Virtual patching based zero trust hardening method, device and electronic equipment

Abstract

This application provides a zero-trust hardening method, apparatus, and electronic device based on virtual patching, relating to the field of network security technology. The method includes: taking the services provided by multiple IP devices in the current network as first nodes, acquiring and constructing an initial device graph based on the node attribute characteristics of each first node, communication relationship edges between nodes, and affiliation relationship edges; fusing the node attribute characteristics in the created initial device graph, learning node relationships, clustering the nodes, synchronizing the identities of nodes in the same cluster, and pruning the nodes after shrinking, ultimately generating a target device graph containing multiple identities. Deploying security components on the devices indicated by the nodes included in the target device graph, forwarding external device traffic without access permissions to a permission pre-verification port, and discarding all requests to ports other than the permission pre-verification port; achieving zero trust in external devices to improve the security of the current network.

Description

Technical Field

[0001] This application relates to the field of cybersecurity technology, and in particular to zero-trust hardening methods, apparatus and electronic devices based on virtual patching. Background Technology

[0002] With the rapid development and application of the Internet of Things (IoT), IoT platforms have also been widely used and deployed. However, security issues such as unauthorized access vulnerabilities, privilege escalation, information leakage, and file upload vulnerabilities in IoT platform ports seriously affect the overall security of the platform. Furthermore, the customized development of IoT application platforms makes the discovery and remediation of security vulnerabilities at the business ports difficult.

[0003] The security of the business ports of an IoT application platform is directly related to the platform itself. Because these ports are directly exposed to the internet, IoT application platforms are constantly vulnerable to malicious scanning and attack attempts. To protect these business ports from attack, IoT application platforms typically employ a software-defined perimeter architecture, encapsulating them with zero trust.

[0004] Existing zero-trust network management solutions perform security authentication on all requests from the request initiator through a gateway, which cannot be refined to the service level. Therefore, there is an urgent need for a new zero-trust hardening method based on virtual patching to solve the above-mentioned technical problems. Summary of the Invention

[0005] The purpose of this application is to provide a zero-trust hardening method, apparatus, and electronic device based on virtual patching, enabling more granular security control. The specific technical solution is as follows: In a first aspect, embodiments of this application provide a zero-trust hardening method based on virtual patching, the method comprising: In response to the triggering of preset conditions, taking the services provided by multiple IP devices in the current network as the first node, the initial device graph is constructed based on the node attribute characteristics of each first node, the communication relationship edges between each node, and the affiliation relationship edges. The node attribute characteristics include at least vulnerability characteristics, service detail characteristics, and service sequence characteristics. Input the initial device graph into a pre-trained graph embedding representation model to obtain node fusion features that match each first node, and cluster the first nodes according to the node fusion features to generate multiple clusters; For each cluster, obtain the known identity information of the first node contained therein to generate the corresponding full identity table, and configure the identity information of the service indicated by the first node in the cluster using the full identity table; Using IP devices as the second node, after shrinking the second node according to the affiliation edge, abnormal nodes are filtered and deleted according to the communication relationship edge between the second nodes to generate the target device graph; Deploy a security component on the IP device indicated by the second node in the target device graph, triggering the security component to initialize the access permissions of the IP device according to the communication relationship edge contained in the target device graph. The access permissions include open permissions and restricted permissions. Upon receiving an access request from a target IP device with restricted access permissions, the security component is triggered to forward the access request to the permission pre-verification port for identity pre-verification. After the identity pre-verification is successful, the corresponding attack inspection policy is invoked based on the identity information of the target IP device to perform attack inspection on the access request, and the target service in the target IP device is opened after the attack inspection is successful.

[0006] Optionally, obtain the node attribute features of each first node, including: Actively scan IP devices and services in the current network to obtain raw, proactive data containing service vulnerability information and device information. Traffic data generated by each service in the current network is collected by bypass mirroring traffic monitoring, and the service detail features and service sequence features are extracted based on the traffic data; Based on the service detail features, the service sequence features, and the service vulnerability information contained in the original active data, node attribute features matching each of the services are generated.

[0007] Optionally, before invoking the corresponding attack inspection policy based on the identity information of the target IP device to perform attack inspection on the access request, the method includes pre-constructing a mapping table containing attack inspection policies and identity information: For any given service, obtain the service vulnerability information corresponding to the service, and integrate the service vulnerability information of other services with the same identity information as the service to generate summary vulnerability information; Based on the known vulnerabilities included in the aggregated vulnerability information, find the corresponding virtual patches to generate an attack inspection strategy; Associate services with attack detection policies to generate a mapping table.

[0008] Optionally, while generating the target device map, IP asset attribute tags are constructed based on the IP device as the primary key and the device information. The device information includes at least the device manufacturer, device type, and device model. The method also includes: In response to the detection of a new IP device coming online, the access permissions of the new IP device are set to restricted permissions, and the IP asset attribute tags are checked to see if there is target device information that matches the new IP device. If matching device information exists, the target identity information of the IP device corresponding to the target device information is obtained to configure the identity information of the new IP device.

[0009] Optionally, the first node is clustered based on node fusion features to generate multiple clusters, including: Calculate the reach distance between each first node based on the node fusion characteristics, and construct a minimum spanning tree containing each first node using the reach distance as the edge; The edges of the minimum spanning tree are removed in descending order of mutual distance to split and obtain the hierarchical structure tree; Traverse the hierarchical structure tree to obtain candidate cut points, and calculate the stability score of all clusters under each cut point; The candidate cut point with the highest stability score is determined as the target cut point, and the hierarchical structure tree is cut according to the target cut point to obtain the optimal clustering result, wherein the optimal clustering result includes at least one cluster, and each cluster contains at least one first node.

[0010] Optionally, abnormal nodes can be filtered based on the communication relationship edges between nodes, including: Record the out-degree and in-degree counts of the second node with a communication relationship edge, and determine the second node whose out-degree count to in-degree count ratio is greater than a first preset threshold as an abnormal node; and / or, Record the number of connected nodes of the second node with a communication relationship edge, and determine the second node whose ratio of the number of connected nodes to the total number of second nodes in the target device graph is greater than a second preset threshold as an abnormal node; and / or, Record the connection duration of the second node with a communication relationship edge, and determine the second node whose average connection duration is less than a third preset threshold as an abnormal node; and / or, Record the identity information of the second node with a communication relationship, and identify the second node without identity information as an abnormal node.

[0011] Optionally, the method also includes a training method for the graph embedding representation model: Obtain the initial training graph for training, which includes nodes and edges; Randomly delete edges of a first preset proportion from the initial training graph to generate the first augmented graph; Randomly set the node attribute features of nodes in the initial training graph to zero according to a second preset ratio to generate a second augmented graph; Extract the embedding representation features corresponding to the nodes in the first augmented graph and the embedding representation features corresponding to the nodes in the second augmented graph; Positive sample pairs are constructed based on the embedding representation features of the same nodes in the first and second augmented graphs. Negative sample pairs are constructed based on the embedding representation features of different nodes in the first and second augmented maps. Based on positive and negative sample pairs, the graph embedding representation model is iterated until the model converges.

