Self-adaptive firewall rule generation method and device based on real-time threat intelligence

Abstract

The invention relates to a self-adaptive firewall rule generation method and device based on real-time threat intelligence, and the method comprises the steps: carrying out the semantic analysis of a threat intelligence text, extracting attack indexes and attack technique and tactics labels, and generating an intelligence triple set and an attack technique and tactics label set; calling a language model to generate candidate rules based on an intelligence analysis result, carrying out credibility scoring, intercepting a low-scoring rule as a high-risk illusion rule, and entering other rules into a to-be-verified set; constructing a digital twinborn shadow sub-domain to perform real-time traffic verification on the rule set to be verified, and dividing the rule set to be verified into an effective rule set and an invalid rule set according to a verification result; constructing a rule dependence graph based on the invalid rule set to perform pollution traceability, and adding nodes with excessive pollution into an isolation list; and cleaning the historical training samples based on the isolation list and the interception rule log, and performing incremental training on the language model to generate an updated model.

Description

Technical Field

[0001] This invention relates to the field of digital information transmission security technology, specifically to an adaptive firewall rule generation method and apparatus based on real-time threat intelligence. Background Technology

[0002] With the continuous evolution of cyberattack methods and the rapid iteration of threat forms, traditional firewalls based on static rule bases are struggling to cope with complex and ever-changing network environments. To improve the real-time performance and accuracy of defense responses, the cybersecurity field has begun exploring the application of artificial intelligence technology to the dynamic generation process of firewall rules. Among these approaches, using large language models to semantically analyze threat intelligence texts and automatically generate corresponding blocking rules has become an important development direction for adaptive firewall technology. These methods attempt to transform unstructured threat information into machine-executable firewall configuration policies by analyzing attack indicators and attack tactics descriptions in intelligence texts, aiming to shorten the response time from threat detection to rule activation.

[0003] However, existing firewall rule generation methods based on large language models have significant drawbacks in practical applications. The probabilistic prediction-based generation mechanism of large language models inherently introduces uncertainty into their output. When generating complex firewall rules, a "hallucination" phenomenon may occur, resulting in rules that appear logically complete but are actually inconsistent with reality or contain semantic biases. More seriously, if these erroneous rules containing such hallucinations are not effectively identified and blocked, they can not only directly cause firewall policies to fail or mistakenly block normal services, but also become erroneous samples in the system's subsequent learning process. As the adaptive system continues to run, these erroneous rules enter the model optimization loop, causing the model to self-reinforce itself on incorrect optimization paths, leading to the propagation and accumulation of hallucinations, ultimately causing a continuous deterioration in the reliability of the entire rule generation system. Summary of the Invention

[0004] Based on this, the purpose of this invention is to provide an adaptive firewall rule generation method based on real-time threat intelligence that can effectively block the illusion propagation chain and ensure the long-term stability and reliability of the rule generation process.

[0005] The objective of this invention is achieved through the following solution:

[0006] In a first aspect, the present invention provides an adaptive firewall rule generation method based on real-time threat intelligence, comprising the following steps:

[0007] S1: Perform semantic analysis on the intelligence text from multiple threat intelligence sources accessed in real time, extract attack indicators, attack patterns and attack tactics tags from the intelligence text, and generate an intelligence triple set and an attack tactics tag set.

[0008] S2: Based on the intelligence triple set and the attack tactics tag set, call the preset second language model to generate candidate rules for attack indicators and divide each candidate rule into trust categories. The candidate rules are divided into high-risk illusion rules and a set of rules to be verified. The high-risk illusion rules are stored in the interception rule log library.

[0009] Among them, the second language model refers to a specialized language model that scores the credibility of the output of a large language model;

[0010] S3: Construct a digital twin shadow domain based on the existing rule set obtained from the current network environment configuration, deploy the rule set to be verified to the digital twin shadow domain and overlay it with the existing rule set, run the overlaid rule set using real-time mirror traffic, and divide the rule set to be verified into a valid rule set and an invalid rule set according to the blocking accuracy and idle time of each rule during the operation.

[0011] S4: Construct a rule dependency graph based on the invalid rule set, trace back along the rule dependency graph to the intelligence source nodes, model instance nodes and training sample nodes that participated in generating the invalid rule set, update the pollution coefficient of each traced node, and add each node whose pollution coefficient exceeds the preset pollution threshold to the pollution isolation list.

[0012] S5: Based on the pollution isolation list and the interception rule log library, the historical training samples of the second language model are screened. The screened pollution samples are identified according to the signal-to-noise ratio to identify the layer to be disturbed and the hybrid loss constraint is superimposed for incremental training to generate the updated second language model.

[0013] Secondly, the present invention provides an adaptive firewall rule generation device based on real-time threat intelligence, which is configured with the following modules:

[0014] The threat intelligence semantic parsing module is used to perform semantic parsing on intelligence texts from multiple threat intelligence sources that are accessed in real time, extract attack indicators, attack patterns and attack tactics tags from the intelligence texts, and generate intelligence triple sets and attack tactics tag sets.

[0015] The candidate rule trust division module is used to generate candidate rules for attack indicators based on the intelligence triple set and the attack tactical tag set, and to divide each candidate rule into trust, splitting the candidate rules into high-risk illusion rules and a set of rules to be verified, and storing the high-risk illusion rules in the interception rule log library.

[0016] Among them, the second language model refers to a specialized language model that scores the credibility of the output of a large language model;

[0017] The twin domain rule verification module is used to construct a digital twin shadow domain based on the existing rule set obtained from the current network environment configuration, deploy the rule set to be verified to the digital twin shadow domain and overlay it with the existing rule set, run the overlaid rule set using real-time mirror traffic, and divide the rule set to be verified into a valid rule set and an invalid rule set according to the blocking accuracy and idle time of each rule during the operation.

[0018] The contaminated node tracing and updating module is used to construct a rule dependency graph based on the invalid rule set, trace back along the rule dependency graph to the intelligence source nodes, model instance nodes and training sample nodes that participated in generating the invalid rule set, update the contamination coefficient of each traced node, and add each node whose contamination coefficient exceeds the preset contamination threshold to the contamination isolation list.

[0019] The incremental training optimization module is used to screen the historical training samples of the second language model based on the pollution isolation list and the interception rule log library. The screened pollution samples are used to identify the layers to be disturbed based on the signal-to-noise ratio calculation and to perform incremental training by superimposing hybrid loss constraints to generate the updated second language model.

[0020] Thirdly, this application provides a computer device, including a memory and a processor, wherein the memory stores a computer program, and the processor executes the computer program to implement any of the above-mentioned adaptive firewall rule generation methods based on real-time threat intelligence.

[0021] Fourthly, this application provides a computer-readable storage medium storing a computer program thereon, which, when executed by a processor, implements any of the above-mentioned adaptive firewall rule generation methods based on real-time threat intelligence.

[0022] In summary, the adaptive firewall rule generation method based on real-time threat intelligence provided in this application effectively blocks the illusion propagation chain of large language models during firewall rule generation by constructing a triple filtering mechanism of rule trust scoring, shadow verification, and pollution source tracing. First, based on the trust division step, the candidate rules generated by the model can be evaluated in real time, directly blocking low-scoring rules to prevent high-risk illusion rules from entering subsequent stages. Second, by using a digital twin shadow domain to verify the effectiveness of rules that pass the initial screening under real traffic conditions, invalid rules with logical deviations or potential false alarms can be identified and excluded without affecting the production network, ensuring the accuracy and reliability of the rule set to be deployed. Third, by constructing a rule dependency graph based on the invalid rule set and tracing the pollution source nodes, the method can accurately locate and isolate low-quality intelligence sources, unstable model instances, and defective training samples, cutting off the reverse propagation path of erroneous rules to the system knowledge base. Finally, by filtering historical training samples based on the pollution isolation list and interception logs, and incrementally optimizing the model through hybrid loss constraints, the stability and anti-interference capability of model generation can be continuously improved. This invention can significantly improve the long-term reliability of adaptive firewall rule generation, ensuring that the system maintains high rule quality throughout continuous operation to cope with dynamically evolving network threat environments.

