Network security compliance auditing method, device, equipment, medium and product

Abstract

This invention provides a method, apparatus, device, medium, and product for network security compliance auditing, relating to the field of network security auditing technology. It addresses the shortcomings of existing technologies in network security compliance auditing, such as low efficiency and poor accuracy of audit results, thereby improving the accuracy of audit results. The method includes: parsing the audit task of a network device based on a preset model and a preset operation process database to obtain multiple sub-tasks, and determining the function call sequence for each sub-task, which is used to call data or functions associated with the sub-task; determining the data retrieval conditions corresponding to each sub-task, including data type and data retrieval range; determining the target data associated with each sub-task from the network database based on the function call sequence and data retrieval conditions for each sub-task; and determining the audit conclusion for the network device based on the target data associated with each sub-task and the audit task.

Description

Technical Field

[0001] This invention relates to the field of network security auditing technology, and in particular to a network security compliance auditing method, apparatus, equipment, medium, and product. Background Technology

[0002] Currently, in network security compliance auditing technologies, rule-based commercial auditing tools (such as SolarWinds Network Configuration Manager) perform text matching on network device configuration files using predefined regular expressions or SQL-like queries. Auditors need to manually write queries for each compliance requirement, and the auditing tool can only output the result of whether the configuration lines match (compliance). Alternatively, formal verification tools based on network policy analysis (such as Batfish) analyze the consistency of Access Control Lists (ACLs) and routing policies by modeling the network control plane, but this requires writing specialized query languages ​​to obtain the analysis results.

[0003] At the data source level, rule-matching-based commercial auditing tools only cover configuration text (in actual audits, they only meet about 22% of compliance requirements) and cannot access critical evidence such as network topology, real-time device status, organizational documents, and vendor manuals. Formal verification tools based on network policy analysis only support static policy analysis and cannot examine dynamic or stateful events such as network device operating status, log records, and default behaviors. At the process level, the auditing process heavily relies on human experience. Faced with complex requirements across data sources (such as configuration + topology + documentation) and modalities (such as graph data + natural language), there is no standardized audit path to follow, leading to inconsistent audit conclusions from auditors with different experience levels. Furthermore, manually searching documents and logging into devices to check each item is extremely inefficient. At the intelligence level, existing tools lack natural language understanding capabilities and cannot automatically translate auditors' conversational compliance audit requirements into executable audit plans. In addition, while different vendors' operation and maintenance platforms can collect multi-source data, they are usually tied to a single vendor and only provide raw data presentation, without outputting audit conclusions. Therefore, current compliance audits of network security are inefficient and the accuracy of audit results is poor. Summary of the Invention

[0004] This invention provides a network security compliance audit method, apparatus, equipment, medium, and product to address the shortcomings of existing technologies in network security compliance audits, such as low efficiency and poor accuracy of audit results, thereby improving the efficiency and accuracy of network security compliance audits.

[0005] This invention provides a network security compliance auditing method, which includes the following steps.

[0006] Based on a preset model and a preset operation process database, the audit tasks of network devices are parsed to obtain multiple sub-tasks, and the function call sequence of each sub-task is determined. The function call sequence is used to call the data or functions associated with the sub-task. Determine the data retrieval conditions for each subtask. The data retrieval conditions include: data type and data retrieval scope. Based on the function call sequence and data retrieval conditions of each subtask, the target data associated with each subtask is determined from the network database. Based on the target data and auditable tasks associated with each subtask, the audit conclusions for the network devices are determined.

[0007] According to a network security compliance auditing method provided by the present invention, the network database includes data of various data types, including at least one of the following: network configuration data, network topology data, network status data, and unstructured document data; The network database is determined in the following ways: By using keyword syntax tree pre-pruning, configuration data related to audit semantics is extracted to obtain network configuration data; The entire network graph structure is stored in a graph database, subgraphs are dynamically pruned, and nodes and edges relevant to audit requirements are returned to obtain network topology data. Based on a read-only command on-demand execution engine, commands are issued in real time according to the audit process and the echo is captured to obtain network status data; Construct paragraph-level vector indexes and attach document structure anchors to obtain unstructured document data based on precise semantic positioning.

[0008] According to a network security compliance auditing method provided by the present invention, each data item in network configuration data, network topology data, network status data, and unstructured document data is associated with a calling interface; Based on the function call sequence and data retrieval conditions for each subtask, the target data associated with each subtask is determined from the network database, including: For a target subtask among multiple subtasks, the corresponding target call interface is invoked based on the function call sequence of the target subtask; Based on the data retrieval conditions corresponding to the target subtask, the target data associated with the target subtask is determined from the data associated with the target call interface.

[0009] According to a network security compliance auditing method provided by the present invention, the audit conclusion of a network device is determined based on the target data associated with each sub-task and the task to be audited, including: The target data and audit tasks are analyzed based on a preset model, and the audit conclusion of the network device is determined in combination with the network context. The network context includes at least one of the following: IP subnet affiliation and preset routing behavior. The audit conclusion is used to indicate whether the network device is compliant or non-compliant.

[0010] According to the network security compliance audit method provided by the present invention, the method further includes: The audit conclusions are reviewed based on a pre-defined model to determine whether the audit conclusions are missing evidentiary information; In cases where audit conclusions lack evidentiary information, supplementary rules are triggered to provide supplementary explanations to the audit conclusions.

