Host micro-isolation adaptive protection method and device, electronic equipment and storage medium

Abstract

The application provides a host micro-isolation adaptive protection method and device, electronic equipment and a storage medium, and belongs to the technical field of network security. In the method, a multi-dimensional host identity containing business attributes and logical identification is constructed, and a network access relationship graph generated by network access traffic is combined with a network access behavior baseline, so that the strategy configuration is changed from a traditional static IP port to a business identity, the aggregation optimization capability of the identity is used to significantly reduce the strategy maintenance cost, and the strategy recalculation can be automatically triggered with business changes, so that fine-grained adaptive protection is realized. Meanwhile, by deeply associating and judging the security events triggered by the underlying filtering rules with the host security situation information, the event association analysis capability is greatly improved, so that accurate control and closed-loop defense of the east-west traffic in the internal network are realized.

Description

Technical Field

[0001] This invention relates to the field of network security technology, and in particular to a host micro-segmentation adaptive protection method, apparatus, electronic device, and storage medium. Background Technology

[0002] Mainstream network security measures primarily rely on deploying traditional firewall devices at network boundaries. These devices are typically deployed at the boundary between internal and external networks or at the intersection of different subnets, achieving security isolation by controlling north-south traffic. However, this centralized architecture has significant security blind spots: its granularity in controlling east-west traffic within the internal network is often coarse, or even undefended. Once an attacker breaches the outer defenses and enters the internal network, they can easily move laterally between internal hosts, causing security threats to spread rapidly.

[0003] To compensate for this deficiency, some derivative products attempt to extend protection capabilities to the host level, utilizing the host's built-in firewall functionality to collaboratively manage east-west traffic. However, in practical applications, this approach faces significant engineering challenges. In a large business system containing tens of thousands of servers, distributed across different regions and departments, the number of open business ports and the resulting access relationships can reach tens or even hundreds of millions of complexities.

[0004] These traditional derivative products often lack a complete security framework design and mainly suffer from the following technical bottlenecks: Inflexible and inefficient policy configuration: Traditional technologies typically rely on administrators manually coordinating with various departments or using fragmented automated maintenance scripts for batch deployment when configuring access control policies. This approach lacks a unified policy management platform, and policy parameters are often based solely on static IP addresses and popular high-risk ports, failing to fully consider the host's business attributes, network topology, and real-time security posture. Once business operations change, policy maintenance costs are extremely high, requiring re-coordination and lengthy change processes, severely slowing down business adjustments.

[0005] Weak threat assessment and attribution capabilities: Traditional firewalls and some derivative products typically only obtain network layer traffic information. When faced with massive alerts, the lack of correlation analysis between host assets, running processes, vulnerabilities, and intrusion behaviors leads to ineffective alert convergence and low efficiency in security incident assessment. When a real attack occurs, it is difficult to piece together a complete attack chain, making accurate attribution impossible.

[0006] Difficult to adapt to the requirements of zero-trust architecture: Most traditional technologies do not conform to the zero-trust security concept of "continuous verification, never trust", and cannot perform identity-based dynamic verification and fine-grained access control for each access request.

[0007] In summary, traditional network security protection solutions suffer from technical problems such as high policy configuration and maintenance costs, weak threat event correlation analysis capabilities, and inability to meet the needs of fine-grained adaptive protection. Summary of the Invention

[0008] In view of this, the purpose of the present invention is to provide a host micro-segmentation adaptive protection method, device, electronic device and storage medium to alleviate the technical problems of high policy configuration and maintenance costs, weak threat event correlation analysis capabilities and inability to meet the requirements of fine-grained adaptive protection in traditional network security protection schemes.

[0009] In a first aspect, the present invention provides a host micro-segmentation adaptive protection method, applied to a distributed system including a management platform and a client agent, the method comprising: The client agent collects and reports the asset information of the controlled host; the management platform classifies the controlled host based on preset dimensions and constructs a multi-dimensional host identity identifier that includes business attributes and logical identifiers. The client agent collects and reports the network access traffic of the controlled host; the management platform constructs a network access relationship graph based on the network access traffic and generates a network access behavior baseline. The management platform provides policy configuration guidance, and generates and distributes dynamic access control policies based on the network access behavior baseline, the multi-dimensional host identity identifier, and the host security status information. The client agent receives the dynamic access control policy, converts it into filtering rules that can be recognized by the operating system kernel firewall, and loads it into the operating system kernel to implement network access control. When network access behavior triggers the filtering rules, a security event is generated and reported. The management platform combines the host security situation information to perform correlation analysis on the security event and responds to the handling instructions to maintain the dynamic access control policy, or automatically triggers the recalculation of the dynamic access control policy based on the change of the multi-dimensional host identity.

[0010] Furthermore, the management platform constructs a network access relationship graph based on the network access traffic and generates a network access behavior baseline, including: The network access traffic is parsed into graph structure data containing source nodes, destination nodes, and connection relationships; The graph structure data is rendered into a visual topology graph to obtain the network access relationship graph, which intuitively displays the mutual access behavior and traffic flow between hosts; Statistical feature analysis is performed on the network access relationship graph to determine the traffic threshold or access frequency range for normal access, and to generate the network access behavior baseline.

[0011] Furthermore, the management platform provides policy configuration guidance, generating dynamic access control policies based on the network access behavior baseline, the multi-dimensional host identity identifier, and the host security posture information, including: The system displays the network access behavior baseline and the host security posture information, wherein the host security posture information includes: traffic port coverage and risk vulnerability information; In response to the user's configuration operation, the access control rules are aggregated and optimized based on the multi-dimensional host identity to generate a batch dynamic access control policy for the controlled host.