[0023] To better understand and implement this invention, the following detailed description is provided in conjunction with the accompanying drawings. Attached Figure Description

[0024] Figure 1 A flowchart illustrating an adaptive firewall rule generation method based on real-time threat intelligence, provided for an embodiment of this application;

[0025] Figure 2 This is a schematic diagram of the structure of an adaptive firewall rule generation device based on real-time threat intelligence, provided for another embodiment of this application. Detailed Implementation

[0026] To facilitate understanding of the present invention, a more complete description will be given below with reference to the accompanying drawings. Preferred embodiments of the invention are shown in the drawings. However, the invention can be implemented in many different forms and is not limited to the embodiments described herein. Rather, these embodiments are provided to provide a thorough and complete understanding of the disclosure of the invention.

[0027] Unless otherwise defined, all technical and scientific terms used herein have the same meaning as commonly understood by one of ordinary skill in the art to which this invention pertains. The terminology used herein in the description of the invention is for the purpose of describing particular embodiments only and is not intended to be limiting of the invention. The term "and / or" as used herein includes any and all combinations of one or more of the associated listed items.

[0028] In one embodiment, such as Figure 1 As shown, an adaptive firewall rule generation method based on real-time threat intelligence is provided. This embodiment illustrates the method by applying it to a terminal. It is understood that this method can also be applied to a server, and to devices including both a terminal and a server, and is implemented through interaction between the terminal and the server. In this embodiment, the method includes the following steps:

[0029] S1: Perform semantic analysis on the intelligence text from multiple threat intelligence sources accessed in real time, extract attack indicators, attack patterns, and attack tactical tags from the intelligence text, and generate an intelligence triple set and an attack tactical tag set.

[0030] Specifically, the system establishes a multi-source threat intelligence access interface, connecting multiple heterogeneous threat intelligence sources in real time. The access process employs a standardized data interaction protocol to ensure unified parsing of intelligence texts in different formats. The system includes an intelligence access verification mechanism to initially filter invalid intelligence, preventing invalid data from consuming system resources. A pre-trained large language model is used as the core model for semantic parsing, performing deep semantic analysis on the verified intelligence text. During parsing, the system uses the model's attention mechanism to focus on key information in the intelligence text, accurately extracting attack indicators, attack patterns, and attack tactical tags. Attack indicators are specific identifiable features of threat attacks, attack patterns are specific implementation methods of attack behaviors, and attack tactical tags refer to the tactical and technical classification standards of the MITRE ATT&CK framework. The system performs structured processing on the extracted key information, generating a set of intelligence triples and a set of attack tactical tags. The intelligence triple set adopts a triple structure of attack indicator, attack relationship, and attack target, with each triple containing a unique identifier for subsequent rule generation and association matching. The attack tactics and techniques tag set adopts a structured list format, which includes fields such as tag ID, tag name, tag description, corresponding MITRE ATT&CK tactics / technical ID, and associated intelligence ID.

[0031] S2: Based on the intelligence triple set and the attack tactics tag set, call the preset second language model to generate candidate rules for attack indicators and divide each candidate rule into trust categories. The candidate rules are divided into high-risk illusion rules and a set of rules to be verified. The high-risk illusion rules are stored in the interception rule log library.

[0032] Among them, the second language model refers to a specialized language model that scores the credibility of the output of the large language model.

[0033] Specifically, the second language model is a specialized language model for scoring the credibility of the output of a large language model. It is fine-tuned based on a pre-trained language model, with training samples including historical firewall rules, threat intelligence text, and rule validity annotation data. The second language model's input consists of a set of intelligence triples and a set of attack tactical tags; the output is candidate firewall rules targeting attack indicators and their corresponding credibility scores. The core optimization direction of this model is to improve its ability to identify rule syntax correctness, logical rationality, and intelligence matching degree. This is achieved by introducing a rule syntax verification module and an intelligence correlation calculation module to reduce the uncertainty of the model's output. The system calls the second language model to generate candidate rules. The model combines the attack indicators and attack relationships in the intelligence triples, and refers to the defense requirements corresponding to the attack tactical tags, automatically generating candidate rules that conform to the firewall rule syntax specifications. Candidate rule types include access control list rules, network address translation rules, and intrusion prevention system linkage rules. The rule content clearly includes key parameters such as actions, matching conditions, and activation priority. The system performs trust classification on each candidate rule and sets a preset credibility score threshold, which is determined through statistical analysis based on historical rule verification data. The system classifies candidate rules with credibility scores below a threshold as high-risk hallucination rules, and divides candidate rules with credibility scores above the threshold into a set of rules to be verified. The system stores high-risk hallucination rules in an interception rule log database, which uses a distributed database for storage. The log entries include fields such as rule ID, generation time, associated intelligence ID, second language model score, hallucination type, and interception status.

[0034] S3: Construct a digital twin shadow domain based on the existing rule set obtained from the current network environment configuration, deploy the rule set to be verified to the digital twin shadow domain and overlay it with the existing rule set, run the overlaid rule set using real-time mirror traffic, and divide the rule set to be verified into a valid rule set and an invalid rule set according to the blocking accuracy and idle time of each rule during the operation.

[0035] Specifically, based on the current network environment configuration information, the system constructs a virtual test environment, namely the digital twin shadow domain, that is 1:1 mapped to the real network environment through virtualization technology. During the construction process, the system reads existing rule sets, network topology, and device parameters from network devices such as firewalls, routers, and switches through network protocols, and synchronizes them to the digital twin shadow domain to ensure that the network configuration and rule system of the shadow domain are completely consistent with the real network. The system builds a traffic mirroring module, and uses port mirroring and traffic mirroring tools to synchronously mirror real-time traffic from the real network to the digital twin shadow domain. The mirrored traffic includes normal business traffic and attack traffic to ensure the authenticity and comprehensiveness of the test scenario. The system deploys the rule set to be verified, divided by S2, to the firewall simulation module of the digital twin shadow domain, and uses a rule overlay algorithm to merge the rules to be verified with the existing rule set. During the fusion process, the system performs rule conflict detection, marks conflicting rules, and adjusts them according to preset strategies to avoid rule conflicts from causing test result distortion.

[0036] After deployment, the system initiates real-time mirrored traffic, allowing the superimposed rule set to run in the digital twin shadow domain. The running time is set according to network traffic scenario requirements to ensure coverage of network traffic scenarios at different times. Based on real-time monitoring data during operation, the system calculates the blocking accuracy and idle time of each rule to be verified as evaluation indicators of rule effectiveness. The blocking accuracy is calculated as the ratio of the number of times attack traffic is correctly blocked to the total number of blocks. Correctly blocking attack traffic requires that the blocking behavior completely matches the attack indicators and attack patterns in the threat intelligence, and that normal business traffic is not blocked. Idle time refers to the continuous duration during which a rule does not perform any blocking behavior. The system sets a classification standard based on the evaluation indicators, classifying rules to be verified that meet the valid rule standard into the valid rule set, and those that do not meet the valid rule standard into the invalid rule set. Rules in the middle range are given an extended testing time for secondary verification. If the secondary verification still fails to meet the valid rule standard, they are classified into the invalid rule set.

[0037] S4: Construct a rule dependency graph based on the invalid rule set, trace back along the rule dependency graph to the intelligence source nodes, model instance nodes and training sample nodes that participated in generating the invalid rule set, update the pollution coefficient of each traced node, and add each node whose pollution coefficient exceeds the preset pollution threshold to the pollution isolation list.

[0038] Specifically, the system constructs a directed acyclic rule dependency graph centered on the invalid rule set partitioned by S3. Nodes in the graph include invalid rule nodes, intelligence source nodes, model instance nodes, and training sample nodes, with edges representing the dependencies between nodes. An edge between an invalid rule node and an intelligence source node indicates that the invalid rule was generated by a specific intelligence source; an edge between an invalid rule node and a model instance node indicates that the invalid rule was generated by a specific second language model instance; an edge between a model instance node and a training sample node indicates that the model instance was trained from a specific training sample; and an edge between an intelligence source node and a training sample node indicates that the intelligence source provides data support for a specific training sample. Each node contains attributes such as a unique identifier, node type, and a list of associated nodes to ensure the traceability of the graph. The system employs a depth-first search algorithm, tracing back along the rule dependency graph from the invalid rule node, layer by layer, to all associated nodes involved in generating the invalid rule, including intelligence source nodes, model instance nodes, and training sample nodes. During the tracing process, the system records the number and degree of association of each node with invalid rules, providing a basis for subsequent contamination coefficient calculations.