[0012] Optionally, after triggering the security component to forward the access request to the permission pre-verification port for identity pre-verification, the process also includes: In response to the failure of identity pre-verification, a general error code is returned to the terminal device that initiated the access request; Upon successful identity pre-verification, a dynamic access token is issued to the initiating terminal device; After verifying that the dynamic access token possessed by the terminal device is within its validity period, the corresponding attack detection policy is invoked to perform attack detection based on the identity information corresponding to the destination IP device.

[0013] Secondly, embodiments of this application provide a zero-trust hardening device based on virtual patching, the device comprising: The preparation module is used to respond to preset conditions and take the services provided by multiple IP devices in the current network as the first node. It obtains and constructs an initial device graph based on the node attribute characteristics of each first node, the communication relationship edges between each node, and the affiliation relationship edges. The node attribute characteristics include at least vulnerability characteristics, service detail characteristics, and service sequence characteristics. The preparation module is also used to input the initial device graph into a pre-trained graph embedding representation model to obtain node fusion features that match each first node, and to cluster the first nodes according to the node fusion features to generate multiple clusters; The preparation module is also used to obtain the known identity information of the first node contained in each cluster to generate the corresponding full identity table, and to configure the identity information of the service indicated by the first node in the cluster using the full identity table. The preparation module is also used to shrink the second node based on the affiliation edge, with the IP device as the second node, and then filter and delete abnormal nodes based on the communication relationship edge between the second nodes to generate a target device graph. The initialization module is used to deploy a security component on the IP device indicated by the second node in the target device graph, and to trigger the security component to initialize the access permissions of the IP device according to the communication relationship contained in the target device graph. The access permissions include open permissions and restricted permissions. The verification module is used to respond to an access request from a target IP device with restricted access permissions, and trigger the security component to forward the access request to the permission pre-verification port for identity pre-verification. The verification module is also used to call the corresponding attack checking policy to check the access request for attack after the identity pre-verification is passed, based on the identity information corresponding to the target IP device, and to open the target service in the target IP device after the attack check is passed.

[0014] Thirdly, embodiments of this application provide an electronic device, including: Memory, used to store computer programs; When a processor executes a program stored in memory, it implements the zero-trust hardening method based on virtual patching disclosed in the first aspect.

[0015] This application also provides a computer program product containing instructions that, when run on a computer, cause the computer to execute the zero-trust hardening method based on virtual patching disclosed in the first aspect.

[0016] Beneficial effects of the embodiments in this application: The zero-trust hardening method based on virtual patching provided in this application integrates node attribute features in the created initial device graph, learns node relationships, clusters nodes, synchronizes the identities of nodes within the same cluster, and prunes and shrinks nodes to generate a target device graph containing multiple identities. Security components are deployed on the devices indicated by the nodes in the target device graph, forwarding traffic from external devices without access permissions to a permission pre-verification port, and discarding all requests to ports other than the permission pre-verification port; thus achieving zero trust in external devices. Simultaneously, after extending the identities of services on various service ports under IP devices in the current network, an attack inspection policy is configured for each service. The security component uses this attack inspection policy to intercept malicious access, achieving "virtual patching" at the service level without requiring code updates or modifications to specific port service vulnerabilities. This significantly improves the security and stability of the current network, achieving hardening of the zero-trust network.

[0017] Of course, implementing any product or method of this application does not necessarily require achieving all of the above advantages at the same time. Attached Figure Description

[0018] To more clearly illustrate the technical solutions in the embodiments of this application or the prior art, the drawings used in the description of the embodiments or the prior art will be briefly introduced below. Obviously, the drawings described below are only some embodiments of this application. For those skilled in the art, other embodiments can be obtained based on these drawings.

[0019] Figure 1 A schematic diagram of a zero-trust hardening method based on virtual patching provided in this application embodiment; Figure 2 This application provides a schematic diagram of a graph embedding representation model architecture. Figure 3 A schematic diagram of a zero-trust hardening device architecture based on virtual patching is provided for embodiments of this application; Figure 4 This is a block diagram of an electronic device provided in an embodiment of this application. Detailed Implementation

[0020] The technical solutions of the embodiments of this application will be clearly and completely described below with reference to the accompanying drawings. Obviously, the described embodiments are only some embodiments of this application, and not all embodiments. Based on the embodiments of this application, all other embodiments obtained by those skilled in the art based on this application are within the scope of protection of this application.

[0021] As described in the background section, with the development of IoT technology, the number of business ports on various IoT platforms typically reaches thousands, of which hundreds are known to have security vulnerabilities. Therefore, protecting these massive numbers of business ports from attacks and exploitation has become an urgent problem to solve.

[0022] Existing zero-trust network management solutions primarily rely on installing clients and gateways. The client handles and identifies all requests from the request initiator, obtains authentication from the network administrator through a knocking mechanism, and then accesses the responder, achieving zero trust in the network. However, existing solutions only use the gateway as an aggregate for request authentication, failing to implement different security check strategies for different services and thus lacking granular control over various services within the network. Therefore, this application provides a zero-trust hardening method based on virtual patching to achieve granular control over the services provided by various devices in the network while ensuring inspection efficiency.

[0023] Example 1 This application provides a zero-trust hardening method based on virtual patching, applied to a security center in a current network. It is understood that the security center can be a virtual machine or other network device used to execute the disclosed network security method. This application does not limit the type of device for the security center. Figure 1 As shown, it specifically includes the following: S100. In response to the triggering of preset conditions, taking the services provided by multiple IP devices included in the current network as the first node, obtain and construct an initial device graph based on the node attribute characteristics of each first node, the communication relationship edges between each node, and the affiliation relationship edges.

[0024] Specifically, the aforementioned preset conditions are pre-set conditions used to trigger the generation of the target device diagram mentioned later, such as the current network restart and version update. Of course, in some implementation scenarios, in order to ensure the compatibility of the generated target device diagram with the current network, the target device diagram is triggered after a preset time period is met. The aforementioned time period can be a quarter, a month, etc., which can be set by those skilled in the art according to actual needs. This application does not limit it.

[0025] It should be noted that, typically, a network contains multiple IP devices, and each IP device contains multiple service ports, each of which can provide one or more services. In this application, the initial device graph is constructed with services as the first node. It can be understood that different services on the same port of the same IP device are two nodes. For example, port 5041 of 192.169.1.1, which opens Syslog TCP (Transmission Control Protocol) service and UDP (User Datagram Protocol) service respectively, are two nodes.