[0011] According to the network security compliance audit method provided by the present invention, the method further includes: When determining the audit conclusions for network equipment, the confidence level of the audit conclusions must be determined. If the confidence level is lower than the preset confidence level, create annotation information for the audit conclusion. The annotation information is used to indicate that the audit conclusion should be manually reviewed.

[0012] The present invention also provides a network security compliance audit device, comprising the following modules: a parsing module and a determining module; The parsing module is used to parse the audit tasks of network devices based on a preset model and a preset operation process database, obtain multiple sub-tasks, and determine the function call sequence of each sub-task. The function call sequence is used to call the data or functions associated with the sub-task. The determination module is used to determine the data retrieval conditions corresponding to each subtask. The data retrieval conditions include: data type and data retrieval range. The determination module is also used to determine the target data associated with each subtask from the network database based on the function call sequence and data retrieval conditions of each subtask; The determination module is also used to determine the audit conclusion of network devices based on the target data and audit tasks associated with each subtask.

[0013] According to the present invention, a network security compliance auditing device includes a network database comprising data of various data types, including at least one of the following: network configuration data, network topology data, network status data, and unstructured document data; the network security compliance auditing device further includes a processing module; the processing module is used for: By using keyword syntax tree pre-pruning, configuration data related to audit semantics is extracted to obtain network configuration data; The entire network graph structure is stored in a graph database, subgraphs are dynamically pruned, and nodes and edges relevant to audit requirements are returned to obtain network topology data. Based on a read-only command on-demand execution engine, commands are issued in real time according to the audit process and the echo is captured to obtain network status data; Construct paragraph-level vector indexes and attach document structure anchors to obtain unstructured document data based on precise semantic positioning.

[0014] According to the network security compliance auditing device provided by the present invention, each data item in network configuration data, network topology data, network status data, and unstructured document data is associated with a calling interface; the determining module is specifically used for: For a target subtask among multiple subtasks, the corresponding target call interface is invoked based on the function call sequence of the target subtask; Based on the data retrieval conditions corresponding to the target subtask, the target data associated with the target subtask is determined from the data associated with the target call interface.

[0015] According to the network security compliance auditing device provided by the present invention, the determining module is specifically used for: The target data and audit tasks are analyzed based on a preset model, and the audit conclusion of the network device is determined in combination with the network context. The network context includes at least one of the following: IP subnet affiliation and preset routing behavior. The audit conclusion is used to indicate whether the network device is compliant or non-compliant.

[0016] According to the network security compliance auditing device provided by the present invention, the determining module is further used for: The audit conclusions are reviewed based on a pre-defined model to determine whether the audit conclusions are missing evidentiary information; In cases where audit conclusions lack evidentiary information, supplementary rules are triggered to provide supplementary explanations to the audit conclusions.

[0017] According to the network security compliance auditing device provided by the present invention, the determining module is further used for: When determining the audit conclusions for network equipment, the confidence level of the audit conclusions must be determined. If the confidence level is lower than the preset confidence level, create annotation information for the audit conclusion. The annotation information is used to indicate that the audit conclusion should be manually reviewed.

[0018] The present invention also provides an electronic device, including a memory, a processor, and a computer program stored in the memory and executable on the processor, wherein the processor executes the computer program to implement any of the network security compliance audit methods described above.

[0019] The present invention also provides a non-transitory computer-readable storage medium having a computer program stored thereon, which, when executed by a processor, implements any of the network security compliance audit methods described above.

[0020] The present invention also provides a computer program product, including a computer program that, when executed by a processor, implements any of the network security compliance audit methods described above.

[0021] This invention provides a network security compliance auditing method, apparatus, device, medium, and product. Based on a preset model and a preset operation process database, it analyzes the audit task of a network device to obtain multiple sub-tasks and further determines the function call sequence of each sub-task. This allows for the invocation of data or functions associated with each sub-task based on its function call sequence. Furthermore, by determining the data retrieval conditions corresponding to each sub-task, the data type and data retrieval range are defined. Combined with the function call sequence of each sub-task, the target data associated with each sub-task can be determined from the network database. Then, by auditing the target data associated with each sub-task based on the audit task, the audit conclusion of the network device can be accurately determined. Thus, by analyzing the audit task to obtain sub-tasks and auditing the data associated with each sub-task separately, a comprehensive and accurate audit conclusion of the network device can be determined. This improves the efficiency of network security compliance auditing and enhances the accuracy of audit results. Attached Figure Description

[0022] To more clearly illustrate the technical solutions in this invention or the prior art, the drawings used in the description of the embodiments or the prior art will be briefly introduced below. Obviously, the drawings described below are some embodiments of this invention. For those skilled in the art, other drawings can be obtained from these drawings without creative effort.

[0023] Figure 1 This is one of the flowcharts of the network security compliance audit method provided by the present invention.

[0024] Figure 2 This is the second flowchart of the network security compliance audit method provided by the present invention.

[0025] Figure 3 This is the third flowchart of the network security compliance audit method provided by the present invention.

[0026] Figure 4 This is the fourth flowchart of the network security compliance audit method provided by the present invention.

[0027] Figure 5 This is the fifth flowchart of the network security compliance audit method provided by the present invention.