[0012] Furthermore, the management platform combines the host security posture information to perform correlation analysis on the security events, including: When abnormal network access behavior is detected, obtain the process startup information, account login information, and command line execution information that triggered the behavior; The abnormal network access behavior is associated with the process startup information, the account login information, and the command line execution information to construct an attack tracing chain.

[0013] Furthermore, maintaining the dynamic access control policy in response to a disposal instruction includes: For business traffic that is judged to be a false alarm, respond to the ignore command and add the corresponding filtering rule to the whitelist; For traffic identified as a genuine attack, a blocking command is executed and a handling strategy is generated.

[0014] Furthermore, the change in the multidimensional host identity identifier automatically triggers the recalculation of the dynamic access control policy, including: Monitor the service attribute change events and logical identifier change events of the controlled host; When the business attribute change event or the logical identifier change event is detected, causing the multidimensional host identity to change, the corresponding dynamic access control policy is automatically calculated and inherited based on the changed host identity, without the need for manual reconfiguration.

[0015] Furthermore, in response to the user's configuration operation, the access control rules are aggregated and optimized based on the multi-dimensional host identity, including: Identify scattered traffic entries belonging to the same business attribute or logical identifier in the access control rules; The scattered traffic entries are processed by merging IP address ranges and converging port ranges to generate aggregation policy rules, and the aggregation policy rules are used as the dynamic access control policy. The number of aggregation policy rules is less than the number of dispersed traffic entries, in order to reduce the rule matching load of the operating system kernel firewall.

[0016] Secondly, the present invention also provides a host micro-segmentation adaptive protection device, applied to a distributed system including a management platform and a client agent, the device comprising: The information acquisition module is used to collect asset information and network access traffic of the controlled host; The identity construction module is used to classify the controlled host based on preset dimensions and construct a multi-dimensional host identity identifier that includes business attributes and logical identifiers. The baseline generation module is used to construct a network access relationship graph based on the network access traffic and generate a network access behavior baseline. The policy generation module is used to generate dynamic access control policies based on the network access behavior baseline, the multi-dimensional host identity identifier, and the host security status information. The policy execution module is used to convert the dynamic access control policy into filtering rules that can be recognized by the operating system kernel firewall, and load them into the operating system kernel to implement network access control. The event response module is used to generate a security event and perform correlation analysis when network access behavior triggers the filtering rules, and to maintain the dynamic access control policy in response to the handling instructions, or to automatically trigger the recalculation of the dynamic access control policy based on the change of the multi-dimensional host identity.

[0017] Thirdly, the present invention also provides an electronic device, including a memory and a processor, wherein the memory stores a computer program that can run on the processor, and the processor executes the computer program to implement the method described in the first aspect.

[0018] Fourthly, the present invention also provides a computer-readable storage medium storing a computer program, which, when executed by a processor, performs the method described in the first aspect.

[0019] This invention provides a host micro-segmentation adaptive protection method applied to a distributed system including a management platform and a client agent. The method includes: the client agent collecting and reporting asset information of the controlled hosts; the management platform classifying the controlled hosts based on preset dimensions to construct a multi-dimensional host identity identifier containing business attributes and logical identifiers; the client agent collecting and reporting network access traffic of the controlled hosts; the management platform constructing a network access relationship graph based on the network access traffic and generating a network access behavior baseline; the management platform providing policy configuration guidance, generating and distributing dynamic access control policies based on the network access behavior baseline, multi-dimensional host identity identifiers, and host security posture information; the client agent receiving the dynamic access control policies, converting them into filtering rules recognizable by the operating system kernel firewall, and loading them into the operating system kernel to implement network access control; when network access behavior triggers the filtering rules, generating and reporting a security event; the management platform performing correlation analysis on the security events based on the host security posture information, and maintaining the dynamic access control policies in response to handling instructions, or automatically triggering a recalculation of the dynamic access control policies based on changes in the multi-dimensional host identity identifiers. As described above, the host micro-segmentation adaptive protection method of the present invention constructs a multi-dimensional host identity identifier that includes business attributes and logical identifiers. Combined with the network access relationship graph generated by network access traffic and the network access behavior baseline, it realizes the transformation of policy configuration from the traditional static IP port-based approach to a business identity-based approach. The aggregation and optimization capabilities of the identity identifier significantly reduce policy maintenance costs and can automatically trigger policy recalculation with business changes, achieving fine-grained adaptive protection. At the same time, by deeply correlating and analyzing the security events triggered by the underlying filtering rules with the host security posture information, it greatly improves the event correlation analysis capability, thereby achieving precise control and closed-loop defense of east-west traffic on the internal network. Attached Figure Description

[0020] To more clearly illustrate the specific embodiments of the present invention or the technical solutions in the prior art, the drawings used in the description of the specific embodiments or the prior art will be briefly introduced below. Obviously, the drawings described below are some embodiments of the present invention. For those skilled in the art, other drawings can be obtained from these drawings without creative effort.

