An asset dynamic grading and security policy self-adaptive linkage method

Abstract

This invention relates to the field of cloud platform asset security management technology, and provides a method for dynamic asset classification and adaptive linkage of security policies. The method includes: collecting five-dimensional feature data of each asset in the cloud platform; performing differentiated normalization processing on the feature data of each dimension of each asset, and assigning corresponding weight values ​​to each dimension; calculating a weighted comprehensive score for each asset based on the normalized feature values ​​of each dimension and their corresponding weight values, and classifying the assets into multiple predetermined asset levels; matching the corresponding policy template from multiple pre-set security policy templates according to the asset level, and sending the matched configuration parameters to the corresponding security product for execution; continuously monitoring asset change events in the cloud platform, and updating the asset level and corresponding security policy configuration when the key characteristics of the asset change. This invention can realize the transformation of cloud asset security protection strategies towards an objective, automated, and dynamically adaptable intelligent mode.

Description

Technical Field

[0001] This invention relates to the field of cloud platform asset security management technology, and in particular to a method for dynamic asset classification and adaptive linkage of security policies. Background Technology

[0002] The widespread adoption of cloud computing technology has led to a gradual migration of enterprise IT infrastructure to cloud platforms. The number and types of cloud assets (such as cloud servers, containers, databases, and load balancers) are continuously increasing, and the differences in asset importance are becoming increasingly significant—core business systems carry critical enterprise data and revenue streams, while testing environments are used only for internal verification. Against this backdrop, how to accurately assess the importance of the massive amounts of assets on cloud platforms and configure differentiated security protection strategies accordingly has become a key issue in the field of cloud security.

[0003] Currently, mainstream cloud service providers' cloud security center products generally adopt the following technical approach for asset importance assessment and security policy configuration: security administrators manually label various assets with tags such as "core," "important," and "normal" based on their own experience, and then manually configure security policies such as vulnerability scanning, intrusion detection, and firewalls based on these tags. Some solutions introduce automatic assessment mechanisms based on computing resource indicators such as CPU core count and memory size, attempting to reduce manual intervention.

[0004] However, existing technical solutions have the following defects and shortcomings:

[0005] First, the assessment is highly subjective and lacks standardized criteria. The assessment of asset importance relies heavily on the personal experience and subjective judgment of administrators. Different administrators may have significantly different perceptions of the same asset, leading to different labeling results from different individuals. This, in turn, causes a resource mismatch problem, such as insufficient protection for high-value assets and excessive protection for low-value assets.

[0006] Second, the assessment dimensions are too narrow, leading to inaccurate results. Some automation solutions judge asset importance solely based on computing resource specifications (such as CPU and memory), failing to incorporate key factors such as business traffic, security status, and configuration compliance. For example, a low-configuration web server carrying core business operations and a high-configuration server used only for internal testing would have their importance ranking significantly different from their actual business value if assessed solely based on computing resources.

[0007] Third, the asset classification results are disconnected from security policy configuration. Even after asset classification is completed, security policy configuration still needs to be done manually by the administrator—setting parameters such as vulnerability scanning frequency, intrusion detection strength, log retention period, and firewall rules for different asset levels. This process involves configuring multiple security products one by one, which is labor-intensive, cumbersome, and prone to configuration omissions or parameter settings errors.

[0008] Fourth, it cannot dynamically adapt to the continuous changes in the cloud environment. The attributes of assets in a cloud platform are not static. Business expansion may lead to specification upgrades, newly bound public IPs may expand network exposure, and security status may change due to vulnerability patching or new attacks. However, in existing solutions, the asset level labels and corresponding security policies remain static once set and cannot be automatically updated with changes in asset attributes. This means that when an asset changes, its actual risk level may misalign with existing protection strategies, creating protection blind spots.