[0028] Figure 6 This is the sixth flowchart of the network security compliance audit method provided by this invention.

[0029] Figure 7 This is a schematic diagram of the network security compliance audit device provided by the present invention.

[0030] Figure 8 This is a schematic diagram of the structure of the electronic device provided by the present invention. Detailed Implementation

[0031] To make the objectives, technical solutions, and advantages of this invention clearer, the technical solutions of this invention will be clearly and completely described below with reference to the accompanying drawings. Obviously, the described embodiments are only some, not all, of the embodiments of this invention. All other embodiments obtained by those skilled in the art based on the embodiments of this invention without creative effort are within the scope of protection of this invention.

[0032] The following is combined Figures 1 to 8 This invention describes the network security compliance auditing methods, apparatus, equipment, media, and products provided by the present invention.

[0033] This invention aims to overcome the shortcomings of existing technologies, such as reliance on manual auditing processes, fragmented data sources, inability to understand natural language requirements, high noise levels in evidence retrieval, and contextual limitations. It provides an intelligent network security compliance auditing method, device, equipment, medium, and product. This method achieves end-to-end automation from natural language compliance requirements to audit conclusions through a two-level planning and two-level retrieval mechanism, achieving standardized audit processes, comprehensive evidence source coverage, and high-confidence conclusions.

[0034] Figure 1 This is one of the flowcharts illustrating the network security compliance auditing method provided by this invention, such as... Figure 1 As shown, the method includes the following: Step 101: Based on the preset model and preset operation process database, the audit tasks of the network device are parsed to obtain multiple sub-tasks, and the function call sequence of each sub-task is determined.

[0035] The function call sequence is used to call data or functions associated with subtasks.

[0036] Step 102: Determine the data retrieval conditions for each subtask.

[0037] The data retrieval criteria include: data type and data retrieval scope.

[0038] Step 103: Based on the function call sequence and data retrieval conditions of each subtask, determine the target data associated with each subtask from the network database.

[0039] Step 104: Based on the target data and audit tasks associated with each subtask, determine the audit conclusion of the network device.

[0040] In one possible implementation, when an audit of the network security compliance of network devices is required, an audit task (including audit requirements) can be created. Based on this audit task, a two-tiered planning of natural language compliance requirements can be performed.

[0041] Specifically, the first-level planning can be: based on the large language model (i.e., the preset model) and the pre-built standardized operation process library (i.e., the preset operation process database), the complex natural language requirements (such as audit requirements) in the task to be audited are decomposed into several high-level planning steps (i.e., multiple sub-tasks).

[0042] The second-level planning can be done by translating each high-level planning step into a low-level function call sequence (i.e., determining the function call sequence for each subtask). The function call interfaces corresponding to the function call sequence are pre-encapsulated. Specifically, the function call interfaces may include: topology query interface, configuration retrieval interface, command execution interface, document location interface, and subnet calculation interface. When a function call interface is called based on the function call sequence, the corresponding function call interface can be automatically activated.

[0043] In one possible implementation, task data (i.e., target data associated with each subtask, also known as audit evidence) can be accurately obtained based on two-level retrieval.

[0044] Specifically, in the first-level planning stage of the planning decomposition phase, a first-level retrieval (planning-level retrieval) can be performed. When analyzing the complex natural language requirements in the audit task based on the large language model, the data retrieval conditions (retrieval intent metadata) corresponding to each sub-task can be determined in advance. That is, the data source type (data type) and retrieval scope narrowing conditions (data retrieval scope, such as device set, time window, document chapter) required for each sub-task are determined, thus forming retrieval intent metadata.

[0045] Furthermore, a second-level search (execution-level search) is performed. Based on the search intent metadata, the underlying function calls activate the dedicated compression and positioning interface corresponding to each subtask (i.e., the function call interface corresponding to the function call sequence of each subtask). This accurately determines the target data associated with each subtask from the network database, achieving precise location of audit evidence. For example, the function call `find_config(device="R1", context="line vty")` used to find the specific configuration context of a network device can directly locate the VTY line configuration block, rather than returning the full configuration of R1.

[0046] Finally, based on the target data associated with each subtask and the tasks to be audited, the audit conclusions for the network devices are determined. The audit conclusions can be presented in the form of a structured audit report, which includes: the audit results for each audit requirement in the task to be audited, the cited evidence (target data), the reasoning basis, the confidence level, and recommendations for manual review.

[0047] In this embodiment, based on a preset model and a preset operation process database, the audit task of a network device is parsed to obtain multiple sub-tasks. Furthermore, the function call sequence of each sub-task is determined, allowing the invocation of data or functions associated with each sub-task based on this sequence. Further, by determining the data retrieval conditions corresponding to each sub-task, the data type and data retrieval range are defined. Combined with the function call sequence of each sub-task, the target data associated with each sub-task can be determined from the network database. Then, by auditing the target data associated with each sub-task based on the audit task, the audit conclusion of the network device can be accurately determined. Thus, by parsing the audit task to obtain sub-tasks and auditing the data associated with each sub-task separately, a comprehensive and accurate audit conclusion of the network device can be determined. This improves the efficiency of compliance auditing of network security and enhances the accuracy of audit results.

[0048] In one possible implementation, the network database includes data of various data types, including at least one of the following: network configuration data, network topology data, network status data, and unstructured document data.