[0021] Figure 1 A flowchart illustrating a host micro-segmentation adaptive protection method provided in an embodiment of the present invention; Figure 2 An architecture diagram of a distributed system for a management platform and client agent provided in an embodiment of the present invention; Figure 3 This is a schematic diagram illustrating the operation of a distributed system comprising a management platform and a client agent, as provided in an embodiment of the present invention. Figure 4 This is a schematic diagram of a host micro-isolation adaptive protection device provided in an embodiment of the present invention; Figure 5 This is a schematic diagram of an electronic device provided in an embodiment of the present invention. Detailed Implementation

[0022] The technical solution of the present invention will be clearly and completely described below with reference to the embodiments. Obviously, the described embodiments are only some embodiments of the present invention, and not all embodiments. Based on the embodiments of the present invention, all other embodiments obtained by those skilled in the art without creative effort are within the scope of protection of the present invention.

[0023] Traditional network security solutions primarily rely on deploying conventional firewall devices at the network boundary. These devices are typically deployed at the interface between the internal and external networks, achieving security isolation by controlling north-south traffic. However, this centralized architecture has limitations in controlling east-west traffic within the internal network, including coarse-grained control and a lack of identity verification. While some derivative products attempt to utilize built-in firewalls on hosts to control east-west traffic, they often rely solely on static IPs and popular ports, lacking a comprehensive consideration of business attributes and real-time security posture, leading to difficulties in policy maintenance and traceability.

[0024] Based on this, embodiments of the present invention provide a host micro-segmentation adaptive protection method, which aims to achieve dynamic access control based on business identity by constructing a multi-dimensional host identity identifier and network access behavior baseline, thereby solving the technical problems of high policy configuration and maintenance costs and weak threat event correlation analysis capabilities in traditional technologies.

[0025] To facilitate understanding of this embodiment, a host micro-isolation adaptive protection method disclosed in this embodiment of the invention will first be described in detail.

[0026] Example 1: According to an embodiment of the present invention, an embodiment of a host micro-segmentation adaptive protection method is provided. It should be noted that the steps shown in the flowchart in the accompanying drawings can be executed in a computer system such as a set of computer-executable instructions. Furthermore, although a logical order is shown in the flowchart, in some cases, the steps shown or described may be executed in a different order than that shown here.

[0027] Figure 1 This is a flowchart of a host micro-segmentation adaptive protection method according to an embodiment of the present invention, such as... Figure 1 As shown, the method includes the following steps: In step S102, the client agent collects and reports the asset information of the controlled host; the management platform classifies the controlled host into attributes based on preset dimensions and constructs a multi-dimensional host identity identifier that includes business attributes and logical identifiers. In this embodiment of the invention, the above-described host micro-segmentation adaptive protection method can be applied to a distributed system including a management platform and a client agent, such as... Figure 2 As shown, the distributed system of the management platform and client agent adopts a "client-server" architecture. Building upon the conventional security capabilities of the host probe agent client, such as asset inventory, risk discovery, intrusion detection, and security posture, it has been further developed and expanded to enhance network security capabilities, effectively managing east-west traffic. Specifically, the server-side host micro-segmentation management platform (i.e., the management platform) includes modules for host management, access relationship lists, a visual network topology diagram, intelligent policy configuration guidance tools, and alarm analysis and response. The client-side host micro-segmentation (i.e., the client agent) mainly includes modules for traffic collection, policy application, and alarm reporting.

[0028] In this step, the first step is to establish the digital identity of the controlled host. The client agent, as adaptive probe software installed on the host, will proactively inventory and collect basic asset information of the controlled host. This information typically includes the host's operating system type, version, open ports, network interface card, list of installed software, business asset information, etc.

[0029] After receiving this information, the management platform will perform attribute classification based on preset dimensions (this classification can be automatic or performed by the administrator, with the management platform responding accordingly). This "multi-dimensional host identity identification" differs from traditional firewalls that rely solely on IP addresses. Instead, it divides hosts into logical dimensions such as zones and labels, and business dimensions such as business groups. For example, an administrator can label a group of Linux servers responsible for processing payment transactions as "Production Environment - Payment Business Group - Web Layer." This business attribute-based identification means that subsequent policy configuration no longer depends on specific IP addresses but is managed in batches based on roles, greatly reducing the complexity of policy maintenance. Furthermore, fine-grained control over the activation of various host micro-segmentation functions can be achieved through on / off switches and authorization.

[0030] The east-west traffic and north-south traffic mentioned above correspond to each other. In a data center, network traffic between external servers and host machines is called north-south traffic or vertical traffic, while network traffic between internal server hosts is called east-west traffic or horizontal traffic.

[0031] The aforementioned client agent, or host probe agent, is a comprehensive adaptive probe software running on the host. It acts as a digital agent for the host in the security protection system, primarily responsible for timely detection of risks and threats on the host and continuously safeguarding data security.

[0032] Step S104: The client agent collects and reports the network access traffic of the controlled host; the management platform constructs a network access relationship graph based on the network access traffic and generates a baseline of network access behavior. Specifically, after establishing identity, the system enters the traffic learning phase. The client agent uses packet capture technology (such as WinPcap or Lippcap) to collect the host's inbound and outbound network access traffic (i.e., network access traffic) in real time and reports this raw traffic data to the management platform.

[0033] After receiving traffic data, the management platform stores it and parses it into a graph structure containing source nodes, destination nodes, and connection relationships. This data is then rendered into a visual network topology graph, i.e., a network access relationship graph. Through this process, administrators can intuitively see the communication behavior between hosts and the flow of traffic.

[0034] Furthermore, the system performs statistical feature analysis on the network graph, continuously learning to determine the traffic threshold or frequency range for normal access, thereby automatically generating a baseline for network access behavior. This step addresses the pain point of traditional technologies where administrators struggle to analyze massive access relationships, providing a reference based on actual business traffic for subsequent policy configuration and preventing business interruptions due to incorrect policy configuration.

