A method for comparing and correcting the mirror results of attack exercise replay baselines

Abstract

This invention discloses a method for comparing and correcting deviations in the mirror results of attack exercise replay baselines, relating to the field of network security technology. The method includes obtaining the current traffic distribution and interface configuration from the network environment using a pre-established network topology model, processing the distribution and configuration using a deep reinforcement learning algorithm to obtain an isolation configuration scheme; deploying virtual network partitions during the replay process according to the isolation configuration scheme, monitoring traffic within the partitions in real time, and activating a backup isolation layer if external interference exceeds a preset threshold, determining the enhanced isolation boundary, and simultaneously running a mirror baseline environment within the isolation boundary to generate mirror baseline results for subsequent comparison. This method for comparing and correcting deviations in the mirror results of attack exercise replay baselines significantly improves the adaptability of network security isolation and the accuracy of attack defense, enhancing system stability and the optimization capabilities of security strategies.

Description

Technical Field

[0001] This invention relates to the field of network security technology, and specifically to a method for comparing and correcting deviations in the mirror results of attack exercise replay baselines. Background Technology

[0002] With the continuous evolution of cyberattack methods and the increasing complexity of information system architectures, cybersecurity drill replays have gradually become a crucial link in ensuring the secure operation of information systems in critical industries. In high-risk sectors such as finance, energy, and government, network drill replays are not only used to reproduce attack processes and verify defense strategies, but also play a key role in adjusting system security architecture and optimizing strategies. Especially in complex network structures and high-intensity attack scenarios, the accuracy of drill replays directly affects the effectiveness and scientific implementation of security strategies. However, existing network drill replay systems still face significant shortcomings in dealing with complex network environments and dynamic threats. First, with the expansion of system scale and the heterogeneity of network structures, network traffic distribution exhibits highly dynamic and non-uniform characteristics. Traditional network isolation mechanisms based on static policies struggle to adapt to interface changes and traffic fluctuations in real time, allowing some external interference traffic to bypass isolation policies and enter the drill environment, thereby interfering with data recording and affecting the replay effect. Second, in actual drills, high-frequency attack traffic often achieves privilege escalation or data manipulation by impersonating legitimate identities or exploiting weaknesses in the permission system, causing a loss of control over system permission management and resulting in "permission abuse." Because most existing systems rely on static access control rules and lack attack behavior identification and dynamic response mechanisms, high-frequency attackers can continuously launch unauthorized access in the exercise environment, affecting the authenticity and representativeness of the exercise results. Furthermore, regarding data integrity assurance, most common replay systems currently rely on log comparison and static verification methods. However, when faced with large-scale concurrent data writes, high-frequency updates, and potential attacks that tamper with data content, it is difficult to quickly and accurately identify contaminated data, easily generating false vulnerability analysis results and interfering with the judgment of subsequent policy optimization paths. In addition, existing systems still rely on manual analysis or rule matching for the analysis and processing of replay results, lacking in-depth modeling and trend prediction of abnormal behavior. This results in policy output delays or insufficient generalization capabilities, making it difficult to meet the needs of rapidly iterating cybersecurity exercises. Summary of the Invention

[0003] The purpose of this invention is to provide a method for comparing and correcting the deviation of the mirror result of the attack exercise replay baseline, thereby solving the problems existing in the prior art.

[0004] To achieve the above objectives, the present invention provides the following technical solution: a method for comparing and correcting deviations of mirror results of attack exercise replay baselines, comprising: S1. Obtain the current traffic distribution and interface configuration from the network environment through a pre-established network topology model, and use a deep reinforcement learning algorithm to process the distribution and configuration to obtain an isolation configuration scheme; S2. According to the isolation configuration scheme, a virtual network partition is deployed during the replay of the exercise. The traffic within the partition is monitored in real time. If external interference is detected to exceed the preset threshold, the backup isolation layer is activated, the enhanced isolation boundary is determined, and the mirror baseline environment is run simultaneously within the isolation boundary to generate mirror baseline results for subsequent comparison reference. S3. Obtain internal access logs from the enhanced isolation boundary, use the support vector machine algorithm to classify the attack simulation behavior in the logs through the hyperplane separation mechanism and kernel function transformation process, obtain the classification result set, and compare the classification result with the mirror baseline result to identify the deviation information; S4. For the classification result set, obtain the corrected comprehensive analysis index, extract the optimization suggestion path from the comprehensive analysis index, update the security policy framework for the path, determine if the path matches the environmental purity requirements, integrate it into the exercise replay process, and combine the event correlation analysis framework and aggregation function application logic to obtain the optimized policy version after comparison and correction.

[0005] As can be seen from the above technical solution, the present invention has the following beneficial effects: This invention generates an isolation configuration scheme using deep reinforcement learning algorithms and deploys virtual network partitions and backup isolation layers during drills, achieving stable isolation of the drill environment in complex network conditions. Based on this, by running mirrored baseline scenarios in parallel within the isolated environment, mirrored baseline results are generated. The actual results of the drill replay are compared with the mirrored baseline results. When a deviation is detected, a deviation correction module is triggered to correct it, thereby ensuring the credibility of the replay results. This invention utilizes support vector machines to classify access logs and combines a dynamic rule generation module to dynamically adjust access control parameters, reducing the access level of high-frequency attack roles and ensuring minimal privileges. Simultaneously, feature vector mapping and training data fitting techniques are used to verify data integrity, generating a clean data subset. This data is then fused using log aggregation and timestamp synchronization algorithms to form a vulnerability analysis report and optimization suggestions, ultimately updating the security policy framework and integrating it into the drill replay process. Therefore, this invention significantly improves the adaptability of network security isolation and the accuracy of attack defense. In particular, through mirrored result comparison and deviation correction mechanisms, it effectively ensures the integrity and credibility of drill replay data in complex network environments, thereby enhancing system stability and the optimization capabilities of security policies. Attached Figure Description

[0006] Figure 1 This is a flowchart of the method for comparing and correcting the mirror results of the attack exercise replay baseline of the present invention. Detailed Implementation

[0007] The technical solutions of the embodiments of the present invention will be clearly and completely described below with reference to the accompanying drawings. Obviously, the described embodiments are only some embodiments of the present invention, and not all embodiments. Based on the embodiments of the present invention, all other embodiments obtained by those skilled in the art without creative effort are within the scope of protection of the present invention.

[0008] like Figure 1 As shown, the present invention provides a technical solution: a method for comparing and correcting deviations of mirror results of attack exercise replay baselines, comprising: S1. Obtain the current traffic distribution and interface configuration from the network environment through a pre-established network topology model, and use a deep reinforcement learning algorithm to process the distribution and configuration to obtain an isolation configuration scheme; S2. According to the isolation configuration scheme, a virtual network partition is deployed during the replay of the exercise. The traffic within the partition is monitored in real time. If external interference is detected to exceed the preset threshold, the backup isolation layer is activated, the enhanced isolation boundary is determined, and the mirror baseline environment is run simultaneously within the isolation boundary to generate mirror baseline results for subsequent comparison reference. S3. Obtain internal access logs from the enhanced isolation boundary, use the support vector machine algorithm to classify the attack simulation behavior in the logs through the hyperplane separation mechanism and kernel function transformation process, obtain the classification result set, and compare the classification result with the mirror baseline result to identify the deviation information; S4. For the classification result set, obtain the corrected comprehensive analysis index, extract the optimization suggestion path from the comprehensive analysis index, update the security policy framework for the path, determine if the path matches the environmental purity requirements, integrate it into the exercise replay process, and combine the event correlation analysis framework and aggregation function application logic to obtain the optimized policy version after comparison and correction. In S4, for the classification result set, the corrected comprehensive analysis indicators are obtained, including: for the classification result set, the permission control parameters are adjusted through the dynamic rule generation module. If the classification result set indicates a high-frequency attack, the access level of the corresponding role is reduced, and the support vector selection criteria and soft interval optimization calculation are incorporated to obtain the updated permission rules. Among them, when the access frequency or attack characteristics of the access behavior exceed the preset threshold, the access behavior is identified as a high-frequency attack, and the permission rules are dynamically corrected by comparing the deviation results. In S4, for the classification result set, the corrected comprehensive analysis index also includes: extracting the authorized operation sequence from the updated permission rules, obtaining the baseline data access records, determining if a concurrent access anomaly occurs in the records, triggering data integrity verification, and applying feature vector mapping technology and training data fitting steps to determine the data subset that passes the verification. In S4, the corrected comprehensive analysis indicators for the classification result set also include: generating a vulnerability analysis report based on the data subset, using log aggregation technology to fuse the subset and isolation boundary data through data stream merging protocol and timestamp synchronization algorithm, and comparing the results with the mirror baseline results to obtain the corrected comprehensive analysis indicators; In S4, for the classification result set, the corrected comprehensive analysis indicators also include: extracting optimization suggestion paths from the comprehensive analysis indicators, updating the security policy framework for the paths, determining if the paths match the environmental purity requirements, integrating them into the exercise replay process, and combining the event correlation analysis framework and aggregation function application logic to obtain the optimized policy version after comparison and correction.

[0009] This implementation first constructs a network topology model and dynamically collects network traffic distribution and interface configuration information. Using this as input, a deep reinforcement learning algorithm automatically generates an isolation configuration scheme, which is then used to construct virtualized network partitions during replay exercises. Network traffic within each partition is monitored in real time. When external interference exceeds a threshold, a backup isolation layer is activated to construct an enhanced isolation boundary, and a mirrored baseline environment is simultaneously run within this boundary to ensure clean reference data. Subsequently, access logs from the enhanced isolation area are extracted, and a support vector machine classification algorithm is applied. By constructing a hyperplane and kernel function transformation mechanism, the simulated attack behaviors in the logs are automatically classified and analyzed. The classification result is compared with the mirrored baseline result to identify deviations. For detected high-frequency attack behaviors, the attacker's access permissions are reduced through a dynamic rule generation mechanism, and the access control rules are optimized using support vector selection criteria and soft-interval optimization strategies. Furthermore, the operation sequences generated by the updated access rules are extracted, mapped to access records, and an integrity verification process is triggered through a concurrent access anomaly identification mechanism to ensure that the data has not been tampered with. After extracting a secure subset of data through feature vector mapping and model fitting, a vulnerability analysis report is generated. This subset is then further integrated with the isolation boundary data through log aggregation, data stream merging, and timestamp synchronization. The results are then compared with the mirror baseline to obtain the final corrected comprehensive analysis indicators. Finally, an optimized path is generated based on the analysis indicators, the security policy is updated, and when the path meets the requirements of a clean environment, it is integrated into the exercise replay process to form the corrected optimized policy version.