[0039] Furthermore, the system sets a tracing depth threshold to avoid excessive tracing leading to excessive system resource consumption. The system sets an initial contamination coefficient for each traced node and establishes a contamination coefficient update rule. The contamination coefficient of a node associated with an invalid rule is increased by a preset increment. The contamination coefficient of an intelligence source node is additionally increased by the increment corresponding to the proportion of invalid rules generated by that intelligence source. The contamination coefficient of a training sample node is additionally increased by the increment corresponding to the number of times that sample was called by the model. The contamination coefficient ranges from 0 to 100; a higher value indicates a more severe degree of contamination and a greater negative impact on rule generation. The system presets a contamination threshold, which is determined based on statistical analysis of the impact of historical contamination nodes on rule generation. Nodes with contamination coefficients exceeding the preset threshold are added to a contamination isolation list. The contamination isolation list includes fields such as node ID, node type, contamination coefficient, isolation time, and associated invalid rule ID. During the isolation period, the system prohibits intelligence sources, model instances, and training samples from the isolated list from accessing the list. The system sets a periodic re-examination mechanism for isolated nodes. If the node's contamination coefficient drops below the threshold during the re-examination, it can be removed from the isolation list, restoring its normal usage rights.

[0040] S5: Based on the pollution isolation list and the interception rule log library, the historical training samples of the second language model are screened. The screened pollution samples are identified according to the signal-to-noise ratio to identify the layer to be disturbed and the hybrid loss constraint is superimposed for incremental training to generate the updated second language model.

[0041] Specifically, the system filters historical training samples of the second language model based on the generated contaminated isolation list interception rule log library. The filtering rules include identifying historical training samples associated with intelligence source nodes, model instance nodes, and training sample nodes in the contaminated isolation list as contaminated samples; training samples corresponding to high-risk illusion rules in the interception rule log library are also identified as contaminated samples. Simultaneously, the system filters out historical training samples not associated with any invalid or illusion rules as clean samples to ensure the model's basic performance. The system calculates the signal-to-noise ratio (SNR) of the filtered contaminated samples, which is the ratio of the effective signal strength to the contaminated noise strength. The effective signal strength is the average confidence score of the model output corresponding to the clean samples, and the contaminated noise strength is the average confidence score of the model output corresponding to the contaminated samples. Based on the SNR results, the system identifies the layers in the second language model to be perturbed. A lower SNR indicates a higher sensitivity of a particular layer to contaminated samples; this layer is the layer to be perturbed. The encoder layer in the Transformer architecture is preferentially selected as the layer to be perturbed. This type of layer is responsible for the extraction and transformation of semantic features and is the key layer for generating illusion rules. The system uses clean samples as the main training data and adds an appropriate amount of contaminated samples to incrementally train the second language model.

[0042] During training, the system employs a hybrid loss constraint consisting of cross-entropy loss and mean squared error loss. Cross-entropy loss optimizes the model's classification accuracy for rule credibility scores, ensuring accurate differentiation between valid, invalid, and illusion rules. Mean squared error loss constrains parameter updates in the perturbation layer, preventing overfitting and contaminating samples while preserving the model's original effective features. Training utilizes a mini-batch gradient descent algorithm with appropriate learning rates and iteration counts until the model's loss value stabilizes. After incremental training, the system validates the model's performance using metrics including rule generation accuracy, illusion rule recognition rate, and credibility scoring accuracy. If all validation metrics meet preset standards, the updated second language model replaces the original model. If the preset standards are not met, the hybrid loss constraint parameters, the selection of the perturbation layer, or the training sample ratio are adjusted, and incremental training is repeated. The updated second language model is then used for subsequent candidate rule generation and trust classification, continuously improving the reliability of rule generation and forming a closed-loop adaptive mechanism of rule generation, validation, source tracing, and model optimization.

[0043] In summary, the adaptive firewall rule generation method based on real-time threat intelligence provided in this application effectively blocks the illusion propagation chain of large language models during firewall rule generation by constructing a triple filtering mechanism of rule trust scoring, shadow verification, and pollution source tracing. First, based on the trust division step, the candidate rules generated by the model can be evaluated in real time, directly blocking low-scoring rules to prevent high-risk illusion rules from entering subsequent stages. Second, by using a digital twin shadow domain to verify the effectiveness of rules that pass the initial screening under real traffic conditions, invalid rules with logical deviations or potential false alarms can be identified and excluded without affecting the production network, ensuring the accuracy and reliability of the rule set to be deployed. Third, by constructing a rule dependency graph based on the invalid rule set and tracing the pollution source nodes, the method can accurately locate and isolate low-quality intelligence sources, unstable model instances, and defective training samples, cutting off the reverse propagation path of erroneous rules to the system knowledge base. Finally, by filtering historical training samples based on the pollution isolation list and interception logs, and incrementally optimizing the model through hybrid loss constraints, the stability and anti-interference capability of model generation can be continuously improved. This invention can significantly improve the long-term reliability of adaptive firewall rule generation, ensuring that the system maintains high rule quality throughout continuous operation to cope with dynamically evolving network threat environments.

[0044] In one embodiment, S1 of the adaptive firewall rule generation method based on real-time threat intelligence provided by the present invention specifically includes the following steps:

[0045] S11: Perform sentence segmentation and lexical parsing on the intelligence text from multiple threat intelligence sources accessed in real time. Extract candidate attack indicators from each sentence based on regular expressions. Normalize the format of each candidate attack indicator to generate a set of normalized indicators.

[0046] Specifically, the system receives intelligence text transmitted from multiple threat intelligence sources in real time and processes all intelligence text into sentences. During sentence segmentation, the system breaks down the intelligence text based on natural language punctuation features, ensuring that each sentence contains only a single semantic unit to avoid semantic confusion affecting subsequent indicator extraction. After sentence segmentation, the system performs lexical analysis on each sentence, breaking down the lexical units within the sentence, identifying lexical attributes and relationships between words, filtering meaningless words, and retaining core words related to the threat. Based on preset regular expressions, the system extracts candidate attack indicators from each sentence. These regular expressions are preset to target threat attack-related features and can match various potential attack indicator-related words and combinations. After extraction, the system performs format normalization on each candidate attack indicator, unifying the expression format of various attack indicators and eliminating differences in the expression of the same attack indicator. During format normalization, the system adjusts the character length, expression format, and symbol usage of candidate attack indicators according to preset standardization rules to ensure that the normalized attack indicator format is uniform and recognizable.

[0047] S12: Input the normalized indicator set into the preset first language model for contextual semantic encoding. Calculate the semantic similarity between each indicator and the predefined threat type based on the embedding vector output by the first language model. Mark the indicators with semantic similarity exceeding the preset matching threshold as attack indicators. Generate a structured indicator set containing attack indicators and their type labels. The first language model refers to the encoder model used in the field of network security.

[0048] Specifically, the first language model is a dedicated encoder model for the cybersecurity field. After fine-tuning and training with cybersecurity-related data, it possesses the ability to semantically recognize and encode threat indicators, transforming input attack indicators into semantically meaningful embedding vectors. The system inputs the normalized indicator set generated by S11 into the preset first language model. The first language model performs contextual semantic encoding on each normalized indicator, combining it with semantic features from the cybersecurity field to transform the indicator into a fixed-dimensional embedding vector. This embedding vector accurately represents the semantic connotation and correlation features of the indicator. After encoding, the system calculates the semantic similarity between each indicator and a predefined threat type based on the embedding vectors output by the first language model. The predefined threat types cover various common network attack threat categories. The system uses a semantic similarity algorithm to compare the correlation between the embedding vectors of each indicator and the embedding vectors of the predefined threat types to obtain the semantic similarity results. The system presets a matching threshold, which is determined through statistical analysis based on historical semantic matching data, to distinguish between valid and invalid attack indicators. The system marks indicators with semantic similarity exceeding the preset matching threshold as attack indicators and performs type labeling on the marked attack indicators, with the label content corresponding to the predefined threat type that it successfully matched. The system integrates all tagged attack indicators and their type annotation information to generate a structured indicator set. The structured indicator set adopts a standardized data format and includes core information such as attack indicator identifier, indicator content, type annotation, and related intelligence identifier.