[0026] Among these, node attribute characteristics include at least vulnerability characteristics, service detail characteristics, and service sequence characteristics; in some implementation scenarios, the methods for obtaining the above node attribute characteristics include: S110. Actively scan the IP devices and services in the current network to obtain raw active data containing service vulnerability information and device information.

[0027] Specifically, by deploying a lightweight agent or utilizing agentless scanning technology, one can proactively scan for IP devices and services on the current network, that is, actively send specific probe requests or connection packets to IP devices or services. Then, the system collects raw, proactive data such as banner information, certificate information, and protocol versions. It's understood that banner information typically includes service software name, version number, hostname, device type, device model, device manufacturer, and even operating system information. Device information on the network can be accurately identified directly through banner information, including the type and version of the running service, device type, device model, device manufacturer, and operating system information. Furthermore, by comparing the version number or the information returned by the vulnerability scanning probe packets, it's possible to quickly determine whether the service has any known public vulnerabilities. In other words, device information and service vulnerability information on a service can be obtained through banner information. This application does not limit the specific type of proactive scanning method.

[0028] S120. Collect traffic data generated by each service in the current network through bypass mirror traffic monitoring, and extract service detail features and service sequence features based on the traffic data.

[0029] The aforementioned traffic data is used to analyze the communication matrix of actual business ports, including plaintext traffic data as well as encrypted and / or non-plaintext traffic data, such as source IP address, destination IP address, source port, destination port, protocol type, packet size, packet sequence, TLS handshake information, etc.

[0030] Specifically, service detail features are detailed features extracted from the application layer payload of plaintext traffic data. These features describe specific service behaviors, protocol interaction details, or resource identifiers, and possess clear semantic information. The extraction method involves deep packet inspection (DPI) of plaintext traffic (such as HTTP (Hypertext Transfer Protocol), FTP (File Transfer Protocol Traffic), and some unencrypted ONVIF (Open Network Video Interface Forum) / SIP (Session Initialization Protocol) traffic). After parsing the application layer payload according to the protocol specifications, the original text or values ​​of the aforementioned fields are extracted to obtain the specific field information for each protocol. For example, the URI information " / api / v1 / login", the HTTP Method information "GET", and the version information "HTTP / 1.1" are extracted from HTTP request messages. Then, the specific field information of each protocol is vectorized using a word embedding model (such as Word2Vec) to convert it into fixed-dimensional word vectors. Finally, the vectors of multiple features are concatenated to form the final service detail features.

[0031] Service sequence features are time-related characteristics extracted from encrypted or non-plaintext traffic (such as TLS (Transport Layer Security) / SSL (Secure Sockets Layer) encrypted traffic) to characterize the dynamic behavior patterns of service interactions. Since the payload content cannot be directly parsed, statistical patterns of traffic data (such as packet size, timing, and handshake information) are used as service sequence features. First, extract packet size (bytes), timestamps (milliseconds), and TLS handshake message field information from the traffic session in chronological order. For example, record the size sequence of the first 100 packets of a TLS session [1500, 120, 800, ...] and the time interval between packets [0, 1.2, 0.8, ...]. Then, standardize the field information, padding or truncating variable-length sequences to ensure uniform length, and normalize the numerical features. For example, fill sequences with 0s for sequences with fewer than 100 packets, truncate sequences with more than 100 packets, and normalize the values ​​to the range of 0-1. Vectorize the standardized features, treating each data point in the sequence as a "word" and using a word embedding model to generate its vector representation. Finally, concatenate the vectors of multiple features to form the final service sequence feature.

[0032] S130. Based on service detail features, service sequence features, and service vulnerability information contained in the original active data, generate node attribute features that match each service.

[0033] That is, based on the original active data disclosed above, information containing service vulnerabilities is obtained, and combined with the above-mentioned service detail features and service sequence features, corresponding node attribute features are generated for each service (i.e., the corresponding first node).

[0034] It should be noted that there is no order requirement between steps S110 and S120. Step S110 can be executed first and then step S120, or step S120 can be executed first and then step S110, or steps S110 and S120 can be executed simultaneously.

[0035] The communication relationship edge is obtained based on the aforementioned key passive data. That is, if there is interaction between two services, it can be determined that there is a communication relationship edge between the two nodes corresponding to these two services. The attribute values ​​of the edge include at least the number of connections and the duration. The affiliation relationship edge is determined according to the distribution relationship of services on the IP device. The first node belonging to the same IP device has an affiliation relationship edge, which is an undirected edge.

[0036] Furthermore, in some implementation scenarios, this application also proposes to use IP devices as the primary key and construct IP asset attribute tags based on device information while generating the target device map. The device information includes at least the device manufacturer, device type, and device model. The device information is based on original, proactive data acquisition, as already disclosed above, and will not be elaborated upon here.

[0037] This application proposes that, in response to the detection of a new IP device coming online, the security center sets the access permissions of the new IP device to restricted permissions and searches for target device information matching the new IP device within the IP asset attribute tags. If matching device information exists, the target identity information of the matching IP device is obtained to configure the identity information of the new IP device. That is, if the newly connected device has the same manufacturer, type, and model as an existing device in the target device graph, the identity information of the new IP device can be initialized by referring to the identity information corresponding to the node in the target device graph, so as to configure attack detection strategies for services on that IP device in the future.

[0038] S200: Input the initial device graph into the pre-trained graph embedding representation model to obtain node fusion features that match each first node, and cluster the first nodes according to the node fusion features to generate multiple clusters.

[0039] Specifically, the architecture of the above graph embedding representation model adopts the following... Figure 2 The network architecture shown is encoder + decoder. The encoder can be implemented using graph neural networks such as GCN (Graph Convolutional Network) or GAT (Graph Attention Networks); the decoder can be implemented using MLP (Multilayer Perceptron), or other feedforward neural network models suitable for feature extraction. This application does not limit the specific choice of encoder and decoder. Through the graph embedding representation model, the original features of each node in the initial device graph can be processed into a 128-bit one-dimensional feature vector. The original features include graph adjacency matrix features (corresponding to the communication and dependency edges mentioned above), service detail features, and service sequence features. Simultaneously, the graph embedding representation model is used to learn the relationships between nodes, achieving the fusion of service detail features and serialization features in the node attribute features to generate a more efficient, robust, and semantically rich embedded representation of fused node features, thereby improving the ability to model node relationships in the graph structure, facilitating subsequent optimization of the original device graph to generate the target device graph.

[0040] The training methods for the above graph embedding representation models include: Obtain an initial training graph for training, which includes nodes and edges; it is understood that the initial training graph may be a graph containing nodes and edges generated based on some known network topology, which will not be elaborated here.