[0009] Chinese patent CN121146917A discloses an information asset management system and a method for assessing the strength of its protection. This solution focuses on access control based on risk levels, without addressing the multi-dimensional importance classification of assets or establishing an automated linkage mechanism between the classification results and the strategies of various security products. Its dynamic adjustment is limited to correcting the sensitivity level and recalculating the vulnerability index based on the frequency of abnormal access. The adjustment trigger condition is singular (based solely on abnormal behavior in the access logs), lacking a comprehensive dynamic response to changes throughout the entire asset lifecycle. Furthermore, it always uses access control as the sole policy implementation point and fails to extend the risk assessment results to a multi-dimensional security protection strategy system in the cloud environment.

[0010] Therefore, how to provide an asset classification and security strategy linkage solution that can objectively, comprehensively, automatically, and dynamically respond to asset changes has become an urgent technical problem to be solved. Summary of the Invention

[0011] In view of this, in order to overcome the shortcomings of the prior art, the present invention aims to provide a method for dynamic asset classification and adaptive linkage of security policies.

[0012] This invention provides a method for dynamic asset classification and adaptive linkage of security policies, the method comprising:

[0013] Step S1: Collect five-dimensional feature data for each asset in the cloud platform. The five-dimensional features include computing resource features, network features, business features, security features, and configuration features.

[0014] Step S2: Use a differentiated normalization strategy to perform normalization processing on the feature data of each dimension of each asset, and assign corresponding weight values ​​to each dimension;

[0015] Step S3: Calculate the weighted composite score of each asset based on the normalized feature values ​​of each dimension and their corresponding weight values, and classify the assets into multiple predetermined asset levels based on the weighted composite score.

[0016] Step S4: Based on the asset classification level, match the policy template corresponding to the level from multiple pre-set security policy templates. The policy template contains configuration parameters of at least one type of security policy. Send the configuration parameters in the matched policy template to the corresponding security product for execution.

[0017] Step S5: Continuously monitor asset change events in the cloud platform. When a change in the key characteristics of an asset is detected, update the asset's level and corresponding security policy configuration.

[0018] Optionally, in the asset dynamic grading and security policy adaptive linkage method of the present invention, in step S1, the computing resource characteristics include the number of CPU cores, memory size, and disk capacity; network characteristics include the number of public Internet Protocol addresses, peak bandwidth, average daily inbound traffic, and average daily outbound traffic; business characteristics include business access volume, i.e., queries per second, and user-defined core business tags; security characteristics include the number of historical vulnerabilities and their highest severity level, whether there have been successful attack records, and the security score given by the cloud security center; configuration characteristics include whether multi-factor authentication is enabled, whether encrypted storage and backup policy levels are enabled.

[0019] Optionally, in the asset dynamic classification and security strategy adaptive linkage method of the present invention, in step S1, five-dimensional feature data is collected in the following manner:

[0020] A data synchronization channel is established with the cloud platform's data source through an interface. The data source records the asset's basic information, operating status, security status, and user-defined attributes.

[0021] Data is acquired using a combination of timed polling and real-time monitoring. Timed polling is executed at predetermined intervals to acquire basic asset information and cumulative statistical data, while real-time monitoring runs continuously to acquire the latest data in real time when asset changes occur.

[0022] Optionally, in the asset dynamic grading and security strategy adaptive linkage method of the present invention, step S2 involves performing normalization processing on the feature data of each dimension of each asset using a differentiated normalization strategy, including:

[0023] For computing resource characteristics, network characteristics, service characteristics, and configuration characteristics, a segmented mapping method is used to map the original values ​​of each dimension to discrete values ​​within a predetermined range.

[0024] For safety features, a deduction system is used for normalization. Based on the severity of the safety risk indicators, the corresponding score is deducted from the baseline score to obtain the normalized feature value.

[0025] Optionally, in the asset dynamic grading and security strategy adaptive linkage method of the present invention, in step S2, in the segmented mapping method, for each feature dimension using segmented mapping, multiple continuous and non-overlapping numerical intervals are pre-defined, and each interval is assigned a fixed mapping value within a unified dimension. When the original feature value of the dimension falls into a certain interval, the mapping value corresponding to that interval is directly taken as the normalization result. In the deduction system method, for security features, a full score benchmark value is first set, and then according to the number and severity of security risk items existing in the asset, the corresponding score is deducted from the full score benchmark value item by item according to the preset deduction rules. The remaining value after deduction is the normalized value of the dimension, and the normalized value is negatively correlated with the degree of asset security risk.