[0010] This implementation method automatically optimizes isolation configuration by introducing a deep reinforcement learning mechanism, effectively improving the accuracy of virtual network partitioning and emergency isolation capabilities. The combination of real-time monitoring and a backup isolation layer enhances anti-interference capabilities, while the efficient classification capability of support vector machines ensures the accuracy of attack behavior identification. A dynamic permission rule update mechanism dynamically adjusts access permissions based on attack frequency, improving the intelligence of permission management. The combination of integrity verification and feature vector mapping ensures the security and reliability of data processing. Finally, through consistency comparison and optimized strategy path import, the exercise maintains high security standards while possessing adaptive update capabilities, significantly improving the accuracy, security, and intelligence level of attack exercise replay.

[0011] S1 includes: acquiring traffic distribution data and interface configuration information in the network environment through a preset network topology model to determine the current network operating state; extracting the load characteristics and interface connection status of network nodes from the traffic distribution data and interface configuration information to obtain an initial mode of network traffic allocation; using a deep reinforcement learning algorithm to iteratively optimize the initial mode and generate a dynamic traffic allocation strategy; if the node load in the dynamic traffic allocation strategy exceeds a preset threshold, adjusting the interface configuration information to obtain an optimized interface state; generating a network isolation mechanism based on the optimized interface state and determining an isolation configuration scheme; updating the traffic allocation strategy in the network topology model through the isolation configuration scheme to obtain a stable network operating configuration; and using the network operating configuration to verify the stability of traffic distribution in the network environment and determine the final isolation configuration scheme.

[0012] In this implementation, step S1 first extracts network structure information from a preset network topology model. This model is manually defined by the network administrator based on the actual deployment, including the unique number of each network node, the physical link connections between nodes, the number of physical interfaces configured on each node, and their attributes. This model serves as a static structure to support subsequent data collection and configuration generation. Based on this, traffic monitoring probes deployed on each network node collect actual network traffic data, including the number of inbound and outbound data packets per unit time for each node, the total amount of data transmitted, and the real-time bandwidth utilization of each interface. Interface configuration information is obtained by reading the interface management table of each node, including whether the interface is currently enabled, the number of the target interface, the allowed data transmission types, and the maximum bandwidth limit. The collection period is once every 60 seconds to ensure the real-time updating of network status.

[0013] The aforementioned traffic data and interface information are then integrated and processed to determine the current network operating status. The network operating status is determined based on the load ratio of each node, which is the ratio between each node's current total data throughput and the sum of the theoretical maximum bandwidth of all its enabled interfaces. The result indicates the load pressure currently borne by that node. For example, if a node enables two interfaces, each with a bandwidth limit of 1000 Mbps, for a total bandwidth of 2000 Mbps, and actually processes 1800 Mbps of data per minute, its load ratio is 90%. This load ratio is recorded as part of the node's load characteristics and used for subsequent analysis.

[0014] The initial pattern is generated by summarizing the load ratios of all nodes and their connection relationships to form a network traffic distribution graph. This graph represents the average transmission traffic path and traffic volume between each pair of nodes. Using this graph as input, a deep reinforcement learning algorithm is employed to optimize traffic scheduling. The deep reinforcement learning model used is a state-action mapping model built based on a policy optimization method. Its state space is the current network traffic distribution graph, and its action space represents adjustments to node connection relationships or interface enable states within the allowed configuration change range. In each training round, the model selects an action based on the current state. After executing the action, it re-evaluates the load ratio of each node, using the maximum load of each node as the negative feedback value for the current state. The smaller this value, the more balanced the load. The training objective is to minimize the maximum load ratio among all nodes. Training terminates after 300 iterations or when the maximum load ratio shows no significant decrease for 10 consecutive iterations. The optimal action sequence is then output, forming a dynamic traffic distribution strategy.

[0015] For the initial traffic allocation pattern composed of network node load characteristics and interface connection status, a deep reinforcement learning algorithm is applied to perform optimal network traffic scheduling. In the specific implementation, the environment state space for reinforcement learning is first constructed. The state space is defined as follows: each state corresponds to a traffic distribution map of the network topology, including the load ratio of each node, the current traffic volume of each link, and the enabled status and remaining bandwidth of each interface. All state information is expressed in the form of a structured data table and is updated in real time from monitoring at the beginning of each training round. Using the initial state as input, an action space is defined, which is the set of adjustable operations, including: enabling or disabling an interface, adjusting the bandwidth parameters of an interface, and modifying the connection path between nodes. The constraint condition for all actions is that they must not violate the physical capacity limit of the current interface and the allowed connection rules between nodes. During policy execution, each selected action constitutes the operation instruction set for the current round. After each action is executed, the load ratio of each node is recalculated based on the new network state, and the load level of the node with the highest load is calculated; this maximum value is used as negative feedback input. The reward function is set as follows: the smaller the maximum value of the load ratio among all nodes in the network, the higher the reward value. If an action causes the load ratio of any node in the network to exceed its load threshold, the reward value for that round is deducted, and an abnormal state is recorded in the log. The policy network uses a multi-layer neural network structure for state-action mapping modeling, and the initial parameters are initialized using mini-batch training samples. The training process adopts a fixed step learning rate strategy, with a default learning rate of 0.001 per round. No experience replay mechanism is used during training; the current state is used directly for feedback in each round. After each round of policy execution, i.e., executing an action, observing the state, calculating the reward, and updating the model, one round of training is completed, with a default training limit of 300 rounds. After training, the load balancing results obtained from each round of action execution are sorted, and the action sequence with the highest reward value is selected as the final output dynamic traffic allocation strategy. This strategy clearly indicates which interfaces should be enabled or disabled, the bandwidth values ​​that each interface should be adjusted to, and the recommended transmission paths between nodes. This strategy serves as the basis for generating isolation configuration schemes and verifying network stability in subsequent steps.

[0016] Next, the load level of each node in this strategy is evaluated to determine its reasonableness. The criterion is whether the node load exceeds the load threshold. The load threshold is set as follows: First, statistical analysis is performed on the target network's normal operation data under non-attack conditions. Historical traffic data for 30 consecutive days is collected, recording the daily maximum load ratio for each node. The average of these values ​​is then multiplied by a safety factor of 80% to obtain the overload warning threshold for that node. For example, if a node's historical average maximum load ratio is 95%, its threshold is set to 76%. If the load ratio of a node under the current strategy exceeds this threshold, the current traffic allocation scheme is considered risky. The corresponding interface configuration for that node is automatically adjusted. Specific adjustments include disabling some secondary data transmission interfaces, switching some connections to idle interfaces, or increasing or decreasing the maximum bandwidth configuration of the interface. These operations are written into the control command set of each node in the form of a configuration file and implemented through a remote management protocol.

[0017] The optimized interface status is used to build a network isolation mechanism. The connection range of each node is determined based on the interface's availability. Then, considering the intensity of traffic interaction between nodes, logical subnets are created by identifying which nodes' average traffic exceeds a set isolation threshold. The isolation threshold is set based on the 90th percentile of data transmission volume between nodes in historical network data. For example, if the average data transmission volume between nodes in historical data is 1000 megabits per minute, the isolation threshold is set to 900 megabits per minute. Connections exceeding this value are considered strongly dependent connections, and their nodes are placed in the same subnet. Logical isolation between subnets is achieved through access control policies configured at boundary nodes.

[0018] After the isolation configuration scheme is generated, it is applied to the network topology model. The connectivity between each pair of nodes is reconstructed, and the interface configuration files are updated to ensure that the actual network structure is consistent with the isolation logic. The updated network operation configuration needs to be verified for stability. For the first 10 minutes after the new configuration is applied, the load ratio of each node is monitored every 60 seconds, and the fluctuation range is calculated. This fluctuation range is calculated as the maximum value of the load ratio for each node within that period minus the minimum value. If the fluctuation range of all nodes is lower than the pre-set stability threshold, the configuration is considered effective. The stability threshold is set to 50% of the maximum fluctuation range of the load ratio under normal conditions in the past. For example, if the maximum fluctuation range of a node under normal conditions in the past was 20%, then the stability threshold is 10%. If the fluctuation of any node exceeds this threshold, the interface configuration is readjusted and the strategy is re-evaluated until the stability requirements are met.

[0019] S2 includes: acquiring traffic data within a virtual network partition based on the partition itself; using stream processing technology for real-time monitoring to obtain a traffic data stream; if external interference in the traffic data stream exceeds a preset threshold, activating a backup isolation layer according to preset rules to determine an enhanced isolation boundary; deploying a mirrored baseline environment based on the enhanced isolation boundary, acquiring mirrored baseline data, and determining the baseline's operating status; comparing the mirrored baseline data and real-time traffic data using a K-means clustering algorithm to obtain a data deviation pattern; adjusting the traffic scheduling strategy within the enhanced isolation boundary based on the data deviation pattern to determine an optimized traffic allocation scheme; updating the configuration parameters of the virtual network partition using the optimized traffic allocation scheme to obtain a stable network partition state; if external interference still exists in the traffic data stream of the stable network partition state, generating a new isolation boundary through dynamic routing adjustments to determine the final isolation configuration.

[0020] In this implementation, firstly, traffic sampling probes are deployed within each designated virtual network partition. These probes perform data sampling every 2 seconds via a timed trigger mechanism, collecting data including the number of data packets on each active link, total traffic volume, average packet size, packet interval, source and destination node numbers, and the protocol type used for transmission. A memory stream computing architecture is used to process the sampled data. A sliding window mechanism combines data from every 5 seconds into a complete traffic data snapshot, which is then categorized and cached using fields such as timestamp, node pair identifier, and protocol type. This processing method ensures continuous, real-time monitoring of network traffic status.