[0035] Step S106: The management platform provides policy configuration guidance, generates dynamic access control policies and distributes them based on the network access behavior baseline, multi-dimensional host identity identifiers and host security posture information. Specifically, based on the network access behavior baseline and multi-dimensional host identity established in the previous steps, the management platform enters the policy configuration phase. The platform provides an intelligent policy configuration guidance tool that displays the network access behavior baseline and host security posture information (such as traffic port coverage, host risk and vulnerability information, etc.).

[0036] In this step, administrators can refer to the network access behavior baseline and combine it with the host's security posture to configure policies. For example, if a host has a high-risk vulnerability, the bootstrapping tool will suggest restricting its access scope. The generated policy is dynamic; it not only includes traditional five-tuple information but also binds multi-dimensional host identity identifiers. After the user completes the configuration, the policy is distributed to the corresponding client agent. This identity- and baseline-based configuration method transforms the traditional "human experience-driven" approach into a "data-driven" one, significantly improving the accuracy and efficiency of policy configuration.

[0037] In step S108, the client agent receives the dynamic access control policy, converts it into filtering rules that can be recognized by the operating system kernel firewall, and loads it into the operating system kernel to implement network access control. Specifically, on the client side, after the proxy receives the distributed policy, it needs to execute it. Because the rule formats of firewalls differ across operating system kernels, this step involves a crucial conversion process.

[0038] For Windows operating systems, the client agent translates the policy into filtering rules recognizable by the Windows Filtering Platform (WFP); for Linux operating systems, it translates them into Netfilter rules (supporting Iptables or Nftables formats). The translated rules are then loaded into the operating system kernel.

[0039] By leveraging the operating system's native kernel firewall capabilities, this invention implements a point-to-point distributed firewall defense system, pushing the security barrier down to each host and achieving micro-isolation control of east-west traffic. Its control granularity is far finer than that of traditional perimeter firewalls.

[0040] Step S110: When network access behavior triggers filtering rules, a security event is generated and reported; the management platform combines host security status information to perform correlation analysis on the security event, and responds to the handling instructions to maintain the dynamic access control policy, or automatically triggers the recalculation of the dynamic access control policy based on the change of multi-dimensional host identity identifier.

[0041] Specifically, this is the closed-loop operation and maintenance phase of the system. When network access behavior matches the filtering rules in the kernel (such as blocked traffic), the client agent generates a security event and reports it.

[0042] Upon receiving an event, the management platform will perform correlation analysis based on host security posture information. For example, it will correlate abnormal network access behavior with the process startup information, account login information, and command line execution information that triggered the behavior to build an attack tracing chain, helping administrators determine whether it is a false alarm or a real attack.

[0043] Based on the analysis results, the system responds to the handling instructions for maintenance: for falsely reported business traffic, it can be added to the whitelist; for real attacks, a blocking policy is generated.

[0044] In addition, this step also includes an adaptive mechanism. When a change event in the business attributes of a controlled host is detected (such as a host migrating from a test environment to a production environment, resulting in a change in multidimensional identity), the system will automatically trigger a recalculation of the policy. The corresponding policy will be automatically inherited according to the changed identity, without the need for manual reconfiguration, perfectly adapting to the dynamic needs of cloud environments and zero-trust architectures.

[0045] The work process is as follows Figure 3 As shown, the key process is as follows: Host Management: The host probe agent client (i.e., client agent) counts network cards, ports, and business asset information and reports it to the server. The administrator divides the host into regions, business groups, tags, and other identity identifiers, and configures authorization switches.

[0046] Traffic learning: The client (i.e., the client agent) collects the host network traffic, reports it to the server (i.e. the management platform), stores the access relationships, and generates a visualized network topology map. This is a continuous learning process.

[0047] Policy configuration: Using policy guidance tools, policies are sorted out and configured by comprehensively considering traffic characteristics, business characteristics, and security posture, continuously optimized and operated, and finally distributed to WFP or Netfilter on the host.

[0048] Alarm Response: Whitelist normal business traffic that is falsely reported, and handle abnormal attack traffic in conjunction with security posture.

[0049] Business Changes: When host services change, such as relocating data centers, adjustments to regions, business groups, and tags will automatically trigger a new policy adaptive calculation, and the host will automatically inherit the new policy.

[0050] Through steps S102 to S110 above, this embodiment realizes a complete process from traffic collection, identity construction, policy generation to kernel execution and closed-loop operation and maintenance. This method replaces the traditional static IP policy with multi-dimensional identity identification, uses kernel-level firewalls to achieve micro-segmentation, and combines automated policy recalculation, effectively solving the problems of difficult and costly traditional east-west traffic control and maintenance, and realizing the "continuous verification, never trust" concept in zero-trust security.

[0051] The above provides a brief overview of the host micro-isolation adaptive protection method of the present invention. The specific details involved are described in detail below.

[0052] In an optional embodiment of the present invention, the management platform constructs a network access relationship graph based on network access traffic and generates a network access behavior baseline, specifically including the following steps: (1) Parse network access traffic into graph structure data containing source nodes, destination nodes and connection relationships; (2) Render the graph structure data into a visual topology graph to obtain a network access relationship graph, so as to intuitively display the mutual access behavior and traffic flow between hosts; (3) Perform statistical feature analysis on the network access relationship graph to determine the traffic threshold or access frequency range for normal access and generate a baseline for network access behavior.

