Network security protection method, device, equipment, medium and program product

Abstract

The application relates to a network security protection method, device, equipment, medium and product. The method comprises the following steps: generating a plurality of event records based on boundary security event data and internal network security event data, each event record comprising an event subject identifier, a target object identifier, an event occurrence time, an access path and a business behavior feature; performing correlation analysis on the event records to obtain a correlation event set of a target access subject, the correlation event set comprising event records associated with the target access subject; determining an access risk feature based on the correlation event set, and obtaining a comprehensive risk value according to the access risk feature, wherein the access risk feature comprises a boundary side threat score of the target access subject, an internal network side anomaly score, a subject trust degree and a behavior deviation value; determining a protection strategy based on the comprehensive risk value, the boundary side threat score and the internal network side anomaly score, and performing network security protection processing according to the protection strategy. The method can improve network security.

Description

Technical Field

[0001] This application relates to the field of network security technology, and in particular to a network security protection method, apparatus, computer equipment, computer-readable storage medium, and computer program product. Background Technology

[0002] With the rapid development of digital power grid services, most network security protection systems are centered on perimeter security devices, primarily relying on firewalls and access control lists to intercept and control external access. Meanwhile, the internal network typically employs endpoint protection, log auditing, traffic monitoring, or situational awareness for localized detection. This means that perimeter security devices are mainly used for access control and attack interception, supplemented by internal network endpoint protection, log auditing, traffic monitoring, or situational awareness technologies for localized security detection. However, the response between perimeter protection and internal network protection in these technologies is prone to disconnect, affecting the effectiveness of protection and impacting network security. Summary of the Invention

[0003] Therefore, it is necessary to provide a network security protection method, device, computer equipment, computer-readable storage medium, and computer program product that can improve network security in response to the above-mentioned technical problems.

[0004] Firstly, this application provides a network security protection method, including:

[0005] Acquire boundary security event data collected by boundary security devices deployed at the intranet network boundary, and intranet security event data collected by intranet security devices deployed on the intranet;

[0006] Multiple event records are generated based on boundary security event data and intranet security event data. Each event record includes the event subject identifier, target object identifier, event occurrence time, access path, and business behavior characteristics.

[0007] The event records are correlated to obtain the set of associated events of the target access subject. The set of associated events includes at least one event record associated with the target access subject.

[0008] Access risk characteristics are determined based on the set of related events, and a comprehensive risk value of the target access subject is obtained based on the access risk characteristics. The access risk characteristics include the target access subject's boundary-side threat score, intranet-side anomaly score, subject trust level, and behavioral deviation value.

[0009] Based on the comprehensive risk value, the threat score at the boundary, and the anomaly score at the internal network, a protection strategy is determined, and network security protection is carried out in accordance with the protection strategy.

[0010] Secondly, this application also provides a network security protection device, including:

[0011] The event data acquisition module is used to acquire boundary security event data collected by boundary security devices deployed at the intranet network boundary, as well as intranet security event data collected by intranet security devices deployed on the intranet.

[0012] The event log generation module is used to generate multiple event logs based on boundary security event data and intranet security event data. Each event log includes the event subject identifier, target object identifier, event occurrence time, access path, and business behavior characteristics.

[0013] The event association module is used to perform association analysis on each event record to obtain the associated event set of the target access subject. The associated event set includes at least one event record associated with the target access subject.

[0014] The risk value determination module is used to determine access risk characteristics based on the set of related events, and to obtain the comprehensive risk value of the target access subject based on the access risk characteristics. The access risk characteristics include the target access subject's boundary-side threat score, intranet-side anomaly score, subject trust level, and behavioral deviation value.

[0015] The protection policy execution module is used to determine protection policies based on comprehensive risk values, edge-side threat scores, and internal network anomaly scores, and to perform network security protection processing according to the protection policies.

[0016] Thirdly, this application also provides a computer device, including a memory and a processor, wherein the memory stores a computer program, and the processor executes the computer program to implement the steps in the method provided in the first aspect above.

[0017] Fourthly, this application also provides a computer-readable storage medium having a computer program stored thereon, which, when executed by a processor, implements the steps of the method provided in the first aspect above.

[0