[0021] Subsequently, interference detection is performed on the traffic data streams generated in each time window. The specific detection logic includes three dimensions: The first dimension is the surge traffic judgment. The preset surge threshold is 1.3 times the maximum traffic value within each 5-second window during the continuous operation of the target subnet in the past 72 hours. This value is obtained by multiplying the maximum value of all sampling windows by 1.3. This threshold is used to identify sudden abnormal traffic. When the current data traffic exceeds this value, an alarm is triggered. The second dimension is the abnormal source identification ratio threshold. This parameter is set so that if the number of newly appearing source nodes in the current data stream accounts for more than 60% of the total number of connected sources, it is considered that abnormal sources have appeared in a concentrated manner. New source nodes are defined as source addresses that have not appeared in the traffic log of this partition in the past 30 minutes. The third dimension is the duplicate data detection threshold. That is, when the data packets continuously sent from the same source address to the same destination address have completely identical data content and appear more than 100 times, this behavior is considered as duplicate attack traffic. Meeting the conditions of any of these dimensions is considered as the presence of external interference.

[0022] Upon detecting external interference, a preset response rule is initiated, activating the backup isolation layer and determining the enhanced isolation boundary. The activation of the backup isolation layer is accomplished by calling an isolation template. The template contains the connection information and path bandwidth of each node in the current partition. Nodes with a latency below 40 milliseconds and a packet loss rate below 2% within the last 30 seconds are selected as isolation relay nodes. These nodes are used to construct a new communication path, disconnecting the currently interfered path and redirecting normal communication into the isolated path, forming a new logical boundary. This boundary is marked as the enhanced isolation boundary, and its scope is the set of all nodes on the shortest connection path from the source node to the target node that are not marked as high-frequency anomalies.

[0023] A mirrored baseline environment was deployed within the enhanced isolation boundary. This mirrored environment was deployed via a container cluster, with each node loading a configuration file identical to the standard operating environment, including parameters such as firewall policies, interface bandwidth, and node access permissions. After the environment was running, multiple metrics, including response latency, data processing rate, link packet loss rate, and error code return rate, were collected on each node. These metrics constituted the mirrored baseline dataset. Simultaneously, real-time data streams within the current enhanced isolation boundary were collected, and both were input into a K-means clustering algorithm for comparative analysis. The specific execution process of the K-means clustering algorithm included: setting the number of clusters to three, representing normal, mildly abnormal, and severely abnormal traffic states; randomly selecting three sets of data as cluster centers during the algorithm initialization phase; calculating the Euclidean distance of each sample to the three centers; and assigning each sample to the category corresponding to the nearest center; iteratively executing this partitioning process until the classification results of all samples remained unchanged for two consecutive rounds or the change in cluster center coordinates was less than 0.001. In the final classification results, the category furthest from the center point of the mirrored baseline was identified as the deviation pattern.

[0024] The system locates the source path of traffic in the deviation pattern by comparing the most frequent source nodes and paths in the deviation data to identify the key links and node combinations causing the deviation. Based on the policy template, the corresponding scheduling optimization logic is invoked. Specific operations include reducing the maximum bandwidth on high-frequency paths to 80% of the historical average bandwidth, enabling a round-robin forwarding mechanism for inter-node communication marked as abnormal, setting the path as the lowest priority queue, and enabling a packet loss rate feedback control mechanism to dynamically limit sudden traffic from entering the main channel. These policies are written into configuration commands, encapsulated in JSON format, and pushed to the control module of the corresponding node. The routing and bandwidth configuration changes are completed via local interface calls, with an execution cycle of one update every 10 seconds.

[0025] After the scheduling policy is executed, an optimized traffic allocation scheme is generated based on the new node path and bandwidth parameters. This scheme includes the inbound and outbound path tables for each node, interface activation status, maximum transmission rate limits, etc., serving as the basis for updating the virtual network partition configuration. After the configuration update is complete, a stability test begins. For a continuous 60-second period, latency and bandwidth fluctuation rates for all nodes are collected every 10 seconds. If all monitored values ​​are below 50% of their respective historical maximum fluctuation values, the network is considered to have reached a stable state. If any monitored value exceeds this threshold, it indicates that the current configuration has not effectively suppressed interference, and dynamic routing adjustment logic is immediately initiated.

[0026] Dynamic routing adjustment is based on the current network topology. It evaluates all possible paths to select the one with the highest current idle bandwidth and the fewest historical interference events, and scores the remaining bandwidth of each path. The path with the highest score is selected as the new path, forming a new path set. An isolation boundary is then regenerated based on this set, and this boundary becomes the final isolation configuration. This configuration is saved to the current exercise session file and serves as the basis for subsequent attack exercise comparisons and control policy adjustments.

[0027] S3 includes obtaining internal access logs from the enhanced isolation boundary, classifying the simulated attack behaviors in the logs using a support vector machine algorithm with hyperplane separation and kernel function transformation to obtain a classification result set; if the proportion of simulated attack behaviors in the classification result set exceeds a preset threshold, then extracting timestamps and source addresses from the logs according to preset rules to determine abnormal behavior patterns; based on the abnormal behavior patterns, extracting corresponding traffic feature vectors from the traffic data within the enhanced isolation boundary, and using principal component analysis to reduce the dimensionality of the feature vectors to obtain a dimensionality-reduced feature set; by comparing the dimensionality-reduced feature set with the mirrored baseline data, calculating the Euclidean distance between the feature vectors to determine the abnormal traffic distribution; if the abnormal traffic distribution exceeds a preset threshold, then dynamically adjusting firewall rules to generate new access control policies to determine the updated isolation boundary configuration; based on the updated isolation boundary configuration, extracting a new log subset from the internal access logs, and using cluster analysis to group the behavior patterns in the log subset to obtain behavior pattern groups; by comparing the behavior pattern groups with the mirrored baseline data again, generating optimized traffic filtering rules to determine the final network isolation state.

[0028] In this implementation, a log collection module is first deployed within the enhanced isolation boundary. Every 60 seconds, a complete access log sample is collected from each node. Each log entry includes eight fields: source address, destination address, access port, protocol type, data length, request / response time, request status code, and access timestamp. The collected data is converted into standard structured feature vectors. Each vector contains six dimensions: source / destination pair identifier, protocol type encoding, data packet length, request interval time, port type classification, and response code classification. This feature set is input into a support vector machine (SVM) algorithm model for classification. The model uses a radial basis function kernel function for nonlinear mapping, mapping the data to a high-dimensional space to train an optimal classification hyperplane to distinguish between normal access behavior and simulated attack behavior. The training samples consist of manually labeled historical logs, with a total of 10,000 samples. Training uses 10-fold cross-validation to optimize the classification boundary, with 300 iterations, and the classification accuracy is controlled above 95%.

[0029] Hyperplane separation refers to the process of separating different categories of data samples in the feature space by constructing a linear boundary with the maximum margin. The implementation process is as follows: When processing access log data, each log entry is first transformed into a numerical feature vector containing multiple dimensions, each vector corresponding to an access behavior. In these feature vectors, each dimension represents a specific access attribute, such as protocol type, access time interval, data length, etc. All labeled data points (i.e., access behaviors known as "normal" or "attack") are distributed in the feature space. The goal of the support vector machine is to find a linear hyperplane that clearly distinguishes these two types of samples, and maximizes the distance from the boundary to the nearest sample point of each class; this distance is called the "margin." The sample points located closest to both sides of the boundary, called "support vectors," determine the specific location of the hyperplane. Finally, a high-dimensional hyperplane is formed, with normal access samples and attack access samples falling on its two sides respectively. The category of a new input sample is determined based on its position on this hyperplane. Hyperplane separation is suitable for cases where data is linearly separable in the feature space, meaning that the data can be clearly divided by a straight line, a plane, or a high-dimensional hyperplane.

[0030] Kernel transformation refers to the process where, in the feature space, if the original data is linearly inseparable (i.e., it cannot be effectively separated by a single plane), a kernel function maps the low-dimensional features to a higher-dimensional space. In this higher-dimensional space, a linearly separable hyperplane is found, still achieving effective classification. The process is as follows: When inputting data, it is found that some visit behavior samples are distributed in an interleaved manner in the original feature dimensions, making them impossible to distinguish effectively by a single linear plane. At this point, a "kernel function" is introduced. This function is a mathematical mapping relationship used to elevate the feature vector of each sample from its current dimension to a higher-dimensional space. In the mapped higher-dimensional space, the originally mixed sample points exhibit a clearer structure in the new dimension, potentially becoming linearly separable. Commonly used kernel functions include radial basis functions (also known as Gaussian kernels) and polynomial kernels. In this implementation, a radial basis function kernel is used. Its characteristic is that it emphasizes local structure in the new higher-dimensional space; that is, the closer two samples are, the higher their similarity, and the more likely they are to belong to the same class after the transformation. After the transformation, the support vector machine uses this mapped data to retrain the classification model, find a new optimal hyperplane, and complete the classification. The essential significance of kernel functions lies in "achieving high-dimensional mapping at low cost," that is, without explicitly calculating high-dimensional coordinates, but by calculating the inner product relationship between data points through kernel functions, hyperplane separation in high-dimensional space can be achieved.

[0031] After classifying the access log samples, the number of records identified as simulated attack behavior within the current period is counted, and this number is divided by the total number of log entries to obtain the attack behavior ratio. For example, if a total of 2000 logs are collected in a certain period, and 600 of them are classified as attack behavior, the attack ratio is 30%. If this ratio exceeds the set attack ratio threshold, it is determined that large-scale simulated attack behavior is currently occurring. The attack ratio threshold is set to 1.4 times the maximum attack ratio of logs in the historical 30 days of operational data. Specifically, the maximum attack behavior ratio is recorded in each period; if this value is 20%, the threshold is set to 28%. This method ensures that a response mechanism can be activated when attack activity significantly increases.