[0053] In an optional embodiment of the present invention, the management platform provides policy configuration guidance, generating dynamic access control policies based on network access behavior baselines, multi-dimensional host identity identifiers, and host security posture information, specifically including the following steps: (1) Display the baseline of network access behavior and host security status information, including: traffic port coverage and risk vulnerability information; (2) In response to the user's configuration operation, the access control rules are aggregated and optimized based on the multi-dimensional host identity to generate batch dynamic access control policies for the controlled host.

[0054] Specifically, considering that micro-segmentation can easily generate a massive number of rules, leading to a decline in host firewall performance, aggregation optimization can reduce the number of rules and improve host performance. In an optional embodiment, in response to user configuration operations, access control rules are aggregated and optimized based on multidimensional host identity identifiers, specifically including the following steps: (21) Identify scattered traffic entries belonging to the same business attribute or logical identifier in access control rules; (22) Perform IP address range merging and port range convergence processing on scattered traffic entries to generate aggregation policy rules, and use the aggregation policy rules as dynamic access control policies; The number of aggregation policy rules is less than the number of dispersed traffic entries, in order to reduce the rule matching load on the operating system kernel firewall.

[0055] When performing aggregation optimization, the following methods can also be used: Identify scattered traffic entries belonging to the same business attribute or logical identifier in access control rules; A multi-dimensional feature space is constructed, with security level weights, business sensitivity coefficients, and environmental risk scores as clustering dimensions, where: Security level weights are dynamically calculated based on host vulnerability density and threat intelligence confidence. Business sensitivity coefficients are assigned values ​​based on the tiered classification of data asset value; Environmental risk scoring is associated with network area trust levels; An improved density clustering algorithm is used to identify policy clusters that satisfy the minimum policy coverage threshold in a multidimensional feature space; Perform the following for scattered traffic entries within the same policy cluster: CIDR merging of IP address ranges without conflict; The discrete port converges over a continuous range; Logical merging of redundant protocol types; Generate an aggregated policy rule set, with the number of rules being less than 30% of the total number of the original scattered traffic entries, to reduce the rule matching load of the operating system kernel firewall.

[0056] In an optional embodiment of the present invention, the management platform combines host security status information to perform correlation analysis on security events, specifically including the following steps: (1) When abnormal network access behavior is detected, obtain the process startup information, account login information and command line execution information that triggered the behavior; (2) Associate abnormal network access behavior with process startup information, account login information and command line execution information to construct an attack tracing chain.

[0057] In an optional embodiment of the present invention, maintaining the dynamic access control policy in response to a disposal instruction specifically includes the following steps: (1) For business traffic that is judged to be a false alarm, respond to the ignore instruction and add the corresponding filtering rule to the whitelist; (2) For traffic that is judged to be a real attack, respond to the blocking command and generate a handling strategy.

[0058] In an optional embodiment of the present invention, the automatic recalculation of the dynamic access control policy based on the change of the multidimensional host identity identifier specifically includes the following steps: (1) Monitor service attribute change events and logical identifier change events of the controlled host; (2) When a business attribute change event or logical identifier change event is detected, resulting in a change in the multidimensional host identity, the corresponding dynamic access control policy is automatically calculated and inherited based on the changed host identity, without the need for manual reconfiguration.

[0059] Compared with traditional north-south firewalls and some derivative products, this invention has the following advantages: Fine-grained traffic control: By utilizing the host kernel's built-in firewalls WFP and Netfilter, inbound and outbound network access control policies can be configured for each host, forming a point-to-point distributed firewall defense system, which provides more granular control over east-west traffic.

[0060] The policy configuration reference information is abundant: using the learned access relationship list and network topology information as a reference baseline, and combining it with the security posture information such as host identity, business asset characteristics, risk vulnerabilities, and intrusion alarms provided by the host probe agent client, the reference information is rich enough, and the configured policies are more complete and accurate.

[0061] High policy configuration efficiency: Based on the "client-server" architecture, the server serves as a unified management platform for host management, policy configuration, policy distribution, and response handling. The probe agent client is pre-installed on various heterogeneous hosts, serving as the digital identity role of the host and bringing it under control. Administrators can configure policies in one stop on the server control plane, synchronize them to the corresponding hosts in batches with one click, and respond to and handle the security status of hosts with one click, avoiding the need to log in to each host system for control, thus significantly improving management efficiency.

[0062] Low policy maintenance cost: Policies can be configured for individual hosts at the host level, or in batches based on host identity factors such as region, business group, and tag. A small number of policies can cover a large number of hosts with consistent behavior. This identity-based policy has low maintenance cost. When business changes, you only need to adjust the host's identity on the unified management platform to automatically switch and inherit the corresponding policies.

[0063] High efficiency in network alarm analysis and tracing: By leveraging the security protection capabilities of the probe agent installed on the host, the host's network access relationships can be correlated with security posture information such as assets, risks, intrusions, and threat intelligence provided by conventional host security capabilities. This facilitates the early identification of high-risk business ports, targeted policy configuration, and, when a network attack occurs, rapid analysis and judgment based on rich security posture information, tracing the complete attack chain, and assessing the actual impact on the business.

[0064] Compliant with Zero Trust Specification: This invention fully leverages the underlying security capabilities of the host probe agent, assigning identity and role attributes to the host, extending the coverage of network traffic control to every corner of network services, forming a security closed loop, filling the gaps in traditional network security, and ensuring comprehensive security protection. It is a good practice of Zero Trust in host network environments.