[0026] Optionally, in the asset dynamic grading and security strategy adaptive linkage method of the present invention, in step S2, corresponding weight values ​​are assigned to each dimension in the following manner: a set of default weight values ​​are preset, the sum of the default weight values ​​of each dimension is 1, a weight adjustment interface is opened to users, and users dynamically adjust the weight values ​​of each dimension through the weight adjustment interface according to the current business focus. After the user completes the adjustment, the comprehensive score of all assets is recalculated based on the adjusted weight values.

[0027] Optionally, in the asset dynamic grading and security strategy adaptive linkage method of the present invention, in step S3, the normalized feature values ​​of each dimension of each asset are multiplied by the corresponding weight values ​​of the dimension, and all products are summed to obtain a weighted comprehensive score between 0 and 1; the predetermined multiple asset grades include core asset grade, important asset grade, ordinary asset grade, and test or temporary asset grade, each grade corresponding to a different comprehensive score threshold range, wherein the comprehensive scores corresponding to the core asset grade to the test or temporary asset grade decrease sequentially.

[0028] Optionally, in the asset dynamic classification and security policy adaptive linkage method of the present invention, in step S4, multiple preset security policy templates correspond one-to-one with the multiple asset levels. Each policy template includes the scanning frequency and scanning depth of the vulnerability scanning policy, the detection strength of the intrusion detection policy, the log retention period and collection scope of the log auditing policy, the default action of the firewall or security group policy, and the backup frequency and off-site disaster recovery requirements of the backup policy. In the policy templates corresponding to different asset levels, the configuration parameters of each security policy have different values. The higher the asset level, the higher the protection strength reflected by the corresponding security policy configuration parameters.

[0029] Optionally, in the asset dynamic classification and security policy adaptive linkage method of the present invention, in step S4, the configuration parameters in the matched policy template are distributed to the corresponding security products for execution in the following manner: a policy configuration task is generated according to the matched policy template, and the configuration parameters of various security policies are distributed to the corresponding security products through the unified policy distribution interface of the cloud platform, wherein the vulnerability scanning policy is distributed to the vulnerability scanning engine, the intrusion detection policy is distributed to the host security agent, the log auditing policy is distributed to the log auditing service, the firewall policy is distributed to the cloud firewall service, and the backup policy is distributed to the backup system; after each security product performs the configuration change, it returns the execution result to the system, collects all execution results, and if all are successful, the policy is marked as effective; if there is a failure, the reason for the failure is recorded and an alarm is issued.

[0030] Optionally, in the asset dynamic classification and security policy adaptive linkage method of the present invention, in step S5, the key features of the asset include asset specification expansion and public Internet Protocol address binding. When a change in the key features of the asset is detected, the security policy configuration corresponding to the old level is updated to the security policy configuration corresponding to the new level.

[0031] The asset dynamic classification and security strategy adaptive linkage method of the present invention has the following beneficial technical effects:

[0032] By collecting five-dimensional asset feature data, differentiating and normalizing and weighting, weighted comprehensive scoring and automatic classification, automatically matching and distributing policy templates, and dynamically responding to asset changes, a complete closed-loop process is achieved, transforming asset importance assessment from subjective experience judgment to objective quantitative calculation. At the same time, the classification results are automatically associated with policy configurations without manual intervention, significantly improving the automation level and response efficiency of cloud security management, and ensuring the consistency between protection policies and the real-time status of assets. Attached Figure Description

[0033] To more clearly illustrate the technical solutions of the embodiments of the present invention, the drawings used in the embodiments will be briefly introduced below. Obviously, the drawings described below are only some embodiments of the present invention. For those skilled in the art, other drawings can be obtained based on these drawings without creative effort.

[0034] Figure 1 This is a flowchart illustrating the asset dynamic classification and security policy adaptive linkage method according to an exemplary embodiment of the present invention.