[0032] Once the threshold is exceeded, the abnormal behavior pattern identification process is initiated. The timestamp and source address fields are extracted from the logs identified as attack behaviors. After sorting by time, the access frequency of each source address is analyzed. If a source address accesses different target nodes more than 10 times within 10 consecutive seconds, or repeatedly sends the same protocol request more than 20 times under the same target node, the behavior is classified as an abnormal behavior pattern and recorded as a high-frequency concentrated access or protocol repetition attack type.

[0033] Based on the identified abnormal behavior patterns, real-time traffic data related to the source address is synchronously collected from the enhanced isolation boundary. Each traffic data point is constructed as a 6-dimensional feature vector, containing packet length, packet interval, persistent connection duration, protocol number, destination port number, and communication path identifier. This feature set is then input into a principal component analysis algorithm for dimensionality reduction. The processing includes: first, constructing the covariance matrix of the batch of feature vectors; then, extracting principal components through eigenvalue decomposition; retaining the first two principal components with a cumulative variance contribution rate greater than 90%, and generating the dimensionality-reduced feature set. Each dimensionality-reduced vector retains key information while reducing computational complexity.

[0034] After the dimensionality reduction feature set is generated, it is paired and compared with traffic feature vectors recorded in the mirrored baseline environment during the same time period. The comparison method is as follows: calculate the Euclidean distance for each pair of feature vectors, and then calculate the average distance, maximum distance, and standard deviation between all pairs. If the average Euclidean distance exceeds the set anomaly distribution threshold, the current traffic distribution is considered to have deviated from the normal pattern. The anomaly distribution threshold is set based on: extracting the maximum average Euclidean distance of all feature vectors under normal conditions over the past 30 days, multiplying it by 1.5 as the current judgment standard. For example, if the historical maximum value is 0.6, then the current threshold is 0.9. This ensures that policy updates are triggered only when the overall deviation is significant.

[0035] Feature vectors of access behavior are obtained from the real-time access environment with enhanced isolation boundaries, and corresponding feature vectors for the same time period are extracted from the mirrored baseline environment. Each feature vector consists of six dimensions: average packet length, packet time interval, connection duration, transport protocol encoding, destination port encoding, and communication path encoding. All feature values ​​are normalized before input calculation, with values ​​uniformly ranging from 0 to 1 to eliminate dimensional differences between different dimensions. A one-to-one pairing process is performed between each pair of real-time feature vectors and the mirrored baseline feature vectors to calculate their Euclidean distance. The specific process includes: first, calculating the difference between the two vectors in each dimension; second, squaring the difference in each dimension to obtain the squared difference; third, summing the squared differences in all six dimensions to obtain the sum of squares; and fourth, performing a square root operation on the sum of squares to obtain the Euclidean distance value of the current vector pair. The same calculation is performed on all feature vector pairs sequentially, ultimately obtaining a set of Euclidean distance results. Based on this set of results, three statistical indicators are calculated: the mean, maximum, and standard deviation of all distance values, to comprehensively assess the degree to which the current access behavior deviates from the baseline behavior. If the average Euclidean distance exceeds the set abnormal distribution threshold, the current access behavior is considered to have an overall deviation, and the corresponding traffic control logic is initiated. The abnormal distribution threshold is set based on the average Euclidean distance of the feature vectors under all normal operating conditions statistically analyzed over the past 30 days, and the maximum value is multiplied by 1.5 to serve as the judgment threshold for the current period. For example, if the historical maximum average is 0.55, then the current threshold is set to 0.825.

[0036] Once the deviation is confirmed, the firewall control module is invoked to adjust the policy. This module generates access control policies based on the source address, target port, and protocol information recorded in the aforementioned abnormal behavior pattern. The policies include: blocking the source address from connecting a maximum of 10 times within 60 seconds; preventing access to the top 3 ports where attack activity has occurred in the past 7 days; and blocking all requests based on insecure protocols such as Telnet. After the policies are generated, they are distributed to the policy application engine on the border nodes in the form of configuration files, with updates every 10 seconds.

[0037] After the control policy is applied, new access logs following the policy implementation are extracted starting from the next cycle, forming a log subset. This subset has the same data structure as the original logs and contains all access records affected by the control policy. A density-based spatial clustering algorithm is used to cluster this log subset, with a minimum sample size of 5 and a neighborhood radius equal to the historical average access interval multiplied by 0.5 as input parameters. After clustering, several behavioral pattern groups are formed, each containing records with similar access times, request paths, and response patterns.

[0038] The normal access patterns of each behavior pattern group are compared with those in the corresponding time period in the mirror baseline. The comparison methods include calculating the difference in access frequency, request / response code offset rate, and path concentration difference. If all three indicators exceed a set difference threshold of 20%, the pattern group is marked as an abnormal behavior group, and new traffic filtering rules are generated accordingly. The filtering rules include a request frequency cap, path access control, and response pattern verification mechanisms. These rules are simultaneously deployed to all boundary nodes as the policy basis for the final network isolation state, ensuring dynamic identification, classification, and response capabilities to persistent attack simulations during the exercise. This allows for automatic adjustment of the defense structure and optimization of policy execution paths, achieving closed-loop control of the attack posture and continuous purification of the exercise environment.

[0039] In S4, for the classification result set, the corrected comprehensive analysis indicators include: For the classification result set, the access control parameters are adjusted through the dynamic rule generation module. If the classification result set indicates a high-frequency attack, the access level of the corresponding role is reduced. Support vector selection criteria and soft-margin optimization calculations are incorporated to obtain updated access rules. Specifically, when the access frequency or attack characteristics of an access behavior exceed a preset threshold, the access behavior is identified as a high-frequency attack, and the access rules are dynamically corrected by comparing the deviation results. This includes obtaining high-frequency attack identifiers based on the classification result set, adjusting access control parameters using soft-margin optimization and kernel function transformation through the support vector machine algorithm, and obtaining an updated access rule set. If the proportion of abnormal behavior identifiers in the updated access rule set exceeds a preset threshold... Then, cluster analysis is used to group access behaviors to obtain a behavior pattern set. Based on the behavior pattern set, the source address and timestamp features of the access behaviors are extracted, and principal component analysis is used to reduce the dimensionality of the feature vectors to obtain a dimensionality-reduced feature set. If the deviation between the dimensionality-reduced feature set and the preset baseline data exceeds a preset threshold, the distribution of abnormal behaviors is determined by calculating the cosine similarity between the feature vectors. Based on the distribution of abnormal behaviors, a dynamic access control list is generated to obtain the updated access control policy. Based on the updated access control policy, a new subset of behaviors is extracted from the access logs, and statistical analysis is used to calculate the frequency distribution of the behavior subsets to obtain a behavior frequency set. Based on the comparison between the behavior frequency set and the preset baseline data, the dynamic access control list is adjusted to determine the optimized permission control configuration.

[0040] In this implementation, based on the classification result set output from the previous stage, the classification labels of each access behavior are filtered to identify access entries that are continuously classified as simulated attack behaviors. The criteria for judging high-frequency attacks are defined as follows: a source address sends more than 30 requests to multiple target nodes within 60 seconds, or sends more than 20 repeated requests to the same target port within 30 seconds. Access behaviors that meet either of these conditions are marked as "high-frequency attacks" and used as the basis for subsequent adjustment of access control parameters. Next, an access control feature vector set is constructed. This vector set transforms the access attributes of each high-frequency attack behavior into six-dimensional feature inputs, including source address encoding, target address encoding, protocol type encoding, request interval time, port number category, and access result status code. Each feature value is normalized and then uniformly input into the support vector machine model. This model uses a soft-margin optimization strategy, that is, while allowing some samples to be misclassified, it balances classification accuracy and model fault tolerance by setting a penalty factor, thereby enhancing the model's generalization ability to boundary samples. During the processing, the support vector machine also introduces a kernel function transformation mechanism. Since high-frequency attack behaviors often exhibit a non-linear distribution in low-dimensional space, a radial basis function (RBF) kernel is used to map feature vectors to a high-dimensional space, making the originally mixed data easier to linearly segment in the new space. In the mapped high-dimensional space, the model is trained and the optimal classification hyperplane is constructed to determine whether the current access control policy can effectively distinguish between high-frequency attack behaviors and normal behaviors.

[0041] After the model is trained, the access control parameters are dynamically adjusted based on the classification output. Specifically, this includes: setting an access frequency cap for high-frequency attack source addresses, such as controlling the request frequency of a single address to no more than 10 times per minute; enabling rate limiting policies for vulnerable target ports, such as limiting the incoming connection rate to 70% of the historical normal traffic; and enabling an access time window mechanism for reusable protocol types, such as allowing each source to access a specified protocol interface only once every 60 seconds.