[0041] Randomly delete edges of a first preset proportion in the initial device graph to generate a first enhanced graph; that is, simulate network changes through the "edge dropping" method to achieve data enhancement of the initial device graph. The first preset proportion can be 10%, 15%, etc. The specific value is determined by those skilled in the art based on actual conditions and experience, and this application does not limit it.

[0042] The node attribute features contained in the nodes of the initial device diagram at a second preset ratio are randomly set to zero to generate a second enhanced diagram; that is, by simulating feature noise, a certain proportion of node attribute features are cleared to achieve data enhancement of the initial device diagram; wherein the second preset ratio can be 10%, 15%, etc., and the specific value is determined by those skilled in the art based on actual conditions and experience, and this application does not limit it.

[0043] Extract the embedding representations of nodes in the first augmented graph and the embedding representations of nodes in the second augmented graph; specifically, the same graph embedding representation model can be used to generate feature representations for all nodes in the first and second augmented graphs, for example, using [ … ] represents all the embedded representation features corresponding to the nodes in the first augmented graph, denoted by [ … ] represents the embedding representation of all nodes in the second augmented graph; where n represents the number of nodes.

[0044] Positive sample pairs are constructed based on the embedding representation features of the same node in the first and second augmented maps; that is, the embedding representation features of the same node in the first and second augmented maps are paired to generate a positive sample pair, which can be represented by (…). , Let represent a positive sample pair, where i <= n, and n represents the node index. Based on the principle that the same node identity should maintain feature similarity under different enhancement conditions, positive sample pairs are used to capture the invariance of node identity.

[0045] Based on the embedding representation features of different nodes in the first and second augmented maps, negative sample pairs are constructed; that is, the embedding representation features of different nodes in the first and second augmented maps are paired to generate a negative sample pair, which can be used as ( , () represents a negative sample pair; where j <= n and j Typically, multiple different node pairs are randomly sampled to cover all possible combinations. Negative sample pairs emphasize the feature differences between different node identities, used to distinguish node identities. By comparing positive and negative samples, the model optimizes the distance between node attribute features in the embedding space: the feature vectors of similar nodes are closer together, while the feature vectors of different nodes are farther apart; this helps to identify semantic similarity between nodes in unsupervised manner, without the need for manual labeling.

[0046] The graph embedding representation model is iterated based on positive and negative sample pairs until convergence. Specifically, the parameters of the graph embedding representation model are trained by minimizing the positive sample difference and maximizing the negative sample difference, ultimately outputting the trained model; the loss function is designed as follows:

[0047] in, Represented as The embeddings of nodes in the first and second augmented graphs represent the similarity of features (which can be set as the reciprocal of the Euclidean distance; a larger value indicates closer feature distances, and a smaller value indicates farther feature distances). In the loss function, a larger numerator indicates more similar positive samples, and a smaller denominator indicates less similar negative samples, resulting in a smaller loss. This process is repeated multiple times until the model converges to obtain the final graph embedding representation model. The criteria for determining model convergence are standard in this field and will not be elaborated upon here.

[0048] In some implementation scenarios, the above-mentioned clustering of the first node based on node fusion characteristics to generate multiple clusters specifically includes: S210. Calculate the reach distance between each first node based on the node fusion characteristics, and construct a minimum spanning tree containing each first node using the reach distance as the edge. That is, construct a complete graph by using the reach distance between all nodes as edge weights, and then generate a minimum spanning tree; only nodes with reachable density will be connected together, and sparse abnormal nodes will not be connected due to excessive reach distance, forming isolated edges; therefore, the generated minimum spanning tree only retains edges with small reach distances, naturally connecting nodes in high-density areas while isolating low-density nodes.

[0049] Specifically, firstly, the core distance between each first node is calculated. This distance can be represented by a distance set formed by selecting the distances of the K nearest neighbors. , Indicates the first node Core distance, This represents the first node, including its K neighbor nodes. and the first node The original distance between The original distance can be Euclidean distance, and the specific calculation method is a conventional technique in this field, which will not be elaborated here. Furthermore, the reachability distance between two first nodes is defined. , That is, the first node and the first node The reachability between the two nodes is the first node. Core distance, first node Core distance and first node and the first node The reachability distance is the maximum of the three original distances. It can be understood that the reachability distance represents the minimum cost for two nodes to be "density reachable"; if one of the nodes is in a low-density area (large core distance), or if they are far apart, the reachability distance will increase, that is, the connectivity cost will increase.

[0050] S220. Remove edges from the minimum spanning tree in descending order of their reachability to split it into a hierarchical tree structure. Edges in the minimum spanning tree are removed in descending order of their reachability; each time an edge is removed, the minimum spanning tree splits into two subtrees, forming a hierarchical tree structure, i.e., a hierarchical tree structure. It can be understood that in the hierarchical tree structure, the order in which clusters are merged or split is determined by their reachability: edges with smaller distances are removed later, indicating that the clusters are tightly connected.

[0051] S230. Traverse the hierarchical structure tree to obtain candidate cut points, and calculate the stability score of all clusters under each cut point.

[0052] For each cluster in the hierarchical structure tree, its stability score at different split levels is automatically evaluated. The stability score quantifies the compactness and separability of the cluster; clusters with higher scores indicate that they remain stable over a wider distance range and are more suitable as the final clustering result. Specifically, starting from the root node of the hierarchical structure tree, each possible split level (i.e., candidate split point) is traversed downwards. Each candidate split point generates a set of clusters; for each candidate split point, the sum of the stability scores of all clusters under that point is calculated. For example, split point A generates clusters 1, 2, and 3, with stability scores of 0.8, 0.6, and 0.3 respectively, resulting in a total of 1.7. Split point B generates clusters 1, 2, 3, 4, and 5, with scores of 0.7, 0.5, 0.4, 0.2, and 0.1 respectively, resulting in a total of 1.9.

[0053] S240. Determine the candidate cut point with the highest stability score as the target cut point, and cut the hierarchical structure tree according to the target cut point to obtain the optimal clustering result. The optimal clustering result includes at least one cluster, and each cluster contains at least one first node. It can be understood that the sum of stability scores reflects the "robustness" of the overall clustering structure under the candidate cut point. The larger the sum, the more stable and reliable the resulting clusters are. Therefore, the candidate cut point with the highest sum of stability scores is selected as the target cut point to represent the optimal clustering result.

[0054] This application achieves unsupervised node clustering through hierarchical splitting and stability analysis. It eliminates the need for pre-defined clusters, automatically adapts to density variations among nodes, and automatically isolates abnormal nodes. The above is merely an exemplary clustering algorithm. Those skilled in the art can employ other clustering algorithms, such as the K-means algorithm, to cluster the first nodes in the current network in other implementation scenarios. This application does not limit this approach.