[0049] Figure 2 This is the second flowchart of the network security compliance auditing method provided by the present invention, as shown below. Figure 2 As shown, the network database is determined in the following way: Step 201: Extract configuration data related to audit semantics by using keyword syntax tree pre-pruning to obtain network configuration data.

[0050] Step 202: Store the entire network graph structure in the graph database, perform dynamic subgraph pruning, and return the nodes and edges relevant to the audit requirements to obtain network topology data.

[0051] Step 203: Based on the read-only command on-demand execution engine, commands are issued in real time according to the audit process and the echo is captured to obtain network status data.

[0052] Step 204: Construct paragraph-level vector indexes and attach document structure anchors to obtain unstructured document data based on precise semantic positioning.

[0053] In this embodiment, a multi-source data access and compression layer (i.e., a network database) for auditing can be pre-constructed. This allows for the design of dedicated compression and location interfaces (i.e., function call interfaces) for the six types of data sources involved in network auditing: network configuration data, network topology data, network status data (device status data), organizational documents, vendor documents, and maintenance work orders. Organizational documents, vendor documents, and maintenance work orders can be collectively referred to as unstructured document data, and can correspond to the same function call interface or their respective function call interfaces.

[0054] Specifically, network configuration data can be obtained by pre-pruning using a keyword syntax tree, extracting only the configuration paragraphs relevant to audit semantics, rather than importing the entire dataset.

[0055] Network topology data: This is obtained by storing the entire network graph structure in a graph database, supporting dynamic subgraph pruning, and returning only the nodes and edges relevant to the audit requirements.

[0056] Network status data: This is obtained by designing a read-only command on-demand execution engine, rejecting the pre-fetching of the full status, and issuing commands in real time according to the audit steps and capturing the echoes.

[0057] Unstructured document data: This is obtained by constructing paragraph-level vector indexes and attaching document structure anchors (such as chapter titles), which supports precise semantic positioning rather than fuzzy fragment recall.

[0058] Thus, this application obtains network configuration data, network topology data, network status data, and unstructured document data through various methods, thereby constructing a network database that includes multiple data types. Based on accurately identifying the target data associated with each subtask from the network database, the audit tasks can be audited accurately and efficiently.

[0059] In one possible implementation, each piece of data in the network configuration data, network topology data, network status data, and unstructured document data is associated with a calling interface (function calling interface).

[0060] Figure 3 This is the third flowchart of the network security compliance auditing method provided by the present invention, as shown below. Figure 3 As shown, the method includes the following: Step 301: Based on the preset model and preset operation process database, analyze the audit tasks of the network device to obtain multiple sub-tasks, and determine the function call sequence of each sub-task.

[0061] Step 302: Determine the data retrieval conditions for each subtask.

[0062] Step 303: For the target subtask among multiple subtasks, call the corresponding target call interface based on the function call sequence of the target subtask.

[0063] Step 304: Based on the data retrieval conditions corresponding to the target subtask, determine the target data associated with the target subtask from the data associated with the target call interface.

[0064] Step 305: Based on the target data and auditable tasks associated with each subtask, determine the audit conclusion of the network device.

[0065] In this embodiment of the application, when performing the second-level search, the underlying function call can be performed based on the function call sequence of each subtask.

[0066] Specifically, the function call sequence of each subtask can activate the corresponding dedicated compression and positioning interface (i.e., the target call interface), thereby determining the target data associated with each subtask through the corresponding dedicated compression and positioning interface, and achieving precise positioning of audit evidence.

[0067] Figure 4 This is the fourth flowchart of the network security compliance auditing method provided by the present invention, as follows: Figure 4 As shown, the method includes the following: Step 401: Based on the preset model and preset operation process database, the audit tasks of the network device are parsed to obtain multiple sub-tasks, and the function call sequence of each sub-task is determined.

[0068] Step 402: Determine the data retrieval conditions for each subtask.

[0069] Step 403: Based on the function call sequence and data retrieval conditions of each subtask, determine the target data associated with each subtask from the network database.

[0070] Step 404: Analyze the target data and the tasks to be audited based on the preset model, and determine the audit conclusion of the network device in combination with the network context.

[0071] The network context includes at least one of the following: IP subnet affiliation, default routing behavior, and audit conclusions used to indicate whether network devices are compliant or non-compliant.

[0072] In one possible implementation, after identifying the target data associated with each subtask from the network database, further evidence reasoning is required. By inputting the identified target data associated with each subtask (the located evidence fragments) along with the audit requirements in the task to be audited into a large language model, and combining this with network context (such as IP subnet affiliation and default routing behavior) for compliance determination, the audit conclusion for the network device can be accurately determined, outputting audit conclusions such as compliant / non-compliant / inapplicable.

[0073] Thus, when this application analyzes target data and audit tasks based on a preset model, it can more accurately determine the audit conclusions of network devices by combining the network context (IP subnet affiliation, preset routing behavior).

[0074] Figure 5 This is the fifth flowchart of the network security compliance auditing method provided by the present invention, as shown below. Figure 5 As shown, the method includes the following: Step 501: Based on the preset model and preset operation process database, the audit tasks of the network device are parsed to obtain multiple sub-tasks, and the function call sequence of each sub-task is determined.

[0075] Step 502: Determine the data retrieval conditions for each subtask.