[0042] After classification, the permission rules are adjusted accordingly, generating an updated permission rule set, including access frequency restrictions for source addresses, access permission restrictions for target ports, and usage permission control for protocol types. The number of rule entries marked as abnormal behavior in the updated permission rule set is counted, and their proportion in all rules is calculated. If this proportion exceeds a threshold, the access behavior clustering analysis phase begins. This threshold is set based on the maximum percentage of abnormal behavior in the permission rule set for each hour of each day over the past 30 days, multiplied by 1.4 as the current judgment benchmark. For example, if the historical maximum is 18%, the current threshold is 25.2%. If the percentage of abnormal entries in the current rule set is 27%, it exceeds the threshold, triggering the next processing step. Density clustering algorithms are used to perform pattern recognition on access behavior, extracting fields such as source address, target address, access time, protocol type, access path, and request frequency for each access to construct a feature vector. The neighborhood radius in the clustering parameters is set to 0.5 times the historical average request interval, and the minimum sample size is 5. Clustering is then performed to form a behavior pattern set. For each behavior pattern set, the source address and access timestamp fields of all access behaviors are extracted to form a two-dimensional feature vector, which is then input into a principal component analysis algorithm for dimensionality reduction. Dimensionality reduction first constructs a covariance matrix for all vectors, extracts eigenvalues ​​and arranges them in descending order, and selects the two principal components with a cumulative contribution rate exceeding 90% to form a new feature space, generating a dimensionality-reduced feature set. The dimensionality-reduced feature set is compared with a preset baseline behavior feature set, and the mean deviation between the two is calculated. If the deviation exceeds a set threshold, the similarity calculation process is triggered. This threshold is determined by extracting the maximum mean deviation of the behavior feature sets for each period under normal conditions over the past 30 days, multiplying it by 1.3 to obtain the current period's judgment threshold. For example, if the historical maximum deviation is 0.18, the current threshold is set to 0.234. If the mean deviation between the dimensionality-reduced feature set and the baseline is greater than 0.234, it is considered that there is a significant deviation in behavior, and cosine similarity calculation is initiated. In the cosine similarity calculation, the cosine value between each reduced-dimensional vector and the baseline vector is calculated, with a value range between 0 and 1. If the cosine similarity between a behavior vector and the baseline vector is less than 0.7, it is marked as an abnormal behavior. The proportion of abnormal behaviors in the current period's access samples is statistically analyzed. If the proportion exceeds 50%, it indicates that the overall behavior distribution deviates from the baseline. At this point, a dynamic access control list is generated based on the abnormal behavior distribution characteristics. Control items include policies such as limiting the number of requests from the source address to a maximum of 20 per minute, restricting the target port for repeated access, and limiting the transmission rate of specific protocol types. This access control policy is synchronized to the isolation boundary nodes through configuration distribution. After the policy is applied, access behaviors that are still active are selected from the post-execution access logs to form a new subset of behaviors. Frequency statistics are performed on this subset to generate a behavior frequency set.

[0043] Frequency statistics involve calculating the number of times each behavior type occurs within a 1-minute window and comparing it to the standard frequency of the same behavior in the mirror baseline. If the frequency of a certain behavior in the current frequency set is higher than 150% of the baseline value, it is considered a high-frequency deviation behavior. Based on this, the access control list is revised again, setting stricter access frequency limits, increasing access intervals, or mandating manual approval mechanisms for that behavior. After the revision is completed, the final access control configuration is generated as the optimal access control policy output for this period's exercise state.

[0044] In S4, for the classification result set, the corrected comprehensive analysis index also includes: extracting the authorized operation sequence from the updated permission rules, obtaining baseline data access records, determining if concurrent access anomalies occur in the records, triggering data integrity verification, and applying feature vector mapping technology and training data fitting steps to determine the data subset that passes the verification. Specifically, this includes extracting access behavior timestamps and source addresses from the authorized operation sequence, using cluster analysis to generate access behavior patterns, and determining the access behavior classification set; based on the access behavior classification set, extracting the time series features of abnormal behaviors, using principal component analysis for dimensionality reduction, and obtaining a dimensionality-reduced feature set; if the dimensionality-reduced feature set matches the preset baseline number... If the deviation exceeds the anomaly detection threshold, the abnormal behavior distribution set is determined by calculating the Euclidean distance between time series. Based on the abnormal behavior distribution set, dynamic permission adjustment rules are generated, and the permission control strategy is updated using a decision tree algorithm to obtain the optimized permission configuration. New authorized operation sequences are extracted from the optimized permission configuration, and the access frequency distribution is calculated using statistical analysis to obtain the behavior frequency set. Based on the behavior frequency set, concurrent access anomalies are detected. If the proportion of abnormal behavior exceeds a preset threshold, a verification feature set is generated through feature vector mapping to determine the data subset. Based on the data subset, the dynamic permission adjustment rules are adjusted, and the optimized permission control strategy is fitted using regression analysis to obtain the final permission configuration.

[0045] In this implementation, the authorization operation sequence for the current period is first obtained from the updated permission configuration. Each record explicitly includes a timestamp and source address of the access behavior. The timestamp precisely defines the moment the behavior occurs, and the source address identifies the accessing entity; together, they constitute the spatiotemporal characteristics of the behavior. Then, an access behavior feature vector is generated using these fields for each record. This vector includes the access time interval, behavior frequency, and access source identifier. This feature vector set is input into the clustering module, employing a density-based spatial clustering algorithm. The neighborhood radius in the clustering parameters is set to 50% of the historical average request interval to ensure that only records that are spatiotemporally close, have the same source, or similar behavior frequencies are grouped into the same category. The minimum sample size is set to five to prevent mis-clustering from affecting pattern recognition. After clustering, several access behavior pattern categories are generated, forming access behavior classification sets used to identify differences in behavior types. For each classification set, time-series features of its internal behaviors are further extracted, including specific indicators such as the change in behavior count per minute, the average access interval, and the peak window length. These indicators are integrated into a time-series feature vector, and all these vectors are input into the principal component analysis module.

[0046] In the dimensionality reduction process, the covariance matrix of these vector sets is first calculated. Then, principal components are extracted by sorting them by eigenvalues. The top two to three principal components, whose cumulative explained variance exceeds 90%, are selected to form the dimensionality-reduced feature set. This dimensionality-reduced feature set is compared with a preset baseline behavioral feature set, and the difference between their means is calculated. If the difference exceeds the anomaly detection threshold, it proves that the current behavioral pattern deviates from normal. The anomaly detection threshold is set by extracting the maximum difference between the dimensionality-reduced means from historical normal behavior and multiplying it by 1.4. For example, if the historical maximum deviation is 0.15, the threshold is set to 0.21. If the difference between the current dimensionality-reduced feature mean and the baseline mean is greater than 0.21, the dimensionality-reduced feature set is considered a different feature set.

[0047] The dimensionality-reduced feature set is further converted into a time series format and paired with the baseline time series point by point. Euclidean distance is calculated by taking the square root of the sum of squared differences at each time point and then averaging the distance. If the average distance exceeds a set deviation threshold (set to twice the historical average Euclidean distance maximum, e.g., if the historical maximum is 0.2, and the current value is 0.4), it is considered an abnormal behavior distribution. After identifying the abnormal behavior distribution, dynamic permission adjustment rules are constructed, including increasing the access request interval of high-frequency source addresses to 30 seconds, setting read-only access permissions for that source address within the current period, and restricting its access paths to only whitelisted resources. All these rules are used to construct decision paths using a decision tree algorithm. The model training samples are the feature vectors of each behavior within the current period and their labels indicating whether it is abnormal. The decision objective is to determine whether... Permissions should be adjusted to generate a structured, optimized permission configuration. After applying the optimized permission configuration, the frequency of various behaviors per minute should be counted from the newly authorized operation sequence generated after execution, forming a behavior frequency set. The concurrent access ratio should be calculated, which is the proportion of multiple parallel behaviors within the same time window. If this ratio exceeds the set concurrency anomaly threshold, the threshold is determined by multiplying the historical highest concurrency ratio by 1.2. For example, if the historical maximum concurrency ratio is 29%, then the current threshold is 34.8%. If the current ratio exceeds this value, it is considered a concurrency anomaly. In this state, a feature vector mapping operation should be performed to map high-frequency behaviors to a unified feature space. A verification feature set should be generated based on the access path, source address, and time density. Access records with completely identical access paths and the same source address within a ten-second window should be selected from this feature set to form a data subset.

[0048] After identifying concurrent access anomalies, a subset of data containing high-frequency abnormal behaviors has been generated. This subset contains multiple access behavior records filtered by features, with each record including fields such as timestamp, source address, target resource path, access frequency, and access success rate. The optimization process for dynamic permission adjustment rules based on this subset is implemented as follows: First, a training sample set for permission control fitting is constructed. Each sample consists of three types of variables: input variables, target variables, and labels. Input variables include access frequency, behavior trigger time window density, historical behavior consistency score of the source address, path access depth level, and historical anomaly identification frequency. The target variable is the current permission control level (e.g., read, write, execute, or deny), and the label is the anomaly judgment result of the behavior in the current period, serving as a reference system for regression fitting. Next, a linear regression analysis algorithm is used to model the training samples. First, all input variables are standardized to eliminate the influence of different dimensions. Then, a multiple linear model is constructed, assuming that the permission control level is a weighted combination of multiple input variables, and a bias term is introduced to improve the model fitting accuracy. During the modeling process, the least squares method is used to calculate regression coefficients, minimizing the sum of squared errors between the fitted results and the actual observed values. After model training, the model is used to calculate permission policies for unlabeled behaviors throughout the entire lifecycle. Based on the continuous values ​​output by the model, four permission level intervals are defined, corresponding to four control policies: prohibited access, read-only access, restricted access, and full access. For example, if the model output value is less than 0.25, it is classified as prohibited access; between 0.25 and 0.5, it is read-only access; between 0.5 and 0.75, it is restricted access, allowing only partial resource access; and greater than 0.75, it is full access. Based on this, the final permission control configuration is generated. The configuration file explicitly specifies the access level corresponding to each combination of behavioral characteristics, and incorporates additional rules such as source address whitelists, target path sensitivity levels, and access time periods as supplementary control conditions. The final policy is synchronized to the access control component for implementation through the permission distribution interface, ensuring that all access behaviors are evaluated and controlled in real-time, accurately, and dynamically throughout the future lifecycle.

[0049] S4, for the classification result set, obtains the corrected comprehensive analysis indicators, which also include: generating a vulnerability analysis report based on the data subset; using log aggregation technology to fuse the subset and isolation boundary data through a data stream merging protocol and a timestamp synchronization algorithm; and comparing the results with the mirror baseline results to obtain the corrected comprehensive analysis indicators. Specifically, this includes obtaining access log data from the data subset, merging the data streams using log aggregation technology to obtain an aggregated data stream; aligning the aggregated data stream with the isolation boundary data on the timeline using a timestamp synchronization algorithm to obtain a synchronized data set; and if the consistency comparison result between the synchronized data set and the mirror baseline data is lower than a preset threshold, then a vector space is used. Inter-mapping technology is used to correct data deviations, resulting in a corrected data set. Based on the corrected data set, abnormal pattern features are extracted from the access logs, and an abnormal pattern classification set is generated using the K-means clustering algorithm. High-risk access features are obtained from the abnormal pattern classification set, and the feature frequency distribution is calculated using statistical analysis to obtain an abnormal frequency set. Features in the abnormal frequency set whose risk level exceeds a preset threshold are considered high-risk features. If the proportion of high-risk features in the abnormal frequency set exceeds a preset threshold, the source of the anomaly is located using log tracing technology to determine the abnormal access source set. Based on the abnormal access source set, dynamic access control rules are generated, and the access permission configuration is updated using a rule matching algorithm to obtain an optimized permission set.