[0055] S300. For each cluster, obtain the known identity information of the first node contained therein to generate the corresponding full identity table, and use the full identity table to define the identity information of the service indicated by the first node in the cluster.

[0056] An IP device can be identified as a specific platform (e.g., a video image information application platform) through active scanning. However, if this platform also includes storage functions belonging to an NVR platform (Network Video Recorder) or intelligent analysis services belonging to an algorithm platform, treating it only as a video image information application platform will lead to significant conflicts in subsequent attack detection strategies for access service requests. To resolve this conflict, this application proposes supplementing the identity of the first node contained in each cluster.

[0057] It is understandable that, through the aforementioned steps, the first nodes in the initial device graph have been clustered based on the reach distance between each node. In this case, the identity similarity of nodes in the same cluster is high. Therefore, this application proposes to configure the same identity information for all first nodes in the same cluster. Specifically, the known identity information of each first node in the same cluster can be obtained through active scanning. The identity corresponding to each first node may be the same or different. A full identity table is generated by summarizing and deduplicating the multiple known identities contained in the known identity information of each node. It should be noted that a cluster corresponds to the first full identity table; the identity information of all first nodes in this cluster is all the known identities contained in this full identity table.

[0058] S400: Using IP devices as the second node, shrink the second node according to the affiliation edge, and then filter and delete abnormal nodes according to the communication relationship edge between the second nodes to generate the target device graph.

[0059] First, based on the subordinate relationship edges contained in each first node, the first nodes belonging to the same IP device are shrunk into a new logical node (i.e., the second node), thus shrinking the initial device graph. At this time, the meaning of the node changes from the service under the IP device to the IP device itself. During this process, the identity information and service vulnerability information contained in each first node are also aggregated to the new logical node. That is, the service-level information is aggregated to the IP device level.

[0060] Then, based on the communication relationships between the second node, abnormal nodes are filtered and deleted, thereby pruning the nodes at the IP device level of the initial device graph. Specifically, the above-mentioned method for filtering abnormal nodes includes: The out-degree and in-degree counts of the second node with communication relationship edges are recorded. Second nodes whose out-degree to in-degree ratio is greater than a first preset threshold are identified as abnormal nodes. The first preset threshold can be set to 10, or it can be set by those skilled in the art based on actual circumstances and experience; this application does not limit this setting. It is understood that the communication relationship edges of the second node are determined by summarizing the communication relationship edges between all first nodes under that second node.

[0061] And / or, record the number of connected nodes of the second node with a communication relationship edge, and determine the second node whose ratio of the number of connected nodes to the total number of second nodes contained in the target device graph is greater than a second preset threshold as an abnormal node; wherein the second preset threshold can be set to 0.1, or it can be set by those skilled in the art according to the actual situation and experience, and this application does not limit it.

[0062] And / or, record the connection duration of the second node with a communication relationship, and determine the second node whose average connection duration is less than a third preset threshold as an abnormal node; that is, record the connection duration of each second node to other nodes, and calculate the average connection duration. If the average is less than the third preset threshold, it is marked as an abnormal node. The third preset threshold can be 0.1s, or it can be set by those skilled in the art based on actual conditions and experience; this application does not limit this setting.

[0063] And / or, record the identity information of the second node with a communication relationship, and identify the second node without identity information as an abnormal node; that is, mark the second node that can be accessed but does not provide service as an abnormal node. Through the above pruning operation, abnormal IP devices are identified, ensuring that every IP device in the final generated target device graph can provide normal service, thus guaranteeing the accuracy of the generated target device graph.

[0064] After the aforementioned node feature fusion, node aggregation, node shrinking, and node pruning processes, a final target device graph is obtained. This target device graph contains second nodes defined by IP devices, whose node attribute features include various service information, vulnerability summary information, and node fusion features; edges represent valid interaction information between IP devices. This application uses this target device graph to perform subsequent service permission configuration and attack detection strategy updates.

[0065] S500, Deploy a security component on the IP device indicated by the second node contained in the target device diagram, and trigger the security component to initialize access permissions on the IP device according to the communication relationship contained in the target device diagram.

[0066] Specifically, this application determines the IP devices requiring security component deployment based on the second nodes included in the target device diagram obtained above, and uses the security components to take over the access permissions of each IP device; wherein the access permissions include open permissions and restricted permissions; access permissions are only opened to the second nodes containing communication relationship edges in the target device diagram, that is, access ports are only opened to IP devices containing communication relationship edges; restricted permissions are configured for other IP devices without communication relationship edges, and only the permission pre-verification port is opened. It should be noted that the permission pre-verification port is set on the security center.

[0067] S600: In response to receiving an access request from a target IP device with restricted access permissions, the security component is triggered to forward the access request to the permission pre-verification port for identity pre-verification.

[0068] It's important to note that the security center directly opens the corresponding access port for received access requests to target IP devices with open access permissions, allowing external devices to access the target IP device. Based on the target service address contained in the access request, the corresponding service port is opened to provide the target service. The security center discards all access requests to ports other than the already opened access ports and the pre-verified authentication port. Specifically, XDP (eXpress Data Path) and TC (Traffic Control) technologies are used to discard all access requests received on other ports. The target IP device and the target service on the corresponding service port accessed by such requests appear as filtered or closed on the network, making the scanner unable to identify the service's existence. This achieves the goal of making the backend service invisible. Simultaneously, attack traffic packets targeting services and hosts do not enter the kernel, thus preventing attacks such as DDoS attacks (Distributed Denial of Service).

[0069] Identity pre-verification is typically set up as a multi-dimensional verification process. The security center only determines that the identity pre-verification has passed if all verifications pass. This multi-dimensional verification includes, but is not limited to, the following authentication dimensions: identity authentication, used to verify user credentials such as account, password, certificate, and MFA (Multi-factor authentication); environment assessment: checking the terminal device status, such as whether the device is jailbroken, patch version check, and antivirus status check; intent verification: verifying whether the business resources the user claims to access are correct (target IP, port, protocol). The above authentication process is a standard technique and will not be elaborated upon here.

[0070] S700: After identity pre-verification is passed, the corresponding attack inspection policy is invoked based on the identity information of the target IP device to perform attack inspection on the access request, and the target service in the target IP device is opened after the attack inspection is passed.

[0071] After triggering the security component to forward the access request to the permission pre-verification port for identity pre-verification, this application further proposes: in response to identity pre-verification failure, a general error code is returned to the terminal device that initiated the access request, achieving zero leakage of backend service information and completely avoiding vulnerability scanning. In response to successful identity pre-verification, a dynamic access token is issued to the initiating terminal device; that is, a short-term, one-time-use dynamic access token (DAT) bound to session characteristics is issued. This token does not contain business data, but only "authorization credentials to allow access to a specific port". After the security center further verifies that the dynamic access token possessed by the terminal device is within its validity period, it calls the corresponding attack checking policy to perform attack checks based on the identity information corresponding to the target IP device. It is understandable that after obtaining the token, the terminal device will request the IP device to provide services again, that is, access the corresponding service again, so it is necessary to verify the token's validity period. After verifying the validity of the dynamic access token, the security center establishes a temporary encrypted tunnel from the external device to the target IP device and sends the attack checking policy to the security component on the target IP device, triggering the security component to check whether the above access request contains an attack according to the attack checking policy.