[0035] Figure 2 A flowchart illustrating the process of collecting five-dimensional feature data for the asset dynamic classification and security strategy adaptive linkage method according to an exemplary embodiment of the present invention;

[0036] Figure 3A schematic diagram illustrating the process of differential normalization for the asset dynamic classification and security policy adaptive linkage method according to an exemplary embodiment of the present invention;

[0037] Figure 4 A schematic diagram illustrating the process of segmented mapping and point deduction system for the asset dynamic classification and security policy adaptive linkage method according to an exemplary embodiment of the present invention;

[0038] Figure 5 This is a flowchart illustrating the weight allocation and dynamic adjustment process of the asset dynamic classification and security strategy adaptive linkage method according to an exemplary implementation 1 of the present invention.

[0039] Figure 6 This is a flowchart illustrating the process of issuing and executing policy configuration parameters for the asset dynamic classification and security policy adaptive linkage method according to an exemplary implementation 1 of the present invention.

[0040] Figure 7 This is a flowchart illustrating the asset change monitoring and policy update process of the asset dynamic classification and security policy adaptive linkage method according to an exemplary embodiment of the present invention. Detailed Implementation

[0041] The embodiments of the present invention will now be described in detail with reference to the accompanying drawings.

[0042] It should be noted that, in the absence of conflict, the following embodiments and features can be combined with each other; and, based on the embodiments of this disclosure, all other embodiments obtained by those skilled in the art without creative effort are within the scope of protection of this disclosure.

[0043] It should be noted that various aspects of embodiments within the scope of the appended claims are described below. It will be apparent that the aspects described herein can be embodied in a wide variety of forms, and any particular structure and / or function described herein is merely illustrative. Based on this disclosure, those skilled in the art will understand that one aspect described herein can be implemented independently of any other aspect, and two or more of these aspects can be combined in various ways. For example, any number of aspects set forth herein can be used to implement the device and / or practice the method. Additionally, this device and / or method can be implemented using structures and / or functionalities other than one or more of the aspects set forth herein.

[0044] Example

[0045] An exemplary embodiment of the present invention provides a method for dynamic asset classification and adaptive linkage of security policies. Figure 1 This is a flowchart illustrating the asset dynamic grading and security policy adaptive linkage method according to an exemplary embodiment of the present invention, as shown below. Figure 1As shown, in this embodiment, the method of the present invention is implemented in the following manner:

[0046] Step S1: Collect five-dimensional feature data for each asset in the cloud platform. The five-dimensional features include computing resource features, network features, business features, security features, and configuration features.

[0047] In this embodiment, computing resource characteristics include the number of CPU cores, memory size, and disk capacity; network characteristics include the number of public Internet Protocol addresses, peak bandwidth, average daily inbound traffic, and average daily outbound traffic; business characteristics include business access volume (queries per second) and user-defined core business tags; security characteristics include the number of historical vulnerabilities and their highest severity level, whether there have been successful attack records, and the security score given by the cloud security center; configuration characteristics include whether multi-factor authentication is enabled, whether encrypted storage and backup policy levels are enabled.

[0048] This embodiment defines the specific components of five major features: computing resources, network, business, security, and configuration. This ensures that asset feature collection has a clear and comprehensive data source, covers key factors affecting asset importance, avoids evaluation bias caused by missing feature dimensions, and provides a sufficient and accurate data foundation for subsequent normalization processing and comprehensive scoring.

[0049] Figure 2 This is a flowchart illustrating the process of collecting five-dimensional feature data for the asset dynamic grading and security policy adaptive linkage method according to an exemplary embodiment of the present invention, as shown below. Figure 2 In this embodiment, five-dimensional feature data is collected in the following manner: a data synchronization channel is established with the data source of the cloud platform through an interface. The data source records the basic information, operating status, security status and user-defined attributes of the asset; data is obtained by combining timed polling and real-time monitoring. The timed polling is executed according to a predetermined cycle to obtain the basic information and cumulative statistical data of the asset, while the real-time monitoring runs continuously to obtain the latest data in real time when the asset changes.