[0050] In this implementation, access log data is first read from the data subset one by one and log aggregation is performed. The aggregation is based on a fixed time window and a clear merge key. The time window is 5 seconds, and the merge key consists of the source address, target path, access action, and status code. Multiple records with completely identical merge keys within the same window are merged into a single record. The merging rules are: summing the number of requests, summing the number of successes, taking the arithmetic mean of the response latency, and taking the earliest and latest start and end timestamps, respectively. The output is an aggregated data stream.

[0051] Subsequently, a timestamp synchronization algorithm is executed to align the aggregated data stream with the isolated boundary data on the timeline. The alignment steps are as follows: first, unify them to the same time zone and use seconds as the granularity; then, pair the records on both sides using the source address and target path as matching keys; calculate the time difference sequence of records with the same key and take the median as the clock offset; use this offset to correct the timestamp of the aggregated data stream as a whole; after correction, resample in 1-second steps, and remove records that cannot be paired within the 1-second tolerance to obtain the synchronized data set; next, perform a consistency comparison between the synchronized data set and the mirror baseline data and calculate the consistency score. The consistency score is obtained by weighted summation of the matching degree of four fields, where the four fields are time matching... Matching is performed on the source address, target path, and status code, with corresponding weights of 0.3, 0.3, 0.3, and 0.1, respectively. Time matching is judged with a 1-second tolerance, while other fields are judged by complete consistency. The matching ratio of each field is then calculated and summed according to their weights to obtain the total score. The consistency threshold is determined based on historical data. The method is to statistically analyze the consistency score sequence of all aligned samples during the past 30 days of normal operation, take the 95th percentile, and multiply it by 0.9 to obtain the current threshold. This ensures that the threshold covers normal fluctuations while maintaining sufficient sensitivity to anomalies. When the current score is lower than the threshold, a deviation is determined and the vector space mapping correction process is initiated.

[0052] Vector space mapping constructs a feature vector with four dimensions: access frequency, average response latency, success rate, and short-window burst ratio. The correction steps are as follows: First, the current feature vector is shifted to the center using the mean of the current synchronized dataset in each dimension to eliminate the overall offset. Then, the ratio of the mirror baseline in each dimension to the 75th percentile of the current data is calculated, and the current feature vector is scaled accordingly to align the scale. Subsequently, the mean of the mirror baseline is added to each dimension to align the center. Finally, values ​​exceeding the 95th percentile of the mirror baseline are truncated to suppress the influence of outliers, and the corrected dataset is output. From the corrected dataset, [the following steps are taken]... Anomaly pattern features are extracted, including request count per unit time, short-window burst ratio, failure rate, target path switching rate, and interval variability. Mean clustering is used for classification, with 5 clusters. An accelerated point selection strategy is initialized, and the maximum number of iterations is set to 100. The process stops early if the center displacement between two adjacent iterations is less than one-thousandth, resulting in an anomaly pattern classification set. Statistical analysis is performed on each feature within the anomaly pattern classification set. The frequency is calculated by counting the number of occurrences per minute within a time window and dividing by the total number of samples in that class, forming an anomaly frequency set. High-risk features are then determined based on a risk threshold. The determination of the risk threshold is as follows. The method involves calculating the maximum frequency of the same feature under normal conditions over the past 30 days, multiplied by 1.3. If the current frequency exceeds this threshold, it is marked as a high-risk feature. Subsequently, the proportion of high-risk features within the abnormal frequency cluster is calculated and compared with a high-risk proportion threshold. The high-risk proportion threshold is the maximum high-risk proportion for each period under normal conditions over the past 30 days multiplied by 1.2. When the current proportion exceeds this threshold, log tracing technology is initiated to locate the source of the anomaly. The tracing steps involve retracing back through the synchronized data set in reverse chronological order, according to the source address and target path, to the record where the high-risk feature first appeared, and verifying its occurrence within the specified time frame. Whether the abnormal access continues within the next three adjacent time windows, the source addresses that meet the persistence condition are included in the abnormal access source set; dynamic access control rules are generated based on the abnormal access source set. The rules are expressed with explicit fields, including source address, target path, allowed action, frequency limit, cooldown time, and effective time period. The frequency limit is set to 0.5 times the average frequency of similar sources in the mirror baseline and not higher than 10 times per minute. The cooldown time is set to 1.5 times the average interval of similar sources in the mirror baseline and not less than 30 seconds. The effective time period covers the period when the abnormality occurred and extends 5 minutes before and after.

[0053] Finally, dynamic access control rules are generated using the abnormal access source set as input, and the access permission configuration is updated through a rule matching algorithm until an optimized permission set is formed. The specific process is as follows: First, for each source address in the abnormal access source set, the behavioral statistics in the synchronized data set are summarized one by one. The statistics are fixed and include the number of requests per minute, average request interval, target path list, common access actions, abnormal occurrence time period, number of continuous occurrence windows, and corresponding indicators in the mirror baseline in the past 30 days. Then, a rule draft is constructed for each source address. The rule items adopt a fixed field structure, and the fields are source address, target path, allowed actions, frequency limit, cooldown time, effective time period, rule priority, and scope of application. The frequency limit is based on the same type as the mirror baseline. The frequency of each source is calculated as 0.5 times the average frequency and set to no more than 10 times per minute. The cooldown time is calculated as 1.5 times the average interval of similar sources in the mirror baseline and set to no less than 30 seconds. The effective time period covers the time period when the anomaly occurred and extends 5 minutes before and after it. The rule priority is determined based on the accuracy of the source and path: the priority of a precise source plus a precise path is 1, the priority of a precise source plus a wildcard path is 2, the priority of a wildcard source plus a precise path is 3, and the priority of a wildcard source plus a wildcard path is 4. The smaller the number, the higher the priority. Next, the rule matching algorithm is executed. The newly generated rule draft is matched and merged with the existing access permission configuration one by one. The matching order is from lowest to highest priority and from most recent to oldest time period. The matching process proceeds in three steps, from longest to shortest path. Step 1 compares the source addresses: exact match, wildcard match, and no match. Step 2 compares the target paths: exact match or path prefix inclusion with the boundary at the separator indicates a match; otherwise, no match. Step 3 compares the valid time periods: any overlap indicates a match. When rule conflicts are detected, they are handled according to a predetermined conflict resolution order: denial restrictions take precedence over rate-limiting restrictions, and rate-limiting restrictions take precedence over permission restrictions. For multiple rate-limiting restrictions on the same subject, path, and time period, the minimum frequency limit and the maximum cooldown time are used. For rules with the same restriction strength but different time periods, the time period is used for matching. Merging reduces the number of entries; then deduplication and convergence are performed. Deduplication rules prioritize rules with completely identical fields, and the effective time is updated to the earliest start and latest end. Convergence rules merge adjacent time periods of the same subject on the same path with the same constraint parameters into a single entry. After convergence, consistency checks are performed, which include two fixed checks: the first checks whether the frequency limit and cooldown time simultaneously meet the requirements of no more than 10 requests per minute and an interval of no less than 30 seconds between requests; the second checks whether the effective time period covers at least 3 windows of abnormal persistence. If either condition is not met, the process reverts to the rule draft stage and strengthens the restrictions by a fixed ratio, which is the frequency limit multiplied by 0.8 and the cooldown time multiplied by 1.2. Re-verify, iterating a maximum of 3 times; after passing verification, proceed to the policy merging and writing stage. The merged and converged set of rules is inserted into the existing configuration in ascending priority order. During insertion, path length is compared again to ensure rules with longer paths precede those with shorter paths, ultimately forming an optimized permission set. To ensure traceability and rollback of configuration changes, each generated optimized permission set is appended with a version number and effective timestamp, and the thresholds and statistics used in the calculation are recorded. Thresholds are derived from the stable statistical upper bound of the mirror baseline and normal samples over the past 30 days, multiplied by a fixed security factor. Frequency limits and cooldown time limits are used to prevent excessive allowance or excessive blocking. The extension of the effective time period covers the transition zone before and after anomalies. Priority and conflict handling order ensure that denial restrictions are not overridden by downstream rules under any circumstances. The optimized permission set output after the above determination steps is the final access control configuration for the current period.

[0054] S4, for the classification result set, obtains corrected comprehensive analysis indicators, which also include: extracting optimized suggested paths from the comprehensive analysis indicators, updating the security policy framework for the paths, determining if the path matches the environmental purity requirements, integrating it into the exercise replay process, and combining the event correlation analysis framework and aggregation function application logic to obtain a compared and corrected version of the optimization strategy. Specifically, this includes extracting access traffic patterns from critical path data, generating traffic segment sets using traffic segmentation technology; if the traffic segment sets match a preset access pattern threshold, determining the access path using data flow analysis technology to obtain a path set; generating a path cluster set using clustering analysis algorithms based on the path set; and if the proportion of abnormal paths in the path cluster set exceeds a preset threshold, locating the source of the abnormal path using path tracing technology. Define the abnormal path source set; obtain associated access logs from the abnormal path source set, and extract access behavior features from the logs using log parsing technology to obtain a behavior feature set; generate an access behavior classification set using a decision tree algorithm based on the behavior feature set; if the proportion of risky behaviors in the access behavior classification set exceeds a preset threshold, generate dynamic access control rules using rule generation technology to obtain a control rule set; extract rule priority data from the control rule set, and generate an optimized rule sequence using priority sorting technology to obtain an optimized rule sequence set; update the access permission configuration in the security policy framework based on the optimized rule sequence set to obtain an updated permission configuration set; obtain policy execution logs from the updated permission configuration set, and generate an execution effect dataset using log aggregation technology to obtain an optimized policy execution set.