[0076] Step 503: Based on the function call sequence and data retrieval conditions of each subtask, determine the target data associated with each subtask from the network database.

[0077] Step 504: Based on the target data and auditable tasks associated with each subtask, determine the audit conclusion of the network device.

[0078] Step 505: Review the audit conclusions based on the preset model to determine whether the audit conclusions are missing evidentiary information.

[0079] Step 506: If the audit conclusion lacks evidentiary information, trigger the supplementary rules to provide supplementary explanations for the audit conclusion.

[0080] In one possible implementation, after determining the audit conclusion of the network device based on the target data and the audit task associated with each subtask, this application can further review the audit conclusion.

[0081] That is, this application introduces an iterative self-verification process, which backtracks the generated audit conclusions based on the Large Language Model (LLM) to check whether there are any missing evidence in the audit conclusions (e.g., only checking that SSH is enabled, but not checking the encryption algorithm). If missing evidence information is found, a supplementary plan is automatically triggered to supplement the audit conclusions.

[0082] Therefore, this application uses a large language model to review audit conclusions. This further ensures the accuracy of audit conclusions, allowing for timely triggering of supplementary rules to provide supplementary explanations when audit conclusions lack evidentiary information or are inaccurate. This, in turn, guarantees the accuracy of audit conclusions.

[0083] Figure 6 This is the sixth flowchart of the network security compliance auditing method provided by this invention, as shown below. Figure 6 As shown, the method includes the following: Step 601: Based on the preset model and preset operation process database, the audit tasks of the network device are parsed to obtain multiple sub-tasks, and the function call sequence of each sub-task is determined.

[0084] Step 602: Determine the data retrieval conditions for each subtask.

[0085] Step 603: Based on the function call sequence and data retrieval conditions of each subtask, determine the target data associated with each subtask from the network database.

[0086] Step 604: Based on the target data and auditable tasks associated with each subtask, determine the audit conclusion of the network device.

[0087] Step 605: When determining the audit conclusions for network devices, determine the confidence level of the audit conclusions.

[0088] Step 606: If the confidence level is less than the preset confidence level, create annotation information for the audit conclusion.

[0089] The annotation information is used to indicate that the audit conclusions have been manually reviewed.

[0090] In one possible implementation, this application, while determining the audit conclusion of the network device based on the target data and the task to be audited associated with each subtask, can further determine the confidence level of the audit conclusion. Thus, the confidence level of the audit conclusion characterizes its credibility.

[0091] Thus, when the confidence level of the audit conclusion is lower than the preset confidence level, the audited tasks of network devices can be manually reviewed by marking them with the standard information "manual review recommended." This manual review further ensures the accuracy of the audit conclusion.

[0092] In a complete implementation example, taking the audit task as "NTP function enable audit for all network devices (wide coverage audit with static configuration)" as an example, after the user inputs the audit requirement "All network devices must enable NTP time synchronization function," the Large Language Model (LLM) performs intent recognition and Standard Operating Procedure (SOP) loading on the audit requirement. The LLM agent analyzes the input audit requirement and identifies it as a "Feature Enablement" audit task. The LLM agent then automatically loads the "Function Status Check SOP," which specifies a standard execution path: determine the device scope - determine the function command characteristics - retrieve the configuration - determine compliance.

[0093] Further, the device scope needs to be determined (topology search). The large language model agent calls a topology query tool to obtain a list of active devices across the entire network (e.g., Device A and Device B). Then, it dynamically extracts feature keywords (document search). For Device A, the large language model agent searches for "NTP configuration" in Device A's manufacturer's manual and extracts the key configuration command feature term "ntp server". For Device B, the large language model agent searches for the key feature term "ntp-service unicast-server" in Device B's manufacturer's manual.

[0094] Next, configuration retrieval and evidence extraction are performed. The large language model agent uses the extracted keywords "ntpserver" and "ntp-service unicast-server" to perform precise searches in the configuration files of Device A and Device B, respectively. Ultimately, the results are as follows: Device A returns the configuration line "ntp server 192.168.1.1", while Device B returns null (not found). Therefore, according to the SOP judgment rules, it can be determined that Device A has a valid configuration and is deemed compliant, while Device B lacks configuration and is deemed non-compliant.

[0095] In another complete embodiment, taking the audit task as "firewall performance status compliance audit (numerical audit of dynamic operating status)" as an example, the user inputs the audit requirement: "The CPU and memory usage of all firewall devices in the local data center should not exceed 70%". The large language model agent performs semantic parsing and scope definition of the requirement. The large language model agent parses out two filtering conditions: Location = "Local Server Room" and Type = "Firewall", as well as the numerical constraints: CPU < 70% and Memory < 70%.

[0096] Further, intelligent object filtering is performed. The large language model agent calls `topology_query`, combines it with device metadata for filtering, and accurately locates the target device group: [FW Local A, FW Local B]. Then, it obtains status data (not configuration data). Since CPU and memory are runtime states, the large language model agent does not check the configuration file, but instead calls `exec_command(device_id, command="show system status")`. The specific command is automatically adapted by the large language model agent based on the vendor's knowledge base. The execution results are: FW Local A returns a text block containing CPU usage: 45%, Memory usage: 60%; FW Local B returns a text block containing CPU usage: 82%, Memory usage: 65%.