[0065] Example 2: This invention also provides a host micro-segmentation adaptive protection device, which is mainly used to execute the host micro-segmentation adaptive protection method provided in Embodiment 1 of this invention. The host micro-segmentation adaptive protection device provided in this invention will be described in detail below.

[0066] Figure 4 This is a schematic diagram of a host micro-isolation adaptive protection device according to an embodiment of the present invention, such as... Figure 4 As shown, the device mainly includes: an information acquisition module 10, an identity construction module 20, a baseline generation module 30, a policy generation module 40, a policy execution module 50, and an event response module 60, wherein: Information acquisition module 10 is used to collect asset information and network access traffic of the controlled host; The identity construction module 20 is used to classify the controlled host based on preset dimensions and construct a multi-dimensional host identity identifier that includes business attributes and logical identifiers. The baseline generation module 30 is used to construct a network access relationship graph based on network access traffic and generate a network access behavior baseline. The policy generation module 40 is used to generate dynamic access control policies based on network access behavior baselines, multi-dimensional host identity identifiers, and host security posture information. The policy execution module 50 is used to convert dynamic access control policies into filtering rules that can be recognized by the operating system kernel firewall and load them into the operating system kernel to implement network access control. The event response module 60 is used to generate security events and perform correlation analysis when network access behavior triggers filtering rules, and to maintain dynamic access control policies in response to handling instructions, or to automatically trigger the recalculation of dynamic access control policies based on changes in multi-dimensional host identity identifiers.

[0067] This invention provides a host micro-segmentation adaptive protection method applied to a distributed system including a management platform and a client agent. The method includes: the client agent collecting and reporting asset information of the controlled hosts; the management platform classifying the controlled hosts based on preset dimensions to construct a multi-dimensional host identity identifier containing business attributes and logical identifiers; the client agent collecting and reporting network access traffic of the controlled hosts; the management platform constructing a network access relationship graph based on the network access traffic and generating a network access behavior baseline; the management platform providing policy configuration guidance, generating and distributing dynamic access control policies based on the network access behavior baseline, multi-dimensional host identity identifiers, and host security posture information; the client agent receiving the dynamic access control policies, converting them into filtering rules recognizable by the operating system kernel firewall, and loading them into the operating system kernel to implement network access control; when network access behavior triggers the filtering rules, generating and reporting a security event; the management platform performing correlation analysis on the security events based on the host security posture information, and maintaining the dynamic access control policies in response to handling instructions, or automatically triggering a recalculation of the dynamic access control policies based on changes in the multi-dimensional host identity identifiers. As described above, the host micro-segmentation adaptive protection method of the present invention constructs a multi-dimensional host identity identifier that includes business attributes and logical identifiers. Combined with the network access relationship graph generated by network access traffic and the network access behavior baseline, it realizes the transformation of policy configuration from the traditional static IP port-based approach to a business identity-based approach. The aggregation and optimization capabilities of the identity identifier significantly reduce policy maintenance costs and can automatically trigger policy recalculation with business changes, achieving fine-grained adaptive protection. At the same time, by deeply correlating and analyzing the security events triggered by the underlying filtering rules with the host security posture information, it greatly improves the event correlation analysis capability, thereby achieving precise control and closed-loop defense of east-west traffic on the internal network.

[0068] Optionally, the baseline generation module is also used to: parse network access traffic into graph structure data containing source nodes, destination nodes, and connection relationships; render the graph structure data into a visual topology graph to obtain a network access relationship graph, so as to intuitively display the mutual access behavior and traffic flow between hosts; perform statistical feature analysis on the network access relationship graph to determine the traffic threshold or access frequency range for normal access, and generate a network access behavior baseline.

[0069] Optionally, the policy generation module is also used to: display the baseline of network access behavior and host security posture information, wherein the host security posture information includes: traffic port coverage and risk vulnerability information; and in response to the user's configuration operation, aggregate and optimize access control rules based on multi-dimensional host identity identifiers to generate batch dynamic access control policies for controlled hosts.

[0070] Optionally, the event response module is also used to: when abnormal network access behavior is detected, obtain the process startup information, account login information and command line execution information that triggered the behavior; associate the abnormal network access behavior with the process startup information, account login information and command line execution information to construct an attack tracing chain.

[0071] Optionally, the event response module is also used to: respond to the ignore instruction and add the corresponding filtering rule to the whitelist for business traffic that is judged to be a false alarm; and respond to the block instruction and generate a handling strategy for traffic that is judged to be a real attack.

[0072] Optionally, the event response module is also used to: monitor business attribute change events and logical identifier change events of the controlled host; when a business attribute change event or logical identifier change event is detected that causes a change in the multidimensional host identity, the corresponding dynamic access control policy is automatically calculated and inherited based on the changed host identity, without the need for manual reconfiguration.

[0073] Optionally, the policy generation module is also used to: identify scattered traffic entries belonging to the same business attribute or logical identifier in the access control rules; perform IP address range merging and port range convergence processing on the scattered traffic entries to generate aggregated policy rules, and use the aggregated policy rules as dynamic access control policies; wherein the number of aggregated policy rules is less than the number of scattered traffic entries, so as to reduce the rule matching load of the operating system kernel firewall.

[0074] The device provided in this embodiment of the invention has the same implementation principle and technical effect as the aforementioned method embodiment. For the sake of brevity, any parts not mentioned in the device embodiment can be referred to the corresponding content in the aforementioned method embodiment.