[0055] In this implementation, critical path data is used as input, sorted chronologically, and access traffic patterns are extracted using a fixed 5-second slice window. The window length is determined based on the average round-trip latency and burst duration statistics of the historical 30-day normal period, taking 10 times the average round-trip latency and not less than 5 seconds to ensure sufficient sample size for each window. Within each window, traffic segmentation is performed to generate a traffic segment set. The segmentation criteria include throughput mutation and packet interval mutation. The throughput mutation threshold is taken as the 95th percentile of the historical 30-day average throughput of the same caliber window multiplied by 1.2, and the packet interval mutation threshold is taken as the 5th percentile of the historical threshold multiplied by 0.8. If either exceeds the threshold, the segment is disconnected, forming a new segment, and the start and end times, average throughput, peak throughput, average packet interval, standard deviation of packet interval, and request count within the segment are output. Each segment is compared item by item with the preset access pattern threshold. The access pattern threshold is jointly determined by the mirror baseline and normal samples. The allowable range for average throughput is 20% above and below the average of the mirror baseline, and the packet interval stability is... The allowed interval is 80% of the upper bound of the standard deviation of the mirror baseline interval, and the peak throughput does not exceed 120% of the upper bound of the mirror baseline. If all three conditions are met, the segment is considered valid. For valid segments, data flow analysis technology is used to reconstruct paths on the time axis. Segments with the same source address, destination address, port, and protocol, and with adjacent segments having an interval of no more than 2 seconds, are spliced ​​together in chronological order to obtain an access path set. Five indicators are calculated for each path: length, hop count, average throughput, peak burst ratio, and retry rate. The peak burst ratio is the ratio of the peak value within the path to the average value within the path, and the retry rate is the proportion of requests marked with retry. Cluster analysis is performed based on the path set to generate path cluster sets. The clustering algorithm uses K-means, and the number of clusters is set to 5. The value is selected based on the maximum point of the silhouette coefficient in the candidate range of 3 to 8. Accelerated point selection is used for initialization, and the maximum number of iterations is 100. The process stops when the center movement is less than one-thousandth between two adjacent iterations, and the category label and class center index are output.

[0056] The proportion of abnormal paths in the statistical path cluster is compared with a preset threshold. The abnormal path is determined by the following rules: any indicator of the path deviates from the center of its category by more than three times the standard deviation of the indicator during the historical normal period of that category, or the retry rate of the path exceeds 150% of the upper limit of the mirror baseline. If either condition is met, the path is recorded as abnormal. The abnormal proportion threshold is determined by multiplying the maximum abnormal proportion of each period in the historical 30 days by 1.2, which is used to cover normal fluctuations while amplifying the sensitivity of abnormalities. If the threshold is exceeded, path tracing technology is initiated to locate the source of the abnormal path. The tracing steps are to locate the source address and its corresponding target port of the first occurrence of the abnormality in the path set in reverse chronological order, and to verify whether the same abnormal characteristics continue to appear in the next three adjacent windows. If the same characteristics are met, the path is included in the abnormal path source set. Access logs are obtained from the abnormal path source set and log parsing is performed to extract behavioral characteristics. Fixed fields are timestamp, source address, target address, port, protocol, request size, and response. Eight items, including code and retry, are quantified and normalized to form a behavioral feature set. A decision tree algorithm is trained and used to generate an access behavior classification set. The maximum depth of the decision tree is set to 6, the minimum number of leaf samples to 20, and information gain is used as the splitting criterion. The training set consists of samples from the current period and the mirror baseline, which are then divided into a 7:3 ratio for training and validation. The category and risk label of each log entry are output. The proportion of risky behaviors in the access behavior classification set is calculated and compared with a preset threshold. The risk proportion threshold is the maximum risk proportion of each period over the past 30 days multiplied by 1.3. If the threshold is exceeded, dynamic access control rules are generated using rule generation technology. The rule items include six defined fields: subject scope, resource scope, action type, frequency limit, cooldown time, and effective time period. The frequency limit is set to 0.5 times the average frequency of similar subjects in the mirror baseline and not exceeding 10 times per minute. The cooldown time is set to 1 time the average interval of similar subjects in the mirror baseline.The effective time period is 5 times longer and no less than 30 seconds, covering the peak risk period and extending 5 minutes before and after. The rationale for this coefficient is to significantly reduce the attack window while ensuring business continuity. Rule priority data is extracted from the control rule set and priority sorting is performed to generate an optimized rule sequence. The sorting criteria are fixed as follows: denial rules take precedence over rate-limiting rules over allow rules; precise subject rules take precedence over wildcard subject rules; precise path rules take precedence over wildcard path rules; sensitive resources take precedence over general resources; longer paths take precedence; and rules that take effect earlier take precedence. After sorting, deduplication and merging are performed. Rules with completely identical fields are merged into one rule, and the union of time periods is taken. Rules with adjacent time periods and the same restriction parameters are merged to reduce... The process involves updating access permission configurations in the security policy framework based on an optimized rule sequence set. The update process inserts rules in priority order and resolves conflicts with existing rules one by one. Conflict resolution rules prioritize rejection, use a smaller upper limit and longer cooldown for rate limiting, and allow only when no stricter restrictions apply. After completion, a consistency check is performed. The check verifies that the number of requests per minute does not exceed 10, the interval between single requests is not less than 30 seconds, and the effective time period covers at least three risk peaks. If these conditions are not met, the check is tightened by multiplying the frequency upper limit by 0.8 and the cooldown time by 1.2, and then re-checked. This process is repeated a maximum of three times. Once successful, the updated permission configuration set is written to the policy library. Finally, the policy execution logs are obtained from the updated permission configuration set and aggregated into an execution effect dataset with a 60-second window. The dataset outputs metrics such as hit count, interception count, release count, false interception feedback, average response latency, and peak throughput, forming an optimized policy execution set for threshold correction and parameter review in the next cycle.

[0057] After the updated permission configuration set is written to the policy library and put into actual execution, corresponding policy execution logs are generated in real time. Each log record includes fields such as timestamp, source address, target address, access action type, access status, response latency, hit rule number, and execution result. These logs are first aggregated according to a fixed time window, with a window length set to 60 seconds. This value is determined by statistically analyzing the average response latency and rule switching frequency of the logs over the past 30 days, ensuring complete coverage of rule triggering within a single window without causing data to be too sparse or too dense. The aggregation process uses the timestamp as the primary key, merging log entries with the same source address and the same target address within the same window. The merging rules are: summing the request count, blocking count, allowed count, and false blocking count; taking the arithmetic mean of response latency; and taking the maximum value of peak throughput within the window, forming an aggregated log. After aggregation, the aggregated logs from all windows are combined into an execution effect dataset. Subsequently, metrics were calculated on the execution performance dataset, including hit count, block count, allowed count, false block count, average response latency, and peak throughput, generating multi-dimensional execution performance. Hit count represents the total number of times the current rule was triggered; block count represents the number of requests rejected by the rule; allowed count represents the number of requests that passed normally; false block count represents the number of entries subsequently blocked manually or as incorrectly corrected; average response latency is obtained by summing all response latency values ​​within the window and dividing by the total number of requests; and peak throughput is the maximum number of bytes transmitted per unit time within the window. These metrics were also compared with the corresponding metrics of the mirror baseline, and the deviation ratio was calculated to evaluate whether the updated permission configuration improved the overall execution performance. If the number of block counts in the execution performance dataset decreased and the false block ratio was below 5%, and the response latency was controlled within 120% of the mirror baseline, the optimization strategy was deemed effective. Finally, the execution performance dataset was saved and marked as the optimization strategy execution set, providing a quantitative basis for subsequent periodic strategy adjustments and threshold corrections. All parameters throughout the process have a known source, the time window length is derived from historical statistics, the false blocking ratio threshold is the maximum false blocking ratio in the past 30 days multiplied by 0.8, and the response latency threshold is 1.2 times the average of the mirror baseline, ensuring that the results not only accurately reflect the execution status but can also be used for further optimization decisions.

[0058] Although embodiments of the invention have been shown and described, it will be understood by those skilled in the art that various changes, modifications, substitutions and alterations can be made to these embodiments without departing from the principles and spirit of the invention, the scope of which is defined by the appended claims and their equivalents.

Claims

1. A method for comparing and correcting deviations of mirror results of attack exercise replay baselines, characterized in that, include: S1. Obtain the current traffic distribution and interface configuration from the network environment through a pre-established network topology model, and use a deep reinforcement learning algorithm to process the distribution and configuration to obtain an isolation configuration scheme; S2. According to the isolation configuration scheme, a virtual network partition is deployed during the replay of the exercise. The traffic within the partition is monitored in real time. If external interference is detected to exceed the preset threshold, the backup isolation layer is activated, the enhanced isolation boundary is determined, and the mirror baseline environment is run simultaneously within the isolation boundary to generate mirror baseline results for subsequent comparison reference. S3. Obtain internal access logs from the enhanced isolation boundary, use the support vector machine algorithm to classify the attack simulation behavior in the logs through the hyperplane separation mechanism and kernel function transformation process, obtain the classification result set, and compare the classification result with the mirror baseline result to identify the deviation information; S4. For the classification result set, obtain the corrected comprehensive analysis index, extract the optimization suggestion path from the comprehensive analysis index, update the security policy framework for the path, determine if the path matches the environmental purity requirements, integrate it into the exercise replay process, and combine the event correlation analysis framework and aggregation function application logic to obtain the optimized policy version after comparison and correction.

2. The method for comparing and correcting the mirror results of an attack drill replay baseline according to claim 1, characterized in that: S1 includes: By using a pre-defined network topology model, traffic distribution data and interface configuration information in the network environment are obtained to determine the current network operating status. From traffic distribution data and interface configuration information, the load characteristics and interface connection status of network nodes are extracted to obtain the initial pattern of network traffic allocation; A deep reinforcement learning algorithm is used to iteratively optimize the initial pattern and generate a dynamic traffic allocation strategy. If the node load in the dynamic traffic allocation strategy exceeds the preset threshold, the interface configuration information will be adjusted to obtain an optimized interface state. Based on the optimized interface status, a network isolation mechanism is generated, and the isolation configuration scheme is determined; By using an isolation configuration scheme, the traffic allocation strategy in the network topology model is updated to obtain a stable network operation configuration. By using network operation configuration, the stability of traffic distribution in the network environment is verified, and the final isolation configuration scheme is determined.