[0049] S13: Based on the context window of the attack indicators in the intelligence text, extract the verb phrases and object phrases associated with the attack indicators, combine the verb phrases and object phrases into attack pattern fragments, perform phrase similarity matching between the attack pattern fragments and the technical nodes in the MITRE ATT&CK framework, use the successfully matched technical nodes as attack tactical tags, and combine the structured indicator set to generate an intelligence triple set and an attack tactical tag set.

[0050] Specifically, the system determines the context window of each attack indicator in the original intelligence text based on the structured indicator set. The scope of the context window is set according to the position of the attack indicator in the text and the semantic relevance requirements, ensuring complete coverage of the actions and target information related to the attack indicator. Within the context window of each attack indicator, the system extracts verb phrases and object phrases associated with the attack indicator. The verb phrases represent the actions performed in the attack, and the object phrases represent the targets of the attack. During the extraction process, the system identifies phrase types through grammatical analysis, filters phrases directly related to the attack, and excludes irrelevant phrases. The system combines the extracted verb phrases and object phrases to form attack pattern fragments, which can completely represent the core implementation logic of the attack. The system performs phrase similarity matching between the generated attack pattern fragments and the technical nodes in the MITRE ATT&CK framework. The MITRE ATT&CK framework contains technical nodes corresponding to various types of network attacks, and each technical node corresponds to a specific attack technique.

[0051] During the matching process, the system uses a phrase similarity algorithm to compare the semantic relevance between attack pattern fragments and various technical nodes, and assigns successfully matched technical nodes as attack tactical tags corresponding to the attack indicator. The system combines a structured indicator set, grouping each attack indicator, its associated attack behavior, and the attack target to generate an intelligence triplet set. Simultaneously, it integrates all attack tactical tags to generate an attack tactical tag set. These two sets are interconnected, providing complete structured key information support for subsequent candidate rule generation.

[0052] In one embodiment, S2 of the adaptive firewall rule generation method based on real-time threat intelligence provided by the present invention specifically includes the following steps:

[0053] S21: Input the intelligence triple set and the attack tactical tag set into the second language model. The decoder based on the second language model generates a text representation of the candidate rules on a token-by-token basis. The candidate rules include source IP conditions, destination IP conditions, protocol type conditions, and blocking actions.

[0054] Specifically, the system uses the intelligence triplet set and attack tactical tag set generated earlier as input data and transmits them to a preset second language model. The second language model has rule generation and semantic parsing capabilities; its decoder module generates rule text according to the token sequence, ensuring that the generated candidate rules conform to firewall rule syntax specifications. The system uses the second language model's decoder to generate the text representation of the candidate rules token by token. During the generation process, it combines attack indicator information from the intelligence triplet set and defense requirements from the attack tactical tag set to ensure a high degree of correlation between the candidate rules and threat intelligence. Candidate rules contain four core components: source IP conditions, destination IP conditions, protocol type conditions, and blocking actions. These components are interconnected and together constitute a complete firewall defense rule. During generation, the system verifies the token sequence output by the decoder in real time to ensure that the rule content corresponding to each token conforms to preset syntax requirements and avoids syntax errors. After each candidate rule is generated, the system assigns it a unique identifier, associating it with the corresponding intelligence triplet identifier and attack tactical tag identifier to ensure rule traceability.

[0055] S22: For each candidate rule, calculate the context relevance score based on the context semantic information in the intelligence triplet, perform rule conflict detection based on the existing rule set in the current network environment configuration parameters to obtain the logical consistency score, dynamically deduct the intelligence source credibility based on the pollution isolation list to obtain the intelligence source credibility score, and weight and aggregate the context relevance score, logical consistency score and intelligence source credibility score to generate a trust score.

[0056] Specifically, the system calculates three core scores for each candidate rule in the complete set of candidate rules, and then generates the final trust score through weighted aggregation. Based on the contextual semantic information in the intelligence triplet, the system calculates the contextual relevance score for each candidate rule. During the calculation, the system compares the semantic correlation between the content of the candidate rule and the context of the intelligence triplet; the higher the correlation, the higher the score. The system obtains the existing rule set from the current network environment configuration parameters and performs rule conflict detection on each candidate rule, checking for conflicts between the candidate rule and the existing rule set in terms of matching conditions, action instructions, etc. Based on the conflict detection results, a logical consistency score is generated; no conflict results in a higher score, and more severe conflicts result in a lower score. The system calls the pollution isolation list to dynamically deduct the trustworthiness of the intelligence source associated with the generated candidate rule. If the associated intelligence source is on the pollution isolation list or is associated with a pollution node, the corresponding deduction is performed, and the intelligence source trustworthiness score is obtained after the deduction. The system performs weighted aggregation of context relevance score, logical consistency score, and intelligence source credibility score. The weighting coefficients are determined through statistical analysis based on historical scoring data. After aggregation, a credibility score is generated for each candidate rule, and the scoring results are used for subsequent rule classification.

[0057] S23: Compare the trust score with the preset low confidence acceptance threshold and high confidence rejection threshold. Candidate rules with a trust score lower than the low confidence acceptance threshold are marked as high-risk illusion rules and stored in the interception rule log library. Candidate rules with a trust score higher than the high confidence rejection threshold are marked as high confidence rules. Candidate rules with a trust score between the low confidence acceptance threshold and the high confidence rejection threshold are marked as low confidence rules to be verified. Merge the high confidence rules and low confidence rules to be verified to generate a set of rules to be verified.

[0058] Specifically, the system presets two scoring thresholds: a low-confidence acceptance threshold and a high-confidence rejection threshold. Both thresholds are determined through statistical analysis based on historical rule validation and classification data, and are used to distinguish candidate rules with different risk levels. The system compares the confidence score of each candidate rule with the two preset thresholds one by one, and classifies the candidate rules according to the comparison results. The system marks candidate rules with confidence scores below the low-confidence acceptance threshold as high-risk illusion rules, and stores these rules in an interception rule log database. The log database records rule-related information and provides contaminated sample data for subsequent incremental model training. The system marks candidate rules with confidence scores above the high-confidence rejection threshold as high-confidence rules; these rules can proceed to the next process without additional validation. The system marks candidate rules with confidence scores between the low-confidence acceptance threshold and the high-confidence rejection threshold as low-confidence rules to be validated; these rules need to be verified for validity through subsequent validation processes. After classification, the system merges high-confidence rules and low-confidence rules to be verified to generate a set of rules to be verified. The set of rules to be verified includes a unique identifier, rule content, confidence score and classification tag for each rule.

[0059] In one embodiment, S3 of the adaptive firewall rule generation method based on real-time threat intelligence provided by the present invention specifically includes the following steps:

[0060] S31: Based on the network topology information, service configuration information and business logic parameters in the current network environment configuration parameters, construct a virtualized network environment as a digital twin shadow domain, deploy the rule set to be verified to the shadow domain and overlay it with the existing rule set in the current network environment configuration parameters to generate the shadow domain rule set.

[0061] Specifically, the system acquires the current network environment configuration parameters, extracts network topology information, service configuration information, and business logic parameters from them, and constructs a virtualized network environment based on these parameters. This virtualized network environment is the digital twin shadow domain. During the construction process, the system completely maps the extracted parameters to the virtualized environment, ensuring that the network structure, service deployment, and business operation logic of the digital twin shadow domain are completely consistent with the current production network, guaranteeing the accuracy and reliability of subsequent rule verification results. The system calls the previously generated set of rules to be verified and deploys it to the firewall simulation module of the digital twin shadow domain. During deployment, the rule format is verified to ensure that the set of rules to be verified can be loaded and run normally in the shadow domain. After deployment, the system extracts the existing set of rules from the current network environment configuration parameters, overlays the existing set of rules with the deployed set of rules to be verified, performs rule conflict detection during the overlay process, identifies and marks conflicting rules, and adjusts the conflicting rules according to a preset strategy to avoid rule conflicts affecting subsequent traffic processing results. After the overlay process is completed, the system integrates and forms a shadow domain rule set. The shadow domain rule set contains all the contents of the existing rule set and the rule set to be verified, and there are no rule conflicts. It provides unified rule support for subsequent mirror traffic processing and rule verification. At the same time, the system associates corresponding identification information with each rule in the shadow domain rule set to ensure that the rules are traceable.

[0062] S32: Real-time mirroring of network traffic from the production network and splitting it into two parallel processing channels. The first channel only loads the existing rule set to process the mirrored traffic, while the second channel loads the shadow domain rule set to process the mirrored traffic. The preset verification cycle is continuously run and the processing logs of the two channels are recorded.