[0072] Understandably, before invoking the corresponding attack inspection policy based on the identity information of the target IP device to perform attack inspection on the access request, this application also proposes to pre-construct a mapping table containing attack inspection policies and identity information, specifically including: For any given service, the system retrieves its corresponding service vulnerability information and integrates it with the service vulnerability information of other services that share the same identity information to generate a summary vulnerability information list. Based on the known vulnerabilities included in the summary vulnerability information list, it searches for corresponding virtual patches to generate an attack detection policy. Finally, it associates services with attack detection policies to generate a mapping table. That is, the mapping table contains multiple services and their corresponding attack detection policies, with each service maintaining its own attack detection policy.

[0073] Based on this, this application also proposes that when a service of an IP device adds / removes a virtual patch that matches a known vulnerability, the virtual patch should also be added or removed uniformly on other services with the same identity as that service, so as to achieve global adaptive updates of the attack detection strategy.

[0074] Based on the target service recorded in the access request, the security center queries the aforementioned mapping table to obtain the corresponding attack detection policy. This policy is then distributed to the security component. The security component checks whether the access request to the target IP device contains attacks against known vulnerabilities listed in the attack detection policy. If no attacks are found, the attack check passes, and the target service on the target IP device is opened. If attacks are found, the attack check fails, and the security component rejects the access request for access to the target service. This method, at the service level, implements targeted vulnerability attack checks on access requests, restricting abnormal traffic access, rather than performing a full check for all known vulnerability attacks. This effectively speeds up the check process without affecting basic business operations, thus ensuring the session quality of critical services. Furthermore, after deployment, the security component automatically responds to the attack detection policies issued by the security center to update the policies, achieving automatic virtual patching and hardening without requiring customized modifications to devices or services.

[0075] To avoid resource waste and improve identity pre-verification security, this application proposes that after the business operation corresponding to the external device is completed, i.e., after stopping the generation of access requests, the pre-verification deregistration interface should be called, and the security center should destroy the token issued to the external device and close the temporary tunnel. Furthermore, this application sets a strict session timeout period; if access requests from a specific external device are continuously received for more than the session timeout period, identity pre-verification of that external device will be forcibly re-performed. In addition, this application immediately triggers the deregistration mechanism upon detecting abnormal intra-session traffic initiated by an external device, such as high-frequency access, cutting off the connection with the external device and issuing a direct alarm.

[0076] This application provides a zero-trust hardening method based on virtual patching. Based on a generated target device graph containing multiple identities, a security component is deployed on the devices indicated by the nodes in the target device graph. Traffic from external devices without access permissions is forwarded to a permission pre-verification port, and all requests to ports other than the permission pre-verification port are discarded, achieving zero trust in external devices. Simultaneously, after extending the identities of services on various service ports under IP devices in the current network, an attack inspection policy is configured for each service. The security component uses this attack inspection policy to intercept malicious access, achieving "virtual patching" at the service level without requiring code-level updates or modifications to address vulnerabilities in services on specific ports.

[0077] Example 2 Based on the above method embodiments, this application also provides a zero-trust hardening device for virtual patches, such as... Figure 3 As shown, the zero-trust hardening device 300 includes: Preparation module 310 is used to respond to preset conditions and, taking the services provided by multiple IP devices in the current network as the first node, obtain and construct an initial device graph based on the node attribute characteristics of each first node, the communication relationship edges between each node, and the affiliation relationship edges, wherein the node attribute characteristics include at least vulnerability characteristics, service detail characteristics, and service sequence characteristics. The preparation module 310 described above is also used to input the initial device graph into a pre-trained graph embedding representation model to obtain node fusion features that match each first node, and to cluster the first nodes according to the node fusion features to generate multiple clusters; The preparation module 310 described above is also used to obtain the known identity information of the first node contained in each cluster to generate a corresponding full identity table, and to configure the identity information of the service indicated by the first node in the cluster using the full identity table. The aforementioned preparation module 310 is also used to take IP devices as the second node, shrink the second node according to the affiliation edge, and then filter and delete abnormal nodes according to the communication relationship edge between the second nodes to generate the target device graph. The initialization module 320 is used to deploy a security component on the IP device indicated by the second node contained in the target device graph, and to trigger the security component to initialize the access permissions of the IP device according to the communication relationship contained in the target device graph. The access permissions include open permissions and restricted permissions. The verification module 330 is used to respond to an access request from a target IP device with restricted access permissions, and trigger the security component to forward the access request to the permission pre-verification port for identity pre-verification. The aforementioned verification module 330 is also used to, after the identity pre-verification is passed, invoke the corresponding attack inspection policy according to the identity information corresponding to the target IP device to perform attack inspection on the access request, and open the target service in the target IP device after the attack inspection is passed.

[0078] Optionally, the preparation module is further configured to: scan IP devices and services in the current network by active scanning to obtain raw active data containing service vulnerability information and device information; collect traffic data generated by each service in the current network by bypass mirror traffic monitoring, and extract service detail features and service sequence features based on the traffic data; and generate node attribute features matching each service based on the service detail features, service sequence features, and service vulnerability information contained in the raw active data.

[0079] Optionally, before invoking the corresponding attack checking policy based on the identity information of the target IP device to perform attack checks on the access request, the preparation module 310 is also used to pre-build a mapping table containing attack checking policies and identity information: for any service, obtain the service vulnerability information corresponding to the service, integrate the service vulnerability information of other services with the same identity information as the service to generate summary vulnerability information; find the corresponding virtual patch based on the known vulnerabilities contained in the summary vulnerability information to generate an attack checking policy; associate the service with the attack checking policy to generate a mapping table.

[0080] Optionally, while generating the target device diagram, the preparation module 310 also uses the IP device as the primary key to construct IP asset attribute tags based on the device information. The device information includes at least the device manufacturer, device type, and device model. The preparation module 310 is also used to: in response to detecting a new IP device coming online, set the access permission of the new IP device to restricted permissions and search whether there is target device information matching the new IP device in the IP asset attribute tags; if there is matching device information, obtain the target identity information of the IP device corresponding to the target device information to configure the identity information of the new IP device.