[0050] This embodiment employs a data acquisition method that combines timed polling with real-time monitoring. This approach not only ensures the integrity and periodicity of data by stably acquiring basic asset information and accumulated statistical data through timed polling, but also allows for the immediate acquisition of the latest data when asset changes occur through real-time monitoring, guaranteeing zero-delay awareness of critical changes. Thus, a balance is achieved between the integrity and real-time performance of data acquisition.

[0051] Step S2: Use a differentiated normalization strategy to perform normalization processing on the feature data of each dimension of each asset, and assign corresponding weight values ​​to each dimension.

[0052] Figure 3This is a schematic diagram illustrating the process of differential normalization in the asset dynamic grading and security policy adaptive linkage method according to an exemplary embodiment of the present invention, as shown below. Figure 3 As shown in this embodiment, a differentiated normalization strategy is used to perform normalization processing on the feature data of each dimension of each asset. For computing resource features, network features, business features and configuration features, a segmented mapping method is used to map the original values ​​of each dimension to discrete values ​​within a predetermined range. For security features, a deduction system is used for normalization. The corresponding score is deducted from the benchmark score according to the severity of the security risk indicator to obtain the normalized feature value.

[0053] Figure 4 This is a flowchart illustrating the segmented mapping and point deduction system of the asset dynamic grading and security policy adaptive linkage method according to an exemplary embodiment of the present invention, as shown below. Figure 4 As shown, in the segmented mapping method, for each feature dimension using segmented mapping, multiple continuous and non-overlapping numerical intervals are pre-defined, and each interval is assigned a fixed mapping value within a uniform dimension. When the original feature value of a dimension falls into a certain interval, the mapping value corresponding to that interval is directly taken as the normalization result. For example, for the number of CPU cores, 0.2 is mapped to 4 cores or less, 0.5 to 8 cores, 0.8 to 16 cores, and 1.0 to more than 16 cores. Other dimensions can also use similar segmented logic.

[0054] In the point deduction system, a maximum score baseline is first set for each security feature. Then, based on the number and severity of security risks present in the asset, points are deducted from the baseline item by item according to pre-defined deduction rules. The remaining value after deduction is the normalized value for that dimension, and this normalized value is negatively correlated with the asset's security risk level. For example, the more high-risk vulnerabilities, the lower the score: 0 vulnerabilities = 1.0 point, 1 to 2 = 0.8 points, 3 to 5 = 0.5 points, and more than 5 = 0.2 points. A successful attack record is immediately reduced to 0.3 points, while no record results in 1.0 point. The security score is then directly divided by 100 to convert it to a number between 0 and 1.

[0055] This embodiment effectively improves the rationality and accuracy of the normalization results by adopting differentiated normalization strategies for different categories of features. This makes the normalization process clear, operable, and reproducible, ensuring that the normalization results of different assets on the same dimension are comparable.

[0056] Figure 5 This is a flowchart illustrating the weight allocation and dynamic adjustment process of the asset dynamic classification and security strategy adaptive linkage method according to an exemplary embodiment 1 of the present invention, as shown below. Figure 5As shown, in this embodiment, the corresponding weight values ​​are assigned to each dimension in the following manner: a set of default weight values ​​are preset, the sum of the default weight values ​​of each dimension is 1, a weight adjustment interface is opened to users, and users can dynamically adjust the weight values ​​of each dimension according to the current business focus through the weight adjustment interface. After the user has finished adjusting, the comprehensive score of all assets is recalculated based on the adjusted weight values.

[0057] For example, a default weighting is set as follows: business characteristics account for 35% (because business importance is a core consideration), security characteristics account for 25% (security status reflects the risk level of an asset), network characteristics account for 20% (the larger the network exposure, the higher the risk), computing resource characteristics account for 10%, and configuration characteristics account for 10%. The sum of all weights is 1. A weight adjustment function is made available to users. Users can manually adjust the weight values ​​of each dimension in the console. After the user adjusts the weights, the system recalculates the scores for all assets.