[0063] Specifically, the system mirrors network traffic from the production network in real time, ensuring traffic integrity and real-time performance during the mirroring process, without missing any normal business traffic or potential attack traffic from the production network. The system then distributes the mirrored network traffic to two parallel processing channels. These two channels operate independently without interference, ensuring the independence and comparability of processing results. The first channel loads only the existing rule set from the current network environment configuration parameters to process the mirrored traffic. During processing, it strictly adheres to the matching conditions and action instructions of the existing rule set, recording the detailed process and results of traffic processing. The second channel loads the shadow domain rule set generated by S31 and processes the same batch of mirrored traffic synchronously, following the rules of the shadow domain rule set and synchronously recording the detailed process and results of traffic processing. The system controls both channels to continuously run for a preset verification period. The verification period is set based on network traffic characteristics and rule verification requirements, ensuring coverage of different time periods and different types of traffic scenarios to comprehensively verify the effectiveness of the rules to be verified. During operation, the system records the processing logs of both channels in real time. The log content includes core information such as traffic characteristics, rule matching status, processing actions, and processing results.

[0064] S33: Based on the processing log statistics, calculate the blocking accuracy rate of each candidate rule in the verification period by counting the number of correct blocking and false blocking times. Calculate the idle time ratio by counting the length of time during which each candidate rule is not triggered in the verification period. Multiply the blocking accuracy rate and the idle time ratio to generate a verification score. Add candidate rules with verification scores exceeding the preset verification threshold to the valid rule set, and add candidate rules with verification scores not exceeding the preset verification threshold to the invalid rule set. Record the verification log accordingly.

[0065] Specifically, the system performs verification metric statistics and score calculations for each rule to be verified based on the processing logs of two channels. The system calculates the number of correct and false blocks for each candidate rule within the verification period. The blocking accuracy rate of each candidate rule is calculated by the ratio of the number of correct blocks to the sum of the correct and false blocks. The blocking accuracy rate reflects the rule's ability to identify and block attack traffic. Simultaneously, the system calculates the length of time during which each candidate rule is not triggered within the verification period. The idle time percentage of each candidate rule is calculated by the ratio of the untriggered time period to the total length of the verification period. The idle time percentage reflects the rule's practical application value. The system multiplies the blocking accuracy rate and idle time percentage of each candidate rule to generate a verification score for each candidate rule. The verification score comprehensively reflects the rule's effectiveness and practicality. The system presets a verification threshold, determined through statistical analysis based on historical rule verification data, to distinguish between valid and invalid rules. Candidate rules with verification scores exceeding the preset threshold are added to the valid rule set, while those with scores below the preset threshold are added to the invalid rule set. After classification, the system will record the verification results, verification scores and related statistics of each rule in the verification log. The verification log is linked with the interception rule log library and the contamination isolation list mentioned above.

[0066] In one embodiment, S4 of the adaptive firewall rule generation method based on real-time threat intelligence provided by the present invention specifically includes the following steps:

[0067] S41: Based on the invalid rule set, extract the intelligence source identifier, second language model instance identifier, and historical training sample batch identifier that each invalid rule is based on when it is generated. Use the intelligence source identifier, model instance identifier, and sample batch identifier as nodes, and the generation dependency relationship between nodes and invalid rules as edges to construct a directed rule dependency graph.

[0068] Specifically, the system calls the previously generated set of invalid rules and extracts information from each invalid rule. The extracted information includes the intelligence source identifier, second language model instance identifier, and historical training sample batch identifier upon which each invalid rule was generated. After extraction, the system uses the extracted intelligence source identifier, model instance identifier, and sample batch identifier as the core nodes of the graph, clarifying the type attributes of each node and distinguishing between intelligence source nodes, model instance nodes, and training sample batch nodes. The system defines the generation dependency relationship between nodes and invalid rules as edges in the graph. If a node participates in the generation process of an invalid rule, a directed edge is established between the node and the corresponding invalid rule, with the edge pointing from the node to the invalid rule, thus representing the node's support relationship for the generation of invalid rules. To ensure that the graph accurately reflects the degree of association between nodes and invalid rules, the system introduces a node association degree calculation formula:

[0069]

[0070] in, This represents the degree of association between a node and an invalid rule r. This represents the shortest path length between the node and the invalid rule *r* in the graph. This formula quantifies the degree of association between the node and the invalid rule; a higher association indicates a greater influence of the node on the generation of the invalid rule. Based on the nodes, directed edges, and association degree calculation results, the system constructs a complete directed rule dependency graph. Each node in the graph is associated with its corresponding identifier and type information, and each edge is associated with its corresponding association degree value.

[0071] S42: Based on the directed rule dependency graph, reverse source tracing is performed on each invalid rule. The pollution coefficient increment is calculated based on the number of invalid rules generated by each node and their existence time. The pollution coefficient increment is added to the current pollution coefficient of each node to generate the updated pollution coefficient of each node.

[0072] Specifically, based on the constructed directed rule dependency graph, the system performs reverse tracing for each invalid rule. The tracing process starts from the node corresponding to each invalid rule and traces back along the directed edges to all nodes involved in the generation of that invalid rule, ensuring no related nodes are missed. After tracing, the system counts the number of invalid rules generated by each node and records the existence time of each node, using this as a basis to calculate the pollution coefficient increment for each node. The system uses a preset formula to calculate the pollution coefficient increment; the update formula for the pollution coefficient of each node is:

[0073]

[0074] in, Let be the pollution coefficient of the node at time t; This is a set of invalid rules generated by the nodes. The size of the set of invalid rules; The duration of a node's existence, measured in days; This is the step size coefficient; This is the time decay coefficient, which controls the decay rate of the contribution of historical samples to the current pollution coefficient; The total number of invalid rules generated across all nodes is used to impose additional penalties on nodes that frequently generate invalid rules. The system adds the calculated pollution coefficient increment to the current pollution coefficient of each node to generate an updated pollution coefficient for each node, ensuring that the pollution coefficient accurately reflects the degree of influence of the node on the generation of invalid rules and the accumulation of pollution.

[0075] S43: Based on the updated contamination coefficients of each node, select nodes whose contamination coefficients exceed the preset contamination threshold, and classify them into the corresponding isolation sublists according to the node types of intelligence sources, model instances, and training samples, and merge them to generate a contamination isolation list.

[0076] Specifically, the system obtains the updated contamination coefficient of each node, compares the contamination coefficient of each node with a preset contamination threshold, and filters out nodes whose contamination coefficient exceeds the preset threshold. To ensure the accuracy of the filtering results, the system introduces a filtering judgment formula, which is:

[0077]

[0078] in, The results are used to filter and judge the nodes. A result of 1 indicates that the node's pollution coefficient exceeds the standard, while a result of 0 indicates that the node's pollution coefficient does not exceed the standard. The pollution coefficient after node update; To preset the contamination threshold, this threshold is determined through statistical analysis based on historical contamination node processing data. Based on the screening and judgment results, the system classifies nodes with excessive contamination coefficients according to node type: nodes corresponding to intelligence source identifiers are placed in the intelligence source isolation sublist; nodes corresponding to second language model instance identifiers are placed in the model instance isolation sublist; and nodes corresponding to historical training sample batch identifiers are placed in the training sample isolation sublist. After classification, the system merges the three isolation sublists, removing duplicate nodes during the merging process to ensure that each excessive node appears only once in the list. After merging, a contamination isolation list is generated, containing the identifier of the excessive node, node type, updated contamination coefficient, and screening and judgment results. This provides a clear basis for subsequent incremental training of the second language model and contamination node isolation, ensuring that contamination nodes can be effectively controlled and the propagation chain of illusion rules can be blocked.

[0079] In one embodiment, S5 of the adaptive firewall rule generation method based on real-time threat intelligence provided by the present invention specifically includes the following steps:

[0080] S51: Based on the contaminated isolation list, select sample batches marked by the contaminated isolation list from the historical training sample pool, select a preset number of high-risk illusion rules as negative samples based on the interception rule log library, and merge the marked sample batches and negative samples to generate a sample set to be cleaned.