[0075] like Figure 5 As shown in the embodiment of this application, an electronic device 600 includes a processor 601, a memory 602, and a bus. The memory 602 stores machine-readable instructions executable by the processor 601. When the electronic device is running, the processor 601 communicates with the memory 602 via the bus. The processor 601 executes the machine-readable instructions to perform the steps of the host micro-segmentation adaptive protection method described above.

[0076] Specifically, the memory 602 and processor 601 mentioned above can be general-purpose memory and processor, without any specific limitations. When the processor 601 runs the computer program stored in the memory 602, it can execute the host micro-isolation adaptive protection method mentioned above.

[0077] The processor 601 may be an integrated circuit chip with signal processing capabilities. In implementation, each step of the above method can be completed by the integrated logic circuitry in the hardware of the processor 601 or by instructions in software form. The processor 601 may be a general-purpose processor, including a Central Processing Unit (CPU), a Network Processor (NP), etc.; it may also be a Digital Signal Processor (DSP), an Application Specific Integrated Circuit (ASIC), a Field-Programmable Gate Array (FPGA), or other programmable logic devices, discrete gate or transistor logic devices, or discrete hardware components. It can implement or execute the methods, steps, and logic block diagrams disclosed in the embodiments of this application. The general-purpose processor may be a microprocessor or any conventional processor. The steps of the methods disclosed in the embodiments of this application can be directly manifested as execution by a hardware decoding processor, or execution by a combination of hardware and software modules in the decoding processor. The software module can reside in a mature storage medium in the art, such as random access memory, flash memory, read-only memory, programmable read-only memory, electrically erasable programmable memory, or registers. This storage medium is located in memory 602, and processor 601 reads the information from memory 602 and, in conjunction with its hardware, completes the steps of the above method.

[0078] Corresponding to the above-described host micro-segmentation adaptive protection method, this application embodiment also provides a computer-readable storage medium storing machine-executable instructions. When the machine-executable instructions are invoked and executed by a processor, the machine-executable instructions cause the processor to perform the steps of the above-described host micro-segmentation adaptive protection method.

[0079] The host micro-isolation adaptive protection device provided in this application embodiment can be specific hardware on the device or software or firmware installed on the device. The implementation principle and technical effects of the device provided in this application embodiment are the same as those in the foregoing method embodiments. For the sake of brevity, any parts not mentioned in the device embodiment can be referred to the corresponding content in the foregoing method embodiments. Those skilled in the art will clearly understand that, for the sake of convenience and brevity, the specific working processes of the systems, devices, and units described above can all be referred to the corresponding processes in the above method embodiments, and will not be repeated here.

[0080] In the embodiments provided in this application, it should be understood that the disclosed apparatus and methods can be implemented in other ways. The apparatus embodiments described above are merely illustrative. For example, the division of units is only a logical functional division, and in actual implementation, there may be other division methods. Furthermore, multiple units or components may be combined or integrated into another system, or some features may be ignored or not executed. Additionally, the displayed or discussed mutual couplings, direct couplings, or communication connections may be through some communication interfaces; indirect couplings or communication connections between devices or units may be electrical, mechanical, or other forms.

[0081] For example, the flowcharts and block diagrams in the accompanying drawings illustrate the architecture, functionality, and operation of possible implementations of apparatus, methods, and computer program products according to various embodiments of this application. In this regard, each block in a flowchart or block diagram may represent a module, segment, or portion of code containing one or more executable instructions for implementing a specified logical function. It should also be noted that in some alternative implementations, the functions marked in the blocks may occur in a different order than those marked in the drawings. For example, two consecutive blocks may actually be executed substantially in parallel, and they may sometimes be executed in reverse order, depending on the functions involved. It should also be noted that each block in a block diagram and / or flowchart, and combinations of blocks in block diagrams and / or flowcharts, can be implemented using a dedicated hardware-based system that performs the specified function or action, or using a combination of dedicated hardware and computer instructions.

[0082] The units described as separate components may or may not be physically separate. The components shown as units may or may not be physical units; that is, they may be located in one place or distributed across multiple network units. Some or all of the units can be selected to achieve the purpose of this embodiment according to actual needs.

[0083] In addition, the functional units in the embodiments provided in this application can be integrated into one processing unit, or each unit can exist physically separately, or two or more units can be integrated into one unit.

[0084] If the aforementioned functions are implemented as software functional units and sold or used as independent products, they can be stored in a computer-readable storage medium. Based on this understanding, the technical solution of this application, in essence, or the part that contributes to the prior art, or a portion of the technical solution, can be embodied in the form of a software product. This computer software product is stored in a storage medium and includes several instructions to cause an electronic device (which may be a personal computer, server, or network device, etc.) to execute all or part of the steps of the host micro-segmentation adaptive protection method described in the various embodiments of this application. The aforementioned storage medium includes various media capable of storing program code, such as USB flash drives, portable hard drives, read-only memory (ROM), random access memory (RAM), magnetic disks, or optical disks.

[0085] It should be noted that similar labels and letters in the following figures indicate similar items. Therefore, once an item is defined in one figure, it does not need to be further defined and explained in subsequent figures. In addition, the terms "first", "second", "third", etc. are used only to distinguish descriptions and should not be construed as indicating or implying relative importance.