[0058] This embodiment combines preset default weight values ​​with an interface for users to adjust weights. On the one hand, the default weight values ​​lower the barrier to entry for users, ensuring that the system is ready to use out of the box. On the other hand, it allows users to flexibly adjust the weight ratio of each dimension according to their own business focus. Furthermore, after the user makes the adjustment, the overall score of all assets is recalculated immediately, realizing dynamic updates of weight configuration and real-time linkage of evaluation results.

[0059] Step S3: Calculate the weighted composite score of each asset based on the normalized feature values ​​of each dimension and their corresponding weight values, and classify the assets into multiple predetermined asset levels based on the weighted composite score.

[0060] In this embodiment, the normalized feature values ​​of each asset are multiplied by the corresponding weight values ​​of the dimension, and all products are summed to obtain a weighted comprehensive score between 0 and 1. The predetermined multiple asset levels include core asset level, important asset level, ordinary asset level, and test or temporary asset level. Each level corresponds to a different comprehensive score threshold range, with the comprehensive scores decreasing sequentially from core asset level to test or temporary asset level.

[0061] For example, assets with a weighted composite score of not less than 0.8 are core assets, those with a weighted composite score between 0.6 and 0.8 are important assets, those with a weighted composite score between 0.4 and 0.6 are ordinary assets, and those with a weighted composite score less than 0.4 are test / temporary assets.

[0062] By weighting and summing the normalized feature values ​​with their corresponding weight values, a comprehensive score between 0 and 1 is obtained. Based on this score, assets are divided into four levels: core, important, ordinary, and test or temporary. This gives the asset classification results a clear mathematical basis and a continuously divisible quantitative standard, eliminating the subjectivity and arbitrariness of manual classification. At the same time, the four-level classification granularity is appropriate, which can effectively distinguish assets of different importance levels without increasing the complexity of strategy management due to overly fine classification.

[0063] Step S4: Based on the asset classification level, match the policy template corresponding to the level from multiple pre-set security policy templates. The policy template contains configuration parameters of at least one type of security policy. Send the configuration parameters in the matched policy template to the corresponding security product for execution.

[0064] In this embodiment, multiple pre-set security policy templates correspond one-to-one with the multiple asset levels. Each policy template includes the scanning frequency and scanning depth of the vulnerability scanning policy, the detection strength of the intrusion detection policy, the log retention period and collection scope of the log auditing policy, the default actions of the firewall or security group policy, and the backup frequency and off-site disaster recovery requirements of the backup policy. In the policy templates corresponding to different asset levels, the configuration parameters of each security policy have different values. The higher the asset level, the higher the protection strength reflected by the corresponding security policy configuration parameters.

[0065] This embodiment maps pre-set security policy templates to asset levels one-to-one, with each template covering complete configuration parameters for five major policy categories: vulnerability scanning, intrusion detection, log auditing, firewall or security group, and backup. This allows assets of different levels to automatically receive differentiated protection strengths that match their importance. In other words, the higher the asset level, the higher the protection strength reflected by the corresponding security policy configuration parameters. This enables precise deployment and on-demand configuration of security resources, avoiding the problems of over-protection of low-level assets and under-protection of high-level assets.

[0066] Figure 6 This is a schematic diagram illustrating the process of issuing and executing policy configuration parameters according to the asset dynamic classification and security policy adaptive linkage method of Exemplary Implementation 1 of the present invention, as follows: Figure 6As shown, in this embodiment, the configuration parameters in the matched policy template are distributed to the corresponding security products for execution in the following manner: A policy configuration task is generated based on the matched policy template. Through the unified policy distribution interface of the cloud platform, the configuration parameters of various security policies are distributed to the corresponding security products. Specifically, vulnerability scanning policies are distributed to the vulnerability scanning engine, intrusion detection policies to the host security agent, log auditing policies to the log auditing service, firewall policies to the cloud firewall service, and backup policies to the backup system. After each security product executes the configuration change, it returns the execution result to the system. All execution results are collected. If all are successful, the policy is marked as effective. If any fail, the reason for the failure is recorded and an alarm is issued. This achieves closed-loop management of the entire policy distribution and execution chain, ensuring the integrity and traceability of policy configuration, and enabling administrators to promptly detect and handle policy distribution anomalies.