[0097] Based on this, numerical extraction and logical comparison are performed. The large language model agent uses text parsing capabilities to extract the numerical values ​​(45, 60, 82, 65) from the unstructured CLI output. Logical operations are then performed to determine that FW Local A is compliant if 45 < 70 and 60 < 70. Conversely, if FW Local B is non-compliant if 82 > 70, the large language model agent determines that FW Local B is non-compliant. The system outputs the results and issues an alarm for the high load state of FW Local B.

[0098] In another complete embodiment, taking the audit task as "Invalid Access Control Rule Audit (Statistical Data-Based Inference Audit)" as an example, the user inputs the audit requirement: "Delete redundant or invalid access rules: check the access rule hit rate statistics; rules with a failed hit rate are redundant or invalid." The large language model agent performs complex intent understanding and inference chain construction, understanding that "failed hit rate" in the context of network operations and maintenance usually refers to "hit count of 0" or "extremely low frequency." It then constructs the inference chain: obtain the ACL list - obtain the Hit Count (hit statistics) of the corresponding rules - filter rules with zero hits - mark them as invalid.

[0099] Then, multimodal data association retrieval is performed. The large language model agent first calls `find config` to obtain the device's ACL policy table (which defines rule IDs and actions). Subsequently, it calls `exec command(command="showaccess-list statistics" or "show firewall policy hit-count")` to obtain dynamic statistical data. Finally, structured analysis and cross-validation are performed. The large language model agent aligns the "static rule IDs" and "dynamic statistical data" in a tabular format. Specifically, rule ID 101 (Permit HR to Finance): Hit Count=15,420, determined to be valid; rule ID 102 (Permit Test-Vlan to Internet): Hit Count=0 (Last hit: never), determined to be "hit rate failure". Based on this, decision suggestions can be generated. Based on the reasoning results, rule ID 102 is marked as a "redundant / invalid rule".

[0100] This application's embodiment employs a two-level retrieval and data compression mechanism for network audit data, differing from the general RAG's "full embedding + top-k similarity." It designs a two-level retrieval system—planning-level intent pre-shrinking and execution-level precise positioning—specifically for network configuration, topology, and status data. Before evidence acquisition, semantic analysis determines the retrieval scope (e.g., specific devices, specific configuration blocks, specific document sections), significantly compressing the amount of data input to the LLM and fundamentally solving the problems of long context limitations and retrieval noise.

[0101] Furthermore, based on a two-tier planning architecture that decouples audit logic from data operations, natural language requirements are first decomposed into high-level planning steps (pure audit logic), and then translated into low-level function calls (specific data operations). This decoupling makes the audit process reusable and interpretable, and changes to the low-level data interface (such as switching from CLI to NETCONF) do not affect the high-level planning logic, significantly improving system robustness. Additionally, LLM behavioral constraints based on a standardized operation process library do not rely on LLM internalized knowledge for free planning; instead, the planning path of the LLM is guided by a pre-built standardized operation process library. This solidifies expert audit experience, ensuring the completion rate and standardization of complex cross-source audit tasks (such as joint reasoning of "configuration + topology + documentation").

[0102] Ultimately, based on an iterative self-verification and confidence scoring mechanism, LLM is upgraded from a single result generator to a "generation-verification" closed-loop system. By self-backtracking to check the completeness of evidence and outputting confidence scores, the illusion of large models is significantly suppressed, enhancing the credibility and traceability of automated auditing.

[0103] Thus, this application has the following significant effects: Improved evidence coverage: Through multi-source data access and two-level retrieval, it can handle six types of data sources, including configuration, topology, status, and documents, covering more than 90% of compliance audit items (based on common network device audit items of the Cybersecurity Classified Protection 2.0), while traditional tools only cover 22%.

[0104] Improved audit efficiency: In a typical small-to-medium-sized network (30 devices) audit task, manual audit takes an average of 8 person-days. The method of this invention reduces the audit time to 2 hours.

[0105] Accuracy and reliability: On a test set containing 40 compliance requirements, the consistency between the conclusions of this invention and the expert audit results reached 92%, which is 27 percentage points higher than the direct use of general LLM (65%). The confidence scoring mechanism successfully identified 100% of the model misjudgment cases and pushed high-risk items to manual review.

[0106] Standardization and universality: When the same set of audit requirements is input into different instances (different network sizes, different vendor equipment), the output conclusions differ by less than 5%, solving the industry pain point of "personalized results" in manual auditing.

[0107] The network security compliance audit device provided by the present invention is described below. The network security compliance audit device described below can be referred to in correspondence with the network security compliance audit method described above.

[0108] Figure 7 This is a schematic diagram of the network security compliance audit device provided by the present invention, as shown below. Figure 7As shown, the network security compliance audit device includes the following modules: parsing module 701, determining module 702, and processing module 703; The parsing module 701 is used to parse the audit tasks of the network device based on the preset model and the preset operation process database, obtain multiple sub-tasks, and determine the function call sequence of each sub-task. The function call sequence is used to call the data or functions associated with the sub-task. The determination module 702 is used to determine the data retrieval conditions corresponding to each subtask. The data retrieval conditions include: data type and data retrieval range. The determination module 702 is also used to determine the target data associated with each subtask from the network database based on the function call sequence and data retrieval conditions of each subtask; The determination module 702 is also used to determine the audit conclusion of the network device based on the target data and audit tasks associated with each subtask.