[0081] Specifically, the system calls the previously generated contaminated isolation list and filters samples from a pre-set historical training sample pool. The filtering criterion is whether the sample batch identifier is marked on the contaminated isolation list. The marked sample batches are the set of samples with contamination risk, and the system extracts all marked sample batches completely. The system also calls the interception rule log library and selects a pre-set number of high-risk illusion rules from the log library. These high-risk illusion rules are used as negative samples, which are used for effectiveness verification in the subsequent sample cleaning process.

[0082] To ensure the rationality of negative sample selection, the system introduces a formula for the negative sample selection ratio, which is as follows:

[0083]

[0084] in, The proportion of negative samples is selected. This represents the number of negative samples selected. This formula controls the selection scale of negative samples to ensure they fully reflect the characteristics of hallucination rules. The system merges the selected labeled sample batches with the selected negative samples, removing duplicates during the merging process to prevent them from affecting subsequent cleaning. After merging, the system generates a sample set to be cleaned, containing both contaminated sample batches and negative samples. Each sample is associated with a corresponding identifier, associated node information, and contamination-related records, providing a unified data foundation for subsequent sample cleaning steps and ensuring the orderly progress of the sample cleaning process.

[0085] S52: Based on the sample set to be cleaned, perform synonym replacement and sentence transformation on each contaminated sample to generate an adversarial version that preserves semantics but mutates expression. Input the adversarial version and the original sample into the current second language model to compare output consistency. Remove samples with inconsistent outputs from the training set, and reduce the sampling weight of samples with consistent outputs according to the contamination coefficient ratio to generate a cleaned training set.

[0086] Specifically, based on the generated set of samples to be cleaned, the system performs data augmentation on each contaminated sample, including synonym replacement and sentence transformation. During synonym replacement, the system calls a pre-defined thesaurus in the cybersecurity domain to replace core words in the sample, ensuring that the semantics of the sample remain unchanged after replacement. During sentence transformation, the system adjusts the sentence structure of the sample, changing the word order without altering the semantics, generating an adversarial version that preserves the semantics but modifies the expression. Each contaminated sample corresponds to an adversarial version. The system inputs the original version and the adversarial version of each contaminated sample into the currently used second language model, obtaining the model output results corresponding to the two versions. The system performs a consistency comparison between the two output results to determine whether the model's output for the original sample and the adversarial version is consistent. To quantify output consistency, the system introduces a consistency judgment formula:

[0087]

[0088] in, To output the consistency coefficient, The semantic similarity between the original sample output and the adversarial version output. The original sample output length, To combat inconsistent output lengths, the system removes samples with inconsistent outputs from the training set, as these samples exhibit semantic instability and negatively impact model training performance. Samples with consistent outputs have their sampling weights reduced proportionally to the contamination coefficient of their corresponding nodes. The sampling weight adjustment formula is as follows:

[0089]

[0090] in, The adjusted sampling weights, These are the original sampling weights. The contamination coefficient of the sample-related nodes. This represents the maximum contamination coefficient across all nodes. After adjustment, the system integrates all retained samples to generate a cleaned training set.

[0091] S53: Construct a hybrid loss function based on the cleaned training set, use the hybrid loss function as the optimization objective to incrementally train the second language model, update the model parameters batch by batch until convergence, and generate the updated second language model. The hybrid loss function includes a prediction cross-entropy loss term and an illusion suppression regularization term calculated based on the variance of the confidence score on the validation set.

[0092] Specifically, based on the generated cleaned training set, the system constructs a hybrid loss function. This function serves as the optimization objective for incremental training of the second language model, correcting the model's tendency to generate hallucinations and improving the reliability of rule generation. The hybrid loss function includes a prediction cross-entropy loss term and a hallucination suppression regularization term. The prediction cross-entropy loss term optimizes the model's classification accuracy for rule credibility scores, while the hallucination suppression regularization term suppresses the model's tendency to generate hallucination rules. The formula for the hybrid loss function is:

[0093]

[0094] in, For the mixed loss function value, To predict the cross-entropy loss term, is the regularization coefficient, used to control the weight of the hallucination suppression regularization term. This is the hallucination suppression regularization term. The hallucination suppression regularization term is calculated based on the variance of the confidence scores on the validation set, using the following formula:

[0095]

[0096] in, To validate the variance of the model's output trust scores across all samples in the validation set, a smaller variance indicates a more stable trust score and a lower probability of hallucination generation. The system uses a mixture loss function as the optimization objective to incrementally train the second language model. During training, a mini-batch gradient descent algorithm is employed, inputting samples from the cleaned training set in batches to update the model parameters. The system monitors the model's loss function value in real time to determine if the model has converged. The convergence criterion is that the fluctuation of the loss function value across multiple consecutive training batches remains within a preset range. When the model reaches convergence, training stops, and an updated second language model is generated. This updated second language model will be used for subsequent candidate rule generation and trust scoring, continuously improving the reliability of rule generation and refining the overall adaptive closed-loop mechanism.

[0097] It should be understood that although the steps in the flowcharts of the embodiments described above are shown sequentially according to the arrows, these steps are not necessarily executed in the order indicated by the arrows. Unless explicitly stated herein, there is no strict order restriction on the execution of these steps, and they can be executed in other orders. Moreover, at least some steps in the flowcharts of the embodiments described above may include multiple steps or multiple stages. These steps or stages are not necessarily completed at the same time, but can be executed at different times. The execution order of these steps or stages is not necessarily sequential, but can be performed alternately or in turn with other steps or at least some of the steps or stages of other steps.

[0098] Based on the same inventive concept, this application also provides an adaptive firewall rule generation apparatus based on real-time threat intelligence for implementing the adaptive firewall rule generation method based on real-time threat intelligence described above. The solution provided by this apparatus is similar to the implementation described in the above method; therefore, the specific limitations in one or more embodiments of the adaptive firewall rule generation apparatus based on real-time threat intelligence provided below can be found in the limitations of the adaptive firewall rule generation method based on real-time threat intelligence described above, and will not be repeated here.

[0099] Preferably, such as Figure 2 As shown, the present invention provides an adaptive firewall rule generation device 600 based on real-time threat intelligence, which is configured with the following modules:

[0100] The threat intelligence semantic parsing module 610 is used to perform semantic parsing on intelligence texts from multiple threat intelligence sources that are accessed in real time, extract attack indicators, attack patterns and attack tactics tags from the intelligence texts, and generate an intelligence triple set and an attack tactics tag set.

[0101] The candidate rule trust division module 620 is used to generate candidate rules for attack indicators based on the intelligence triple set and the attack tactical tag set, and to divide each candidate rule into trust, splitting the candidate rules into high-risk illusion rules and a set of rules to be verified, and storing the high-risk illusion rules in the interception rule log library.

[0102] Among them, the second language model refers to a specialized language model that scores the credibility of the output of a large language model;

[0103] The twin domain rule verification module 630 is used to construct a digital twin shadow domain based on the existing rule set obtained from the current network environment configuration, deploy the rule set to be verified to the digital twin shadow domain and overlay it with the existing rule set, run the overlaid rule set using real-time mirror traffic, and divide the rule set to be verified into a valid rule set and an invalid rule set according to the blocking accuracy and idle time of each rule during the operation.

[0104] The contaminated node tracing and updating module 640 is used to construct a rule dependency graph based on the invalid rule set, trace back along the rule dependency graph to the intelligence source nodes, model instance nodes and training sample nodes that participated in generating the invalid rule set, update the contamination coefficient of each traced node, and add each node whose contamination coefficient exceeds the preset contamination threshold to the contamination isolation list.

[0105] The incremental training optimization module 650 is used to screen the historical training samples of the second language model based on the pollution isolation list and the interception rule log library. The screened pollution samples are used to identify the layers to be disturbed based on the signal-to-noise ratio calculation and to perform incremental training by superimposing hybrid loss constraints to generate the updated second language model.

[0106] Preferably, the threat intelligence semantic parsing module 610 provided in this application is configured with the following units:

[0107] The attack indicator extraction and normalization unit is used to perform sentence segmentation and lexical parsing on the intelligence text from multiple threat intelligence sources that are accessed in real time. Based on regular expressions, it extracts candidate attack indicators from each sentence, performs format normalization on each candidate attack indicator, and generates a set of normalized indicators.