[0067] Step S5: Continuously monitor asset change events in the cloud platform. When a change in the key characteristics of an asset is detected, update the asset's level and corresponding security policy configuration.

[0068] Figure 7 This is a flowchart illustrating the asset change monitoring and policy update process of the asset dynamic classification and security policy adaptive linkage method according to an exemplary embodiment of the present invention, as follows: Figure 7 As shown in this embodiment, the key features of the asset include asset specification expansion and public Internet Protocol address binding. When a change in the key features of the asset is detected, the security policy configuration corresponding to the old level is updated to the security policy configuration corresponding to the new level.

[0069] This embodiment continuously monitors changes in key features such as asset specification expansion and public Internet Protocol address binding. When an asset changes, it automatically triggers a reassessment of the security level. After the level changes, it automatically updates the security policy configuration corresponding to the old level to the security policy configuration corresponding to the new level. This achieves dynamic adaptation between asset level and protection policy, ensuring that the security policy evolves in real time with changes in asset status, and eliminating protection blind spots and policy lag caused by asset changes.

[0070] Through the above description of the embodiments, those skilled in the art can clearly understand that each embodiment can be implemented by means of software plus necessary general-purpose hardware platforms, and of course, it can also be implemented by hardware. Based on this understanding, the above technical solutions, in essence or the part that contributes to the prior art, can be embodied in the form of a software product. This computer software product can be stored in a computer-readable storage medium, such as ROM / RAM, magnetic disk, optical disk, etc., including several instructions to cause a computer device (which may be a personal computer, server, or network device, etc.) to execute the methods of various embodiments or some parts of embodiments.

[0071] The above description is merely a specific embodiment of the present invention, but the scope of protection of the present invention is not limited thereto. Any variations or substitutions that can be easily conceived by those skilled in the art within the technical scope disclosed in the present invention should be included within the scope of protection of the present invention. Therefore, the scope of protection of the present invention should be determined by the scope of the claims.

Claims

1. A method for dynamic asset grading and adaptive linkage of security strategies, characterized in that, The method includes: Step S1: Collect five-dimensional feature data for each asset in the cloud platform. The five-dimensional features include computing resource features, network features, business features, security features, and configuration features. Step S2: Use a differentiated normalization strategy to perform normalization processing on the feature data of each dimension of each asset, and assign corresponding weight values ​​to each dimension; Step S3: Calculate the weighted composite score of each asset based on the normalized feature values ​​of each dimension and their corresponding weight values, and classify the assets into multiple predetermined asset levels based on the weighted composite score. Step S4: Based on the asset classification level, match the policy template corresponding to the level from multiple pre-set security policy templates. The policy template contains configuration parameters of at least one type of security policy. Send the configuration parameters in the matched policy template to the corresponding security product for execution. Step S5: Continuously monitor asset change events in the cloud platform. When a change in the key characteristics of an asset is detected, update the asset's level and corresponding security policy configuration.

2. The asset dynamic grading and security strategy adaptive linkage method according to claim 1, characterized in that, In step S1, the computing resource characteristics include the number of CPU cores, memory size, and disk capacity; Network characteristics include the number of public Internet Protocol addresses, peak bandwidth, average daily inbound traffic, and average daily outbound traffic; business characteristics include business access volume (queries per second) and user-defined core business tags. Security features include the number of historical vulnerabilities and their highest severity level, whether there have been successful attack records, and the security score given by the cloud security center; Configuration features include whether to enable multi-factor authentication, whether to enable encrypted storage, and backup policy levels.

3. The asset dynamic grading and security strategy adaptive linkage method according to claim 1, characterized in that, In step S1, five-dimensional feature data are collected in the following manner: A data synchronization channel is established with the cloud platform's data source through an interface. The data source records the asset's basic information, operating status, security status, and user-defined attributes. Data is acquired using a combination of timed polling and real-time monitoring. Timed polling is executed at predetermined intervals to acquire basic asset information and cumulative statistical data, while real-time monitoring runs continuously to acquire the latest data in real time when asset changes occur.