[0109] According to the present invention, a network security compliance auditing device includes a network database comprising data of various data types, including at least one of the following: network configuration data, network topology data, network status data, and unstructured document data; a processing module 703 is used for: By using keyword syntax tree pre-pruning, configuration data related to audit semantics is extracted to obtain network configuration data; The entire network graph structure is stored in a graph database, subgraphs are dynamically pruned, and nodes and edges relevant to audit requirements are returned to obtain network topology data. Based on a read-only command on-demand execution engine, commands are issued in real time according to the audit process and the echo is captured to obtain network status data; Construct paragraph-level vector indexes and attach document structure anchors to obtain unstructured document data based on precise semantic positioning.

[0110] According to the network security compliance auditing device provided by the present invention, each data item in network configuration data, network topology data, network status data, and unstructured document data is associated with a calling interface; the determining module 702 is specifically used for: For a target subtask among multiple subtasks, the corresponding target call interface is invoked based on the function call sequence of the target subtask; Based on the data retrieval conditions corresponding to the target subtask, the target data associated with the target subtask is determined from the data associated with the target call interface.

[0111] According to the network security compliance audit device provided by the present invention, the determining module 702 is specifically used for: The target data and audit tasks are analyzed based on a preset model, and the audit conclusion of the network device is determined in combination with the network context. The network context includes at least one of the following: IP subnet affiliation and preset routing behavior. The audit conclusion is used to indicate whether the network device is compliant or non-compliant.

[0112] According to the network security compliance auditing device provided by the present invention, the determining module 702 is further configured to: The audit conclusions are reviewed based on a pre-defined model to determine whether the audit conclusions are missing evidentiary information; In cases where audit conclusions lack evidentiary information, supplementary rules are triggered to provide supplementary explanations to the audit conclusions.

[0113] According to the network security compliance auditing device provided by the present invention, the determining module 702 is further configured to: When determining the audit conclusions for network equipment, the confidence level of the audit conclusions must be determined. If the confidence level is lower than the preset confidence level, create annotation information for the audit conclusion. The annotation information is used to indicate that the audit conclusion should be manually reviewed.

[0114] Figure 8 An example is a schematic diagram of the physical structure of an electronic device, such as... Figure 8 As shown, the electronic device may include a processor 810, a communications interface 820, a memory 830, and a communication bus 840. The processor 810, communications interface 820, and memory 830 communicate with each other via the communication bus 840. The processor 810 can call logical instructions in the memory 830 to execute a network security compliance audit method. This method includes: parsing the audit task of the network device based on a preset model and a preset operation process database to obtain multiple sub-tasks, and determining the function call sequence for each sub-task. The function call sequence is used to call data or functions associated with the sub-task. The method also includes: determining the data retrieval conditions corresponding to each sub-task, including data type and data retrieval range; determining the target data associated with each sub-task from the network database based on the function call sequence and data retrieval conditions for each sub-task; and determining the audit conclusion of the network device based on the target data associated with each sub-task and the audit task.

[0115] Furthermore, the logical instructions in the aforementioned memory 830 can be implemented as software functional units and, when sold or used as independent products, can be stored in a computer-readable storage medium. Based on this understanding, the technical solution of the present invention, in essence, or the part that contributes to the prior art, or a part of the technical solution, can be embodied in the form of a software product. This computer software product is stored in a storage medium and includes several instructions to cause a computer device (which may be a personal computer, server, or network device, etc.) to execute all or part of the steps of the methods of the various embodiments of the present invention. The aforementioned storage medium includes various media capable of storing program code, such as USB flash drives, portable hard drives, read-only memory (ROM), random access memory (RAM), magnetic disks, or optical disks.

[0116] On the other hand, the present invention also provides a computer program product, which includes a computer program that can be stored on a non-transitory computer-readable storage medium. When the computer program is executed by a processor, the computer can execute the network security compliance auditing method provided by the above methods. The method includes: parsing the audit task of the network device based on a preset model and a preset operation process database to obtain multiple sub-tasks, and determining the function call sequence of each sub-task, wherein the function call sequence is used to call data or functions associated with the sub-task; determining the data retrieval conditions corresponding to each sub-task, wherein the data retrieval conditions include: data type and data retrieval range; determining the target data associated with each sub-task from the network database based on the function call sequence and data retrieval conditions of each sub-task; and determining the audit conclusion of the network device based on the target data associated with each sub-task and the audit task.

[0117] In another aspect, the present invention also provides a non-transitory computer-readable storage medium storing a computer program thereon. When executed by a processor, the computer program is implemented to perform the network security compliance auditing methods provided by the above methods. The method includes: parsing the audit task of a network device based on a preset model and a preset operation process database to obtain multiple sub-tasks, and determining the function call sequence of each sub-task, wherein the function call sequence is used to call data or functions associated with the sub-task; determining the data retrieval conditions corresponding to each sub-task, wherein the data retrieval conditions include: data type and data retrieval range; determining the target data associated with each sub-task from the network database based on the function call sequence and data retrieval conditions of each sub-task; and determining the audit conclusion of the network device based on the target data associated with each sub-task and the audit task.