3. The method for comparing and correcting the mirror results of an attack exercise replay baseline according to claim 1, characterized in that: S2 includes: Based on the virtual network partition, traffic data within the partition is obtained, and stream processing technology is used for real-time monitoring to obtain a traffic data stream. If external interference in the traffic data stream exceeds a preset threshold, a backup isolation layer is activated according to preset rules to determine the enhanced isolation boundary; Based on the enhanced isolation boundary, deploy the mirrored baseline environment, obtain the mirrored baseline data, and determine the baseline's operational status; The K-means clustering algorithm was used to compare the mirror baseline data and real-time traffic data to obtain the data deviation pattern; Based on the data deviation pattern, adjust the traffic scheduling strategy within the enhanced isolation boundary to determine the optimized traffic allocation scheme; By updating the configuration parameters of the virtual network partition using the optimized traffic allocation scheme, a stable network partition state is obtained. If the traffic data flow in a stable network partition state is still subject to external interference, a new isolation boundary is generated through dynamic routing adjustment to determine the final isolation configuration.

4. The method for comparing and correcting the mirror results of an attack exercise replay baseline according to claim 1, characterized in that: S3 includes: Internal access logs are obtained from the enhanced isolation boundary. The attack simulation behaviors in the logs are classified by hyperplane separation and kernel function transformation using the support vector machine algorithm, and a classification result set is obtained. If the proportion of simulated attack behaviors in the classification results exceeds a preset threshold, the timestamps and source addresses in the logs will be extracted according to preset rules to determine the abnormal behavior pattern. Based on the abnormal behavior pattern, the corresponding traffic feature vector is extracted from the traffic data within the enhanced isolation boundary. The principal component analysis algorithm is used to reduce the dimensionality of the feature vector to obtain the dimensionality-reduced feature set. By comparing the dimensionality-reduced feature set with the mirrored baseline data, the Euclidean distance between the feature vectors is calculated to determine the abnormal traffic distribution. If the abnormal traffic distribution exceeds the preset threshold, a new access control policy is generated by dynamically adjusting the firewall rules to determine the updated isolation boundary configuration. Based on the updated isolation boundary configuration, a new subset of logs is extracted from the internal access logs, and cluster analysis is used to group the behavioral patterns in the log subsets to obtain behavioral pattern groups. By comparing the behavior pattern group with the mirrored baseline data again, optimized traffic filtering rules are generated to determine the final network isolation status.

5. The method for comparing and correcting the mirror results of an attack exercise replay baseline according to claim 1, characterized in that: In step S4, for the classification result set, the corrected comprehensive analysis indicators are obtained, including: adjusting the access control parameters through the dynamic rule generation module for the classification result set; if the classification result set indicates a high-frequency attack, reducing the access level of the corresponding role; and incorporating support vector selection criteria and soft-margin optimization calculations to obtain updated access rules. Specifically, when the access frequency or attack characteristics of an access behavior exceed a preset threshold, the access behavior is identified as a high-frequency attack, and the access rules are dynamically corrected by comparing the deviation results. Based on the classification result set, high-frequency attack identifiers are obtained. Then, the access control parameters are adjusted using the support vector machine algorithm with soft-margin optimization and kernel function transformation to obtain the updated access control rule set. If the proportion of abnormal behavior identifiers in the updated permission rule set exceeds a preset threshold, then the access behaviors are grouped through cluster analysis to obtain a set of behavior patterns. Based on the behavior pattern set, the source address and timestamp features of the access behavior are extracted, and principal component analysis is used to reduce the dimensionality of the feature vectors to obtain a dimensionality-reduced feature set. If the deviation between the dimensionality reduction feature set and the preset baseline data exceeds a preset threshold, the distribution of abnormal behavior is determined by calculating the cosine similarity between feature vectors. Based on the distribution of abnormal behavior, a dynamic access control list is generated, and the updated access control policy is obtained. By using the updated access control policy, a new subset of behaviors is extracted from the access logs, and statistical analysis is used to calculate the frequency distribution of the behavior subset to obtain the behavior frequency set. Based on the comparison between the behavior frequency set and the preset baseline data, the dynamic access control list is adjusted to determine the optimized permission control configuration.

6. The method for comparing and correcting the mirror results of an attack exercise replay baseline according to claim 5, characterized in that: The S4 step, for the classification result set, further includes obtaining the corrected comprehensive analysis index: extracting the authorized operation sequence from the updated permission rules, obtaining baseline data access records, determining if concurrent access anomalies occur in the records, triggering data integrity verification, and applying feature vector mapping technology and training data fitting steps to determine the subset of data that passes the verification, specifically including: The access behavior timestamps and source addresses are extracted from the authorized operation sequence, and cluster analysis is used to generate access behavior patterns to determine the access behavior classification set. Based on the access behavior classification set, time series features of abnormal behaviors are extracted, and principal component analysis is used for dimensionality reduction to obtain a dimensionality-reduced feature set. If the deviation between the dimensionality reduction feature set and the preset baseline data exceeds the anomaly detection threshold, the distribution set of abnormal behavior is determined by calculating the Euclidean distance between the time series. Based on the distribution set of abnormal behaviors, dynamic permission adjustment rules are generated, and the permission control strategy is updated using a decision tree algorithm to obtain optimized permission configuration. New authorization operation sequences are extracted from the optimized permission configuration, and the access frequency distribution is calculated using statistical analysis to obtain the behavior frequency set; Based on the behavior frequency set, concurrent access anomalies are detected. If the proportion of abnormal behavior exceeds a preset threshold, a verification feature set is generated through feature vector mapping to determine the data subset. Based on the data subset, the dynamic permission adjustment rules are adjusted, and regression analysis is used to fit and optimize the permission control strategy to obtain the final permission configuration.

7. The method for comparing and correcting the mirror results of an attack exercise replay baseline according to claim 6, characterized in that: The S4 step, for the classification result set, further includes obtaining the corrected comprehensive analysis indicators by: generating a vulnerability analysis report based on the data subset; using log aggregation technology to fuse the subset and isolation boundary data through a data stream merging protocol and a timestamp synchronization algorithm; and combining the results with the mirror baseline results for consistency comparison to obtain the corrected comprehensive analysis indicators, specifically including: Access log data is obtained from a subset of data, and log aggregation technology is used to merge the data streams to obtain an aggregated data stream; The aggregated data stream and the isolated boundary data are aligned on the timeline using a timestamp synchronization algorithm to obtain a synchronized data set; If the consistency comparison result between the synchronized data set and the mirror baseline data is lower than the preset threshold, then the vector space mapping technique is used to correct the data deviation and obtain the corrected data set.

8. The method for comparing and correcting the mirror results of an attack exercise replay baseline according to claim 7, characterized in that: The process of generating a vulnerability analysis report based on a data subset, using log aggregation technology to fuse subset and isolation boundary data through data stream merging protocols and timestamp synchronization algorithms, and combining the results with mirror baseline results for consistency comparison to obtain corrected comprehensive analysis indicators also includes: Based on the calibration dataset, abnormal pattern features are extracted from the access logs, and an abnormal pattern classification set is generated using the K-means clustering algorithm. High-risk access characteristics are obtained from the abnormal pattern classification set, and the frequency distribution of the characteristics is calculated by statistical analysis to obtain the abnormal frequency set; If the risk level of a concentrated risk frequency exceeds a preset threshold, it is considered a high-risk feature. If the proportion of high-risk features in a concentrated anomaly frequency exceeds a preset threshold, the source of the anomaly is located and the set of abnormal access sources is determined through log tracing technology. Based on the abnormal access source set, dynamic access control rules are generated, and the access permission configuration is updated using a rule matching algorithm to obtain an optimized permission set.

9. The method for comparing and correcting the mirror results of an attack exercise replay baseline according to claim 7, characterized in that: The S4 step, for the classification result set, further includes obtaining the corrected comprehensive analysis index: extracting optimized suggested paths from the comprehensive analysis index, updating the security policy framework for the paths, determining if the path matches the environmental purity requirements, integrating it into the exercise replay process, and combining the event correlation analysis framework and aggregation function application logic to obtain the optimized policy version after comparison and correction, specifically including: Access traffic patterns are extracted from critical path data, and traffic segmentation techniques are used to generate traffic segment sets. If the traffic segment set matches the preset access pattern threshold, the access path is determined through data flow analysis technology to obtain the path set; Based on the path set, a path cluster set is generated using a cluster analysis algorithm; If the proportion of abnormal paths in the path cluster exceeds a preset threshold, the source of the abnormal paths will be located and the abnormal path source set will be determined through path tracing technology. Obtain associated access logs from the abnormal path source set, and use log parsing technology to extract access behavior features from the logs to obtain a behavior feature set.

10. The method for comparing and correcting the mirror results of an attack exercise replay baseline according to claim 9, characterized in that: The process of extracting optimized suggested paths from comprehensive analysis indicators, updating the security policy framework for these paths, determining whether a path matches the environmental purity requirements, integrating it into the exercise replay process, and combining the event correlation analysis framework and aggregation function application logic to obtain a compared and corrected optimized policy version also includes: Based on the behavioral feature set, a decision tree algorithm is used to generate a classification set of access behaviors; If the proportion of risky behaviors in the access behavior category exceeds a preset threshold, dynamic access control rules are generated through rule generation technology to obtain a control rule set. Rule priority data is extracted from the control rule set, and an optimized rule sequence is generated using priority sorting technology to obtain an optimized rule sequence set; Based on the optimized rule sequence set, update the access permission configuration in the security policy framework to obtain the updated access permission configuration set; Obtain policy execution logs from the updated permission configuration set, use log aggregation technology to generate an execution effect dataset, and obtain an optimized policy execution set.

Images