[0086] Finally, it should be noted that the above-described embodiments are merely specific implementations of this application, used to illustrate the technical solutions of this application, and not to limit them. The protection scope of this application is not limited thereto. Although this application has been described in detail with reference to the foregoing embodiments, those skilled in the art should understand that any person skilled in the art can still modify or easily conceive of changes to the technical solutions described in the foregoing embodiments, or make equivalent substitutions for some of the technical features, within the scope of the technology disclosed in this application; and these modifications, changes, or substitutions do not cause the essence of the corresponding technical solutions to deviate from the scope of the technical solutions of the embodiments of this application. All should be covered within the protection scope of this application. Therefore, the protection scope of this application should be determined by the protection scope of the claims.

Claims

1. A host micro-isolation adaptive protection method, characterized in that, Applied to a distributed system including a management platform and a client agent, the method includes: The client agent collects and reports the asset information of the controlled host; the management platform classifies the controlled host based on preset dimensions and constructs a multi-dimensional host identity identifier that includes business attributes and logical identifiers. The client agent collects and reports the network access traffic of the controlled host; the management platform constructs a network access relationship graph based on the network access traffic and generates a network access behavior baseline. The management platform provides policy configuration guidance, and generates and distributes dynamic access control policies based on the network access behavior baseline, the multi-dimensional host identity identifier, and the host security status information. The client agent receives the dynamic access control policy, converts it into filtering rules that can be recognized by the operating system kernel firewall, and loads it into the operating system kernel to implement network access control. When network access behavior triggers the filtering rules, a security event is generated and reported. The management platform combines the host security situation information to perform correlation analysis on the security event and responds to the handling instructions to maintain the dynamic access control policy, or automatically triggers the recalculation of the dynamic access control policy based on the change of the multi-dimensional host identity.

2. The method according to claim 1, characterized in that, The management platform constructs a network access relationship graph based on the network access traffic and generates a network access behavior baseline, including: The network access traffic is parsed into graph structure data containing source nodes, destination nodes, and connection relationships; The graph structure data is rendered into a visual topology graph to obtain the network access relationship graph, which intuitively displays the mutual access behavior and traffic flow between hosts; Statistical feature analysis is performed on the network access relationship graph to determine the traffic threshold or access frequency range for normal access, and to generate the network access behavior baseline.

3. The method according to claim 1, characterized in that, The management platform provides policy configuration guidance, generating dynamic access control policies based on the network access behavior baseline, the multi-dimensional host identity identifier, and the host security posture information, including: The system displays the network access behavior baseline and the host security posture information, wherein the host security posture information includes: traffic port coverage and risk vulnerability information; In response to the user's configuration operation, the access control rules are aggregated and optimized based on the multi-dimensional host identity to generate a batch dynamic access control policy for the controlled host.

4. The method according to claim 1, characterized in that, The management platform combines the host security posture information to perform correlation analysis on the security events, including: When abnormal network access behavior is detected, obtain the process startup information, account login information, and command line execution information that triggered the behavior; The abnormal network access behavior is associated with the process startup information, the account login information, and the command line execution information to construct an attack tracing chain.

5. The method according to claim 1, characterized in that, Maintaining the dynamic access control policy in response to a disposal instruction includes: For business traffic that is judged to be a false alarm, respond to the ignore command and add the corresponding filtering rule to the whitelist; For traffic identified as a genuine attack, a blocking command is executed and a handling strategy is generated.

6. The method according to claim 1, characterized in that, The recalculation of the dynamic access control policy is automatically triggered based on the change of the multidimensional host identity, including: Monitor the service attribute change events and logical identifier change events of the controlled host; When the business attribute change event or the logical identifier change event is detected, causing the multidimensional host identity to change, the corresponding dynamic access control policy is automatically calculated and inherited based on the changed host identity, without the need for manual reconfiguration.

7. The method according to claim 3, characterized in that, In response to user configuration operations, access control rules are aggregated and optimized based on the multi-dimensional host identity, including: Identify scattered traffic entries belonging to the same business attribute or logical identifier in the access control rules; The scattered traffic entries are processed by merging IP address ranges and converging port ranges to generate aggregation policy rules, and the aggregation policy rules are used as the dynamic access control policy. The number of aggregation policy rules is less than the number of dispersed traffic entries, in order to reduce the rule matching load of the operating system kernel firewall.

8. A host micro-isolation adaptive protection device, characterized in that, Applied to a distributed system including a management platform and a client agent, the apparatus includes: The information acquisition module is used to collect asset information and network access traffic of the controlled host; The identity construction module is used to classify the controlled host based on preset dimensions and construct a multi-dimensional host identity identifier that includes business attributes and logical identifiers. The baseline generation module is used to construct a network access relationship graph based on the network access traffic and generate a network access behavior baseline. The policy generation module is used to generate dynamic access control policies based on the network access behavior baseline, the multi-dimensional host identity identifier, and the host security status information. The policy execution module is used to convert the dynamic access control policy into filtering rules that can be recognized by the operating system kernel firewall, and load them into the operating system kernel to implement network access control. The event response module is used to generate a security event and perform correlation analysis when network access behavior triggers the filtering rules, and to maintain the dynamic access control policy in response to the handling instructions, or to automatically trigger the recalculation of the dynamic access control policy based on the change of the multi-dimensional host identity.

9. An electronic device comprising a memory and a processor, wherein the memory stores a computer program executable on the processor, characterized in that, When the processor executes the computer program, it implements the method of any one of claims 1 to 7.

10. A computer-readable storage medium storing a computer program thereon, characterized in that, The computer program is executed by the processor to perform the method of any one of claims 1 to 7.

Images