[0118] The device embodiments described above are merely illustrative. The units described as separate components may or may not be physically separate, and the components shown as units may or may not be physical units; that is, they may be located in one place or distributed across multiple network units. Some or all of the modules can be selected to achieve the purpose of this embodiment according to actual needs. Those skilled in the art can understand and implement this without any creative effort.

[0119] Through the above description of the embodiments, those skilled in the art can clearly understand that each embodiment can be implemented by means of software plus necessary general-purpose hardware platforms, and of course, it can also be implemented by hardware. Based on this understanding, the above technical solutions, in essence or the part that contributes to the prior art, can be embodied in the form of a software product. This computer software product can be stored in a computer-readable storage medium, such as ROM / RAM, magnetic disk, optical disk, etc., including several instructions to cause a computer device (which may be a personal computer, server, or network device, etc.) to execute the methods of various embodiments or some parts of embodiments.

[0120] Finally, it should be noted that the above embodiments are only used to illustrate the technical solutions of the present invention, and not to limit them; although the present invention has been described in detail with reference to the foregoing embodiments, those skilled in the art should understand that modifications can still be made to the technical solutions described in the foregoing embodiments, or equivalent substitutions can be made to some of the technical features; and these modifications or substitutions do not cause the essence of the corresponding technical solutions to deviate from the spirit and scope of the technical solutions of the embodiments of the present invention.

Claims

1. A network security compliance audit method, characterized in that, include: Based on a preset model and a preset operation process database, the audit tasks of network devices are parsed to obtain multiple sub-tasks, and the function call sequence of each sub-task is determined. The function call sequence is used to call the data or functions associated with the sub-task. Determine the data retrieval conditions for each subtask, including: data type and data retrieval range; Based on the function call sequence and data retrieval conditions of each subtask, the target data associated with each subtask is determined from the network database; Based on the target data associated with each subtask and the task to be audited, the audit conclusion of the network device is determined.

2. The network security compliance audit method according to claim 1, characterized in that, The network database includes data of various data types, including at least one of the following: network configuration data, network topology data, network status data, and unstructured document data; The network database is determined in the following way: The network configuration data is obtained by extracting configuration data related to audit semantics through keyword syntax tree pre-pruning. The entire network graph structure is stored in a graph database, subgraphs are dynamically pruned, and nodes and edges related to audit requirements are returned to obtain the network topology data. Based on the read-only command on-demand execution engine, commands are issued in real time according to the audit process and the echo is captured to obtain the network status data; Construct paragraph-level vector indexes and attach document structure anchors to obtain the unstructured document data based on precise semantic positioning.

3. The network security compliance audit method according to claim 2, characterized in that, Each item in the network configuration data, network topology data, network status data, and unstructured document data is associated with a calling interface; The process of determining target data associated with each subtask from the network database based on the function call sequence and data retrieval conditions for each subtask includes: For the target subtask among the multiple subtasks, the corresponding target call interface is invoked based on the function call sequence of the target subtask; Based on the data retrieval conditions corresponding to the target subtask, the target data associated with the target subtask is determined from the data associated with the target call interface.

4. The network security compliance audit method according to any one of claims 1-3, characterized in that, The process of determining the audit conclusion of the network device based on the target data associated with each subtask and the audit task includes: The target data and the task to be audited are analyzed based on the preset model, and the audit conclusion of the network device is determined in combination with the network context. The network context includes at least one of the following: IP subnet affiliation and preset routing behavior. The audit conclusion is used to indicate whether the network device is compliant or non-compliant.

5. The network security compliance audit method according to any one of claims 1-3, characterized in that, The method further includes: The audit conclusion is reviewed based on the preset model to determine whether the audit conclusion lacks evidentiary information. If the audit conclusion lacks the aforementioned evidentiary information, a supplementary rule is triggered to provide supplementary explanations for the audit conclusion.

6. The network security compliance audit method according to any one of claims 1-3, characterized in that, The method further includes: When determining the audit conclusion for the network device, the confidence level of the audit conclusion is determined; If the confidence level is less than the preset confidence level, annotation information is created for the audit conclusion, which is used to indicate that the audit conclusion should be manually reviewed.

7. A network security compliance auditing device, characterized in that, include: The parsing module and the determination module; The parsing module is used to parse the auditable tasks of the network device based on a preset model and a preset operation process database, obtain multiple sub-tasks, and determine the function call sequence of each sub-task. The function call sequence is used to call the data or functions associated with the sub-task. The determining module is used to determine the data retrieval conditions corresponding to each subtask, and the data retrieval conditions include: data type and data retrieval range; The determining module is further configured to determine target data associated with each subtask from the network database based on the function call sequence of each subtask and the data retrieval conditions. The determining module is further configured to determine the audit conclusion of the network device based on the target data associated with each subtask and the audit task.

8. An electronic device comprising a memory, a processor, and a computer program stored in the memory and running on the processor, characterized in that, When the processor executes the computer program, it implements the network security compliance audit method as described in any one of claims 1 to 6.

9. A non-transitory computer-readable storage medium having a computer program stored thereon, characterized in that, When the computer program is executed by a processor, it implements the network security compliance audit method as described in any one of claims 1 to 6.

10. A computer program product, comprising a computer program, characterized in that, When the computer program is executed by a processor, it implements the network security compliance audit method as described in any one of claims 1 to 6.

Images