[0108] The semantic encoding indicator labeling unit is used to input the normalized indicator set into the preset first language model for contextual semantic encoding. Based on the embedding vector output by the first language model, it calculates the semantic similarity between each indicator and the predefined threat type. Indicators with semantic similarity exceeding the preset matching threshold are marked as attack indicators. A structured indicator set containing attack indicators and their type labels is generated. The first language model refers to the encoder model used in the field of network security.

[0109] The technical and tactical tag matching triple generation unit is used to extract verb phrases and object phrases associated with attack indicators based on the context window of attack indicators in intelligence text, combine verb phrases and object phrases into attack pattern fragments, perform phrase similarity matching between attack pattern fragments and technical nodes in the MITRE ATT&CK framework, and use successfully matched technical nodes as attack technical and tactical tags. It combines the structured indicator set to generate an intelligence triple set and an attack technical and tactical tag set.

[0110] Preferably, the candidate rule trust division module 620 provided in this application is configured with the following units:

[0111] The candidate rule generation unit is used to input the intelligence triple set and the attack tactical tag set into the second language model. Based on the decoder of the second language model, the text representation of the candidate rule is generated token by token. The candidate rule includes source IP condition, destination IP condition, protocol type condition and blocking action.

[0112] The rule trust score unit is used to calculate the context relevance score for each candidate rule based on the context semantic information in the intelligence triplet, perform rule conflict detection based on the existing rule set in the current network environment configuration parameters to obtain the logical consistency score, dynamically deduct the intelligence source trust score based on the pollution isolation list to obtain the intelligence source trust score, and weight and aggregate the context relevance score, logical consistency score and intelligence source trust score to generate a trust score.

[0113] The rule splitting and marking unit is used to compare the trust score with preset low confidence acceptance threshold and high confidence rejection threshold. Candidate rules with a trust score lower than the low confidence acceptance threshold are marked as high-risk illusion rules and stored in the interception rule log library. Candidate rules with a trust score higher than the high confidence rejection threshold are marked as high confidence rules. Candidate rules with a trust score between the low confidence acceptance threshold and the high confidence rejection threshold are marked as low confidence rules to be verified. The high confidence rules and low confidence rules to be verified are merged to generate a set of rules to be verified.

[0114] Preferably, the twin domain rule verification module 630 provided in this application is configured with the following units:

[0115] The twin shadow domain construction unit is used to construct a virtualized network environment as a digital twin shadow domain based on the network topology information, service configuration information and business logic parameters in the current network environment configuration parameters. The rule set to be verified is deployed to the shadow domain and overlaid with the existing rule set in the current network environment configuration parameters to generate the shadow domain rule set.

[0116] The dual-path traffic verification unit is used to mirror network traffic from the production network in real time and distribute it to two parallel processing channels. The first channel only loads the existing rule set to process the mirrored traffic, while the second channel loads the shadow domain rule set to process the mirrored traffic. It continuously runs a preset verification cycle and records the processing logs of the two channels.

[0117] The rule validity filtering unit is used to calculate the blocking accuracy rate based on the number of correct blocking times and false blocking times of each candidate rule within the verification period, calculate the idle time ratio by calculating the length of time during which each candidate rule is not triggered within the verification period, multiply the blocking accuracy rate and the idle time ratio to generate a verification score, add candidate rules with verification scores exceeding the preset verification threshold to the valid rule set, add candidate rules with verification scores not exceeding the preset verification threshold to the invalid rule set, and record the verification log accordingly.

[0118] Preferably, the pollution node tracing and updating module 640 provided in this application is configured with the following units:

[0119] The rule dependency graph construction unit is used to extract the intelligence source identifier, second language model instance identifier, and historical training sample batch identifier that each invalid rule is based on when it is generated, based on the invalid rule set. The directed rule dependency graph is constructed with the intelligence source identifier, model instance identifier, and sample batch identifier as nodes and the generation dependency relationship between nodes and invalid rules as edges.

[0120] The node pollution coefficient update unit is used to perform reverse tracing processing on each invalid rule based on the directed rule dependency graph. It calculates the pollution coefficient increment based on the number of invalid rules generated by each node and their existence time, and adds the pollution coefficient increment to the current pollution coefficient of each node to generate the updated pollution coefficient of each node.

[0121] The contaminated node isolation and screening unit is used to screen out nodes whose contamination coefficient exceeds the preset contamination threshold based on the updated contamination coefficient of each node, and classify them into the corresponding isolation sublists according to the node type of intelligence source, model instance and training sample, and merge them to generate a contaminated isolation list.

[0122] Preferably, the model incremental training optimization module 650 provided in this application is configured with the following units:

[0123] The contaminated sample set construction unit is used to select sample batches marked by the contaminated isolation list from the historical training sample pool based on the contaminated isolation list, select a preset number of high-risk illusion rules as negative samples based on the interception rule log library, and merge the marked sample batches and negative samples to generate a sample set to be cleaned.

[0124] The sample cleaning and denoising unit is used to perform synonym replacement and sentence transformation on each contaminated sample based on the sample set to be cleaned to generate an adversarial version that preserves semantics but mutates expression. The adversarial version and the original sample are respectively input into the current second language model for output consistency comparison. Samples with inconsistent outputs are removed from the training set, and samples with consistent outputs have their sampling weight reduced according to the contamination coefficient ratio to generate a cleaned training set.

[0125] The incremental training update unit is used to construct a hybrid loss function based on the cleaned training set. The hybrid loss function is used as the optimization objective to incrementally train the second language model, updating the model parameters batch by batch until convergence, and generating an updated second language model. The hybrid loss function includes a prediction cross-entropy loss term and an illusion suppression regularization term calculated based on the variance of the confidence score on the validation set.

[0126] In one embodiment, this application also provides a computer device, including a memory and a processor, wherein the memory stores a computer program, and the processor executes the computer program to implement the above-described adaptive firewall rule generation method based on real-time threat intelligence.

[0127] In one embodiment, this application also provides a computer-readable storage medium storing a computer program thereon, which, when executed by a processor, implements the above-described adaptive firewall rule generation method based on real-time threat intelligence.

[0128] In the description of this specification, references to terms such as "one embodiment," "some embodiments," "example," "specific example," or "some examples," etc., indicate that a specific feature, structure, material, or characteristic described in connection with that embodiment or example is included in at least one embodiment or example of this application. Furthermore, the specific features, structures, materials, or characteristics described may be combined in any suitable manner in one or more embodiments or examples. Moreover, without contradiction, those skilled in the art can combine and integrate the different embodiments or examples described in this specification, as well as the features of those different embodiments or examples.

[0129] For the device embodiments, since they basically correspond to the method embodiments, the relevant parts can be referred to in the description of the method embodiments. The device embodiments described above are merely illustrative. The components described as separate parts may or may not be physically separate, and the components shown as units may or may not be physical units, that is, they may be located in one place or distributed across multiple network units. Some or all of the modules can be selected to achieve the purpose of this disclosure according to actual needs. Those skilled in the art can understand and implement this without creative effort.

[0130] The above description is merely a specific embodiment of this application, but the scope of protection of this application is not limited thereto. Any person skilled in the art can easily conceive of various variations or substitutions within the technical scope disclosed in this application, and these should all be included within the scope of protection of this application. Therefore, the scope of protection of this application should be determined by the scope of the claims.

Claims

1. An adaptive firewall rule generation method based on real-time threat intelligence, characterized in that, Includes the following steps: S1: Perform semantic parsing on the intelligence text from multiple threat intelligence sources accessed in real time, extract attack indicators, attack patterns and attack tactics tags from the intelligence text, and generate an intelligence triple set and an attack tactics tag set. S2: Based on the intelligence triplet set and the attack tactics tag set, a preset second language model is called to generate candidate rules for attack indicators and each candidate rule is assigned a trust level. The candidate rules are then divided into high-risk illusion rules and a set of rules to be verified. The high-risk illusion rules are stored in the interception rule log library. The second language model refers to a dedicated language model that scores the credibility of the output of a large language model. S3: Construct a digital twin shadow domain based on the existing rule set obtained from the current network environment configuration, deploy the rule set to be verified to the digital twin shadow domain and overlay it with the existing rule set, run the overlaid rule set using real-time mirror traffic, and divide the rule set to be verified into a valid rule set and an invalid rule set according to the blocking accuracy and idle time of each rule during the operation. S4: Construct a rule dependency graph based on the invalid rule set, trace back along the rule dependency graph to the intelligence source nodes, model instance nodes and training sample nodes that participated in generating the invalid rule set, update the pollution coefficient of each traced node, and add each node whose pollution coefficient exceeds the preset pollution threshold to the pollution isolation list. S5: Based on the pollution isolation list and the interception rule log library, the historical training samples of the second language model are screened. The screened pollution samples are identified according to the signal-to-noise ratio to identify the layer to be disturbed and the hybrid loss constraint is superimposed for incremental training to generate the updated second language model.