[0081] Optionally, the preparation module 310 is further configured to: calculate the reach distance between each first node based on the node fusion features, construct a minimum spanning tree containing each first node using the reach distance as an edge; remove the edges of the minimum spanning tree in descending order of the reach distance to split and obtain a hierarchical structure tree; traverse the hierarchical structure tree to obtain candidate cut points, calculate the stability score of all clusters under each cut point; determine the candidate cut point with the largest stability score as the target cut point, and cut the hierarchical structure tree according to the target cut point to obtain the optimal clustering result, wherein the optimal clustering result includes at least one cluster, and each cluster contains at least one first node.

[0082] Optionally, the preparation module 310 is further configured to: record the out-degree and in-degree counts of the second node with a communication relationship edge, and determine the second node whose out-degree count to in-degree count ratio is greater than a first preset threshold as an abnormal node; and / or, record the number of connected nodes of the second node with a communication relationship edge, and determine the second node whose connected node count to the total number of second nodes contained in the target device graph is greater than a second preset threshold as an abnormal node; and / or, record the connection duration of the second node with a communication relationship edge, and determine the second node whose average connection duration is less than a third preset threshold as an abnormal node; and / or, record the identity information of the second node with a communication relationship edge, and determine the second node without identity information as an abnormal node.

[0083] Optionally, the preparation module 310 is further configured to train the graph embedding representation model: obtain an initial training graph for training, the initial training graph including nodes and edges; randomly delete edges in the initial training graph at a first preset ratio to generate a first augmented graph; randomly set the node attribute features contained in nodes in the initial training graph at a second preset ratio to zero to generate a second augmented graph; extract the embedding representation features corresponding to nodes in the first augmented graph and the embedding representation features corresponding to nodes in the second augmented graph; construct positive sample pairs based on the embedding representation features of the same nodes in the first and second augmented graphs; construct negative sample pairs based on the embedding representation features of different nodes in the first and second augmented graphs; and iterate the graph embedding representation model based on the positive and negative sample pairs until the model converges.

[0084] Optionally, the verification module 330 is further configured to: return a general error code to the terminal device that initiated the access request in response to the failure of identity pre-verification; issue a dynamic access token to the initiating terminal device in response to the success of identity pre-verification; and, after verifying that the dynamic access token possessed by the terminal device is within its validity period, invoke the corresponding attack checking strategy to perform attack checking based on the identity information corresponding to the destination IP device.

[0085] Example 3 This application also provides an electronic device, such as... Figure 4 As shown, it includes: Memory 401 is used to store computer programs; When the processor 402 executes the program stored in the memory 401, it implements the zero-trust hardening method based on virtual patching disclosed in the above embodiments.

[0086] Furthermore, the aforementioned electronic device may also include a communication bus and / or a communication interface, with the processor 402, communication interface, and memory 401 communicating with each other via the communication bus.

[0087] The communication bus mentioned in the above electronic devices can be a Peripheral Component Interconnect (PCI) bus or an Extended Industry Standard Architecture (EISA) bus, etc. This communication bus can be divided into address bus, data bus, control bus, etc. For ease of illustration, only one thick line is used to represent it in the diagram, but this does not mean that there is only one bus or one type of bus.

[0088] The communication interface is used for communication between the aforementioned electronic devices and other devices.

[0089] The memory may include random access memory (RAM) or non-volatile memory (NVM), such as at least one disk storage device. Optionally, the memory may also be at least one storage device located remotely from the aforementioned processor.

[0090] The processors mentioned above can be general-purpose processors, including central processing units (CPUs), network processors (NPs), etc.; they can also be digital signal processors (DSPs), application-specific integrated circuits (ASICs), field-programmable gate arrays (FPGAs), or other programmable logic devices, discrete gate or transistor logic devices, or discrete hardware components.

[0091] In another embodiment provided in this application, a computer-readable storage medium is also provided, which stores a computer program that, when executed by a processor, implements the steps of the disclosed zero-trust hardening method based on virtual patching.

[0092] In another embodiment provided in this application, a computer program product containing instructions is also provided, which, when run on a computer, causes the computer to execute the zero-trust hardening method based on virtual patching described in the above embodiments.

[0093] In the above embodiments, implementation can be achieved, in whole or in part, through software, hardware, firmware, or any combination thereof. When implemented in software, it can be implemented, in whole or in part, as a computer program product. A computer program product includes one or more computer instructions. When the computer program instructions are loaded and executed on a computer, all or part of the flow or function according to the embodiments of this application is generated. The computer can be a general-purpose computer, a special-purpose computer, a computer network, or other programmable device. The computer instructions can be stored in a computer-readable storage medium or transmitted from one computer-readable storage medium to another. For example, computer instructions can be transmitted from one website, computer, server, or data center to another website, computer, server, or data center via wired (e.g., coaxial cable, fiber optic, digital subscriber line (DSL)) or wireless (e.g., infrared, wireless, microwave, etc.) means. The computer-readable storage medium can be any available medium that a computer can access or a data storage device such as a server or data center that integrates one or more available media. The available medium can be a magnetic medium (e.g., floppy disk, hard disk, magnetic tape), an optical medium (e.g., DVD), or a solid-state disk (SSD), etc.

[0094] It should be noted that, in this document, relational terms such as "first" and "second" are used merely to distinguish one entity or operation from another, and do not necessarily require or imply any such actual relationship or order between these entities or operations. Furthermore, the terms "comprising," "including," or any other variations thereof are intended to cover non-exclusive inclusion, such that a process, method, article, or apparatus that comprises a list of elements includes not only those elements but also other elements not expressly listed, or elements inherent to such a process, method, article, or apparatus. Without further limitations, an element defined by the phrase "comprising one..." does not exclude the presence of other identical elements in the process, method, article, or apparatus that includes the element.

[0095] The various embodiments in this specification are described in a related manner. Similar or identical parts between embodiments can be referred to mutually. Each embodiment focuses on describing the differences from other embodiments. In particular, the apparatus embodiments are basically similar to the method embodiments, so the description is relatively simple; relevant parts can be referred to the descriptions of the method embodiments.

[0096] The above are merely preferred embodiments of this application and are not intended to limit the scope of protection of this application. Any modifications, equivalent substitutions, improvements, etc., made within the spirit and principles of this application are included within the scope of protection of this application.

