of extracting key features from the preprocessed data using feature engineering methods includes: obtaining the access time, access location, and access duration of the target device in a historical period from the device access record data to generate the target device's behavior baseline; obtaining the target device's access behavior data in the current period; calculating the deviation between the access behavior data in the current period and the behavior baseline, and using the deviation as an indicator of abnormal device behavior.

5. The security policy recommendation method based on urgency calculation as described in claim 2, characterized in that, The step of extracting key features from the preprocessed data using feature engineering methods includes: obtaining the event occurrence timestamps and event types from the violation event data; performing cluster analysis on the event occurrence timestamps based on the event types to identify high-frequency event type clusters with periodicity in the time dimension; and extracting statistical features of the time intervals of the high-frequency event type clusters, using the statistical features as the event time series pattern.

6. The security policy recommendation method based on urgency calculation as described in claim 1, characterized in that, The step of calculating urgency based on the feature data to obtain urgency type and corresponding urgency score includes: determining urgency calculation parameters based on the feature data; the urgency calculation parameters include severity parameters, occurrence probability parameters, and improvement urgency parameters; establishing an urgency calculation model based on the urgency calculation parameters and calculating a preliminary urgency score; determining the corresponding urgency type according to the score range to which the preliminary urgency score belongs; and weighting and correcting the preliminary urgency score based on the weight coefficient corresponding to the urgency type to obtain the urgency score.

7. The security policy recommendation method based on urgency calculation as described in claim 1, characterized in that, The step of obtaining a preset security policy generation template corresponding to the urgency type and urgency score includes: querying a basic policy template matching the urgency type from a policy knowledge base, wherein the basic policy template includes policy actions, implementation scope variables, and implementation condition variables; determining the policy strength parameter and effective time limit parameter corresponding to the urgency score from a policy parameter mapping table based on the urgency score; and filling the policy strength parameter and effective time limit parameter into the corresponding variables of the basic policy template to generate the security policy generation template.

8. A security strategy recommendation device based on urgency calculation, characterized in that, The device includes: a data acquisition module for acquiring security activity data, including file transfer data, device access record data, and violation event data; an extraction module for extracting feature data related to urgency calculation from the security activity data; a calculation module for performing urgency calculation based on the feature data to obtain an urgency type and a corresponding urgency score, wherein the urgency calculation is used to quantify the severity, probability of occurrence, and urgency of improvement of security events; an acquisition module for acquiring a preset security policy generation template corresponding to the urgency type and urgency score; and a generation module for generating a recommended target security policy based on the security policy generation template.

9. An electronic device, characterized in that, The system includes a processor, a communication interface, a memory, and a communication bus. The processor, communication interface, and memory communicate with each other via the communication bus. The memory is used to store computer programs. When the processor executes the program stored in the memory, it implements the security policy recommendation method based on urgency calculation as described in any one of claims 1 to 7.

10. A computer-readable storage medium having a computer program stored thereon, characterized in that, When the computer program is executed by the processor, it implements the security policy recommendation method based on urgency calculation as described in any one of claims 1 to 7.

Images