2. The method according to claim 1, characterized in that, S1 includes: S11: Perform sentence segmentation and lexical parsing on the intelligence text from multiple threat intelligence sources accessed in real time, extract candidate attack indicators from each sentence based on regular expressions, perform format normalization on each candidate attack indicator, and generate a set of normalized indicators. S12: Input the normalized index set into a preset first language model for contextual semantic encoding, calculate the semantic similarity between each index and a predefined threat type based on the embedding vector output by the first language model, mark the indexes with semantic similarity exceeding a preset matching threshold as attack indicators, and generate a structured index set containing attack indicators and their type labels. The first language model refers to an encoder model used in the field of network security. S13: Based on the context window of the attack indicator in the intelligence text, extract the verb phrases and object phrases associated with the attack indicator, combine the verb phrases and object phrases into attack pattern fragments, perform phrase similarity matching between the attack pattern fragments and the technical nodes in the MITRE ATT&CK framework, use the successfully matched technical nodes as attack tactical tags, and combine the structured indicator set to generate an intelligence triple set and an attack tactical tag set.

3. The method according to claim 1, characterized in that, S2 includes: S21: Input the intelligence triple set and the attack tactics tag set into the second language model, and generate a text representation of the candidate rule on a token-by-token basis based on the decoder of the second language model. The candidate rule includes source IP condition, destination IP condition, protocol type condition and blocking action. S22: For each candidate rule, calculate the context relevance score based on the context semantic information in the intelligence triplet, perform rule conflict detection based on the existing rule set in the current network environment configuration parameters to obtain the logical consistency score, dynamically deduct the intelligence source credibility based on the pollution isolation list to obtain the intelligence source credibility score, and weight and aggregate the context relevance score, logical consistency score and intelligence source credibility score to generate a trust score. S23: Compare the trust score with a preset low confidence acceptance threshold and a high confidence rejection threshold. Mark candidate rules with a trust score lower than the low confidence acceptance threshold as high-risk illusion rules and store them in the interception rule log library. Mark candidate rules with a trust score higher than the high confidence rejection threshold as high-confidence rules. Mark candidate rules with a trust score between the low confidence acceptance threshold and the high confidence rejection threshold as low-confidence rules to be verified. Merge the high-confidence rules and the low-confidence rules to be verified to generate a set of rules to be verified.

4. The method according to claim 1, characterized in that, S3 includes: S31: Based on the network topology information, service configuration information and business logic parameters in the current network environment configuration parameters, construct a virtualized network environment as a digital twin shadow domain, deploy the rule set to be verified to the shadow domain and overlay it with the existing rule set in the current network environment configuration parameters to generate a shadow domain rule set; S32: Real-time mirror network traffic from the production network is distributed to two parallel processing channels. The first channel only loads the existing rule set to process the mirror traffic, while the second channel loads the shadow domain rule set to process the mirror traffic. The preset verification cycle is continuously run and the processing logs of the two channels are recorded. S33: Based on the processing log, calculate the blocking accuracy rate by counting the number of correct blockings and false blockings for each candidate rule within the verification period, and calculate the idle time ratio by counting the length of time during which each candidate rule is not triggered within the verification period. Multiply the blocking accuracy rate and the idle time ratio to generate a verification score. Add candidate rules with verification scores exceeding a preset verification threshold to the valid rule set, and add candidate rules with verification scores not exceeding the preset verification threshold to the invalid rule set, and record the verification log accordingly.

5. The method according to claim 1, characterized in that, S4 includes: S41: Based on the set of invalid rules, extract the intelligence source identifier, second language model instance identifier, and historical training sample batch identifier on which each invalid rule was generated. Using the intelligence source identifier, model instance identifier, and sample batch identifier as nodes and the generation dependency relationship between nodes and invalid rules as edges, construct a directed rule dependency graph. S42: Based on the directed rule dependency graph, reverse tracing is performed on each invalid rule. The pollution coefficient increment is calculated according to the number of invalid rules generated by each node and their existence time. The pollution coefficient increment is added to the current pollution coefficient of each node to generate the updated pollution coefficient of each node. S43: Based on the updated contamination coefficients of each node, select nodes whose contamination coefficients exceed the preset contamination threshold, and classify them into the corresponding isolation sublists according to the node types of intelligence sources, model instances, and training samples, and merge them to generate a contamination isolation list.

6. The method according to claim 5, characterized in that, The update formula for the pollution coefficient of each node is as follows: in, Let be the pollution coefficient of the node at time t; This is a set of invalid rules generated by the nodes. The size of the set of invalid rules; The duration of a node's existence, measured in days; This is the step size coefficient; This is the time decay coefficient, which controls the decay rate of the contribution of historical samples to the current pollution coefficient; The total number of invalid rules generated for all nodes, used to impose additional penalties on nodes that frequently generate invalid rules.

7. The method according to any one of claims 1-6, characterized in that, S5 includes: S51: Based on the contaminated isolation list, select sample batches marked by the contaminated isolation list from the historical training sample pool, select a preset number of high-risk illusion rules as negative samples based on the interception rule log library, and merge the marked sample batches and the negative samples to generate a sample set to be cleaned. S52: Based on the sample set to be cleaned, perform synonym replacement and sentence transformation on each contaminated sample to generate an adversarial version that preserves semantics but mutates expression. Input the adversarial version and the original sample into the current second language model to compare output consistency. Remove samples with inconsistent outputs from the training set. Reduce the sampling weight of samples with consistent outputs according to the contamination coefficient ratio to generate a cleaned training set. S53: Construct a hybrid loss function based on the cleaned training set, and use the hybrid loss function as the optimization objective to incrementally train the second language model, updating the model parameters batch by batch until convergence, and generating an updated second language model. The hybrid loss function includes a prediction cross-entropy loss term and an illusion suppression regularization term calculated based on the variance of the confidence score of the validation set.

8. An adaptive firewall rule generation device based on real-time threat intelligence, characterized in that, The device includes: The threat intelligence semantic parsing module is used to perform semantic parsing on intelligence texts from multiple threat intelligence sources that are accessed in real time, extract attack indicators, attack patterns and attack tactics tags from the intelligence texts, and generate an intelligence triple set and an attack tactics tag set. The candidate rule trust division module is used to generate candidate rules for attack indicators based on the intelligence triple set and the attack tactical tag set, and to divide each candidate rule into trust, and to divide the candidate rules into high-risk illusion rules and a set of rules to be verified, and to store the high-risk illusion rules in the interception rule log library. The second language model refers to a dedicated language model that scores the credibility of the output of a large language model. The twin domain rule verification module is used to construct a digital twin shadow domain based on the existing rule set obtained from the current network environment configuration, deploy the rule set to be verified to the digital twin shadow domain and overlay it with the existing rule set, run the overlaid rule set using real-time mirror traffic, and divide the rule set to be verified into a valid rule set and an invalid rule set according to the blocking accuracy and idle time of each rule during the operation. The contaminated node tracing and updating module is used to construct a rule dependency graph based on the invalid rule set, trace back along the rule dependency graph to the intelligence source nodes, model instance nodes and training sample nodes that participated in generating the invalid rule set, update the contamination coefficient of each traced node, and add each node whose contamination coefficient exceeds the preset contamination threshold to the contamination isolation list. The model incremental training optimization module is used to screen the historical training samples of the second language model based on the pollution isolation list and the interception rule log library. The screened pollution samples are used to identify the layers to be disturbed based on the signal-to-noise ratio calculation and to perform incremental training by superimposing hybrid loss constraints to generate an updated second language model.

9. A computer device comprising a memory and a processor, wherein the memory stores a computer program, characterized in that, When the processor executes the computer program, it implements the method of any one of claims 1 to 7.

10. A computer-readable storage medium having a computer program stored thereon, characterized in that, When the computer program is executed by a processor, it implements the method of any one of claims 1 to 7.

Images