Claims

1. A zero-trust hardening method based on virtual patching, characterized in that, The method includes: In response to the triggering of preset conditions, taking the services provided by multiple IP devices in the current network as the first node, an initial device graph is constructed based on the node attribute features of each first node, the communication relationship edges between each node, and the affiliation relationship edges. The node attribute features include at least vulnerability features, service detail features, and service sequence features. The initial device graph is input into a pre-trained graph embedding representation model to obtain node fusion features that match each of the first nodes, and the first nodes are clustered according to the node fusion features to generate multiple clusters; For each cluster, the known identity information of the first node included is obtained to generate a corresponding full identity table, and the identity information of the service indicated by the first node in the cluster is configured with the full identity table. Using IP devices as the second node, after shrinking the second node according to the affiliation edge, abnormal nodes are filtered and deleted according to the communication relationship edge between the second nodes to generate the target device graph; Deploy a security component on the IP device indicated by the second node in the target device graph, and trigger the security component to initialize the access permissions of the IP device according to the communication relationship edges contained in the target device graph, the access permissions including open permissions and restricted permissions; In response to receiving an access request from a target IP device with restricted access permissions, the security component is triggered to forward the access request to the permission pre-verification port for identity pre-verification; After the identity pre-verification is passed, the corresponding attack inspection policy is invoked according to the identity information of the target IP device to perform attack inspection on the access request, and the target service in the target IP device is opened after the attack inspection is passed.

2. The method according to claim 1, characterized in that, Obtain the node attribute features of each of the first nodes, including: Actively scan IP devices and services in the current network to obtain raw, proactive data containing service vulnerability information and device information. Traffic data generated by each service in the current network is collected by bypass mirroring traffic monitoring, and the service detail features and service sequence features are extracted based on the traffic data; Based on the service detail features, the service sequence features, and the service vulnerability information contained in the original active data, node attribute features matching each of the services are generated.

3. The method according to claim 2, characterized in that, Before invoking the corresponding attack inspection policy based on the identity information of the target IP device to perform attack inspection on the access request, the method includes pre-constructing a mapping table containing attack inspection policies and identity information: For any one of the services, obtain the service vulnerability information corresponding to the service, and integrate the service vulnerability information of other services with the same identity information as the service to generate summary vulnerability information; Based on the known vulnerabilities included in the summarized vulnerability information, corresponding virtual patches are found to generate an attack inspection strategy; Associate the service with the attack detection policy to generate a mapping table.

4. The method according to claim 2, characterized in that, While generating the target device diagram, using the IP device as the primary key, an IP asset attribute tag is constructed based on the device information. The device information includes at least the device manufacturer, device type, and device model. The method further includes: In response to the detection of a new IP device coming online, the access permission of the new IP device is set to restricted permission, and the IP asset attribute tag is searched to see if there is target device information that matches the new IP device. If matching device information exists, the target identity information of the IP device corresponding to the target device information is obtained to configure the identity information of the new IP device.

5. The method according to claim 1, characterized in that, The step of clustering the first node based on the node fusion features to generate multiple clusters includes: The reach distance between each of the first nodes is calculated based on the node fusion features, and the reach distance is used as an edge to construct a minimum spanning tree containing each of the first nodes; The edges of the minimum spanning tree are removed in descending order of the mutual reach distance to split and obtain a hierarchical structure tree; Traverse the hierarchical structure tree to obtain candidate cut points, and calculate the stability score of all clusters under each cut point; The candidate cut point with the highest stability score is determined as the target cut point, and the hierarchical structure tree is cut according to the target cut point to obtain the optimal clustering result, wherein the optimal clustering result includes at least one cluster, and each cluster contains at least one of the first nodes.

6. The method according to claim 1, characterized in that, The step of filtering abnormal nodes based on the communication relationship edges between the second nodes includes: Record the out-degree and in-degree counts of the second node with the communication relationship edge, and determine the second node whose out-degree count to in-degree count ratio is greater than a first preset threshold as an abnormal node; and / or, Record the number of connected nodes of the second node with the communication relationship edge, and determine the second node whose ratio of the number of connected nodes to the total number of second nodes included in the target device graph is greater than a second preset threshold as an abnormal node; and / or, Record the connection duration of the second node with a communication relationship edge, and determine the second node whose average connection duration is less than a third preset threshold as an abnormal node; and / or, Record the identity information of the second node that has a communication relationship, and determine the second node without identity information as an abnormal node.

7. The method according to claim 1, characterized in that, The method also includes a training method for the graph embedding representation model: Obtain an initial training graph for training, the initial training graph including nodes and edges; Randomly delete edges of a first preset proportion from the initial training graph to generate a first augmented graph; Randomly set the node attribute features of nodes in the second preset proportion of the initial training graph to zero to generate a second enhanced graph; Extract the embedding representation features corresponding to the nodes in the first augmented graph and the embedding representation features corresponding to the nodes in the second augmented graph; Positive sample pairs are constructed based on the embedding representation features of the same nodes in the first and second augmented graphs. Negative sample pairs are constructed based on the embedding representation features of different nodes in the first and second augmented maps. The graph embedding representation model is iterated based on the positive and negative sample pairs until the model converges.

8. The method according to claim 1, characterized in that, After triggering the security component to forward the access request to the permission pre-verification port for identity pre-verification, the method further includes: In response to the failure of the identity pre-verification, a general error code is returned to the terminal device that initiated the access request; In response to the successful identity pre-verification, a dynamic access token is issued to the initiating terminal device; After verifying that the dynamic access token possessed by the terminal device is within its validity period, the corresponding attack detection policy is invoked to perform attack detection based on the identity information corresponding to the destination IP device.

9. A zero-trust hardening device based on virtual patching, characterized in that, The device includes: The preparation module is used to respond to the triggering of preset conditions, taking the services provided by multiple IP devices in the current network as the first node, and to obtain and construct an initial device graph based on the node attribute features of each first node, the communication relationship edges between each node, and the affiliation relationship edges, wherein the node attribute features include at least vulnerability features, service detail features, and service sequence features. The preparation module is further configured to input the initial device graph into a pre-trained graph embedding representation model to obtain node fusion features that match each of the first nodes, and to cluster the first nodes according to the node fusion features to generate multiple clusters; The preparation module is further configured to, for each cluster, obtain the known identity information of the first node contained therein to generate a corresponding full identity table, and configure the identity information of the service indicated by the first node in the cluster using the full identity table; The preparation module is further configured to use IP devices as second nodes, shrink the second nodes according to the affiliation edge, and then filter and delete abnormal nodes according to the communication relationship edge between the second nodes to generate a target device graph. An initialization module is configured to deploy a security component on the IP device indicated by the second node in the target device graph, and trigger the security component to initialize the access permissions of the IP device according to the communication relationship edge contained in the target device graph, wherein the access permissions include open permissions and restricted permissions; The verification module is used to respond to an access request from a target IP device with restricted access permissions, and trigger the security component to forward the access request to the permission pre-verification port for identity pre-verification. The verification module is further configured to, after the identity pre-verification passes, invoke the corresponding attack inspection strategy according to the identity information corresponding to the target IP device to perform attack inspection on the access request, and open the target service in the target IP device after the attack inspection passes.

10. An electronic device, characterized in that, include: Memory, used to store computer programs; A processor, when executing a program stored in memory, implements the method described in any one of claims 1-8.

Images