4. The asset dynamic grading and security strategy adaptive linkage method according to claim 1, characterized in that, In step S2, a differentiated normalization strategy is used to perform normalization processing on the feature data of each dimension of each asset, including: For computing resource characteristics, network characteristics, service characteristics, and configuration characteristics, a segmented mapping method is used to map the original values ​​of each dimension to discrete values ​​within a predetermined range. For safety features, a deduction system is used for normalization. Based on the severity of the safety risk indicators, the corresponding score is deducted from the baseline score to obtain the normalized feature value.

5. The asset dynamic grading and security strategy adaptive linkage method according to claim 4, characterized in that, In step S2, in the segmented mapping method, for each feature dimension using segmented mapping, multiple continuous and non-overlapping numerical intervals are pre-defined, and each interval is assigned a fixed mapping value within a unified dimension. When the original feature value of the dimension falls into a certain interval, the mapping value corresponding to that interval is directly taken as the normalization result. In the deduction system method, for security features, a full score benchmark value is first set, and then according to the number and severity of security risk items existing in the asset, the corresponding score is deducted from the full score benchmark value item by item according to the preset deduction rules. The remaining value after deduction is the normalized value of the dimension, and the normalized value is negatively correlated with the degree of asset security risk.

6. The asset dynamic grading and security strategy adaptive linkage method according to claim 1, characterized in that, In step S2, the corresponding weight values ​​are assigned to each dimension in the following manner: a set of default weight values ​​are preset, the sum of the default weight values ​​of each dimension is 1, the weight adjustment interface is opened to users, and users can dynamically adjust the weight values ​​of each dimension according to the current business focus through the weight adjustment interface. After the user has finished adjusting, the comprehensive score of all assets is recalculated based on the adjusted weight values.

7. The asset dynamic grading and security strategy adaptive linkage method according to claim 1, characterized in that, In step S3, the normalized feature values ​​of each dimension of each asset are multiplied by the corresponding weight values ​​of the dimension, and all products are summed to obtain a weighted comprehensive score between 0 and 1. The predetermined multiple asset levels include core asset level, important asset level, ordinary asset level, and test or temporary asset level. Each level corresponds to a different comprehensive score threshold range, with the comprehensive scores decreasing sequentially from core asset level to test or temporary asset level.

8. The asset dynamic grading and security strategy adaptive linkage method according to claim 1, characterized in that, In step S4, multiple pre-set security policy templates correspond one-to-one with the multiple asset levels. Each policy template includes the scanning frequency and scanning depth of the vulnerability scanning policy, the detection strength of the intrusion detection policy, the log retention period and collection scope of the log auditing policy, the default actions of the firewall or security group policy, and the backup frequency and off-site disaster recovery requirements of the backup policy. In the policy templates corresponding to different asset levels, the configuration parameters of each security policy have different values. The higher the asset level, the higher the protection strength reflected by the corresponding security policy configuration parameters.

9. The asset dynamic grading and security strategy adaptive linkage method according to claim 1, characterized in that, In step S4, the configuration parameters in the matched policy template are distributed to the corresponding security products for execution in the following manner: A policy configuration task is generated based on the matched policy template. Through the unified policy distribution interface of the cloud platform, the configuration parameters of various security policies are distributed to the corresponding security products. Specifically, the vulnerability scanning policy is distributed to the vulnerability scanning engine, the intrusion detection policy to the host security agent, the log auditing policy to the log auditing service, the firewall policy to the cloud firewall service, and the backup policy to the backup system. Each security product returns the execution result to the system after executing the configuration change. All execution results are collected. If all are successful, the policy is marked as effective. If any fail, the reason for the failure is recorded and an alarm is issued.

10. The asset dynamic grading and security strategy adaptive linkage method according to claim 1, characterized in that, In step S5, the key features of the asset include asset specification expansion and public Internet Protocol address binding. When a change in the key features of the asset is detected, the security policy configuration corresponding to the old level is updated to the security policy configuration corresponding to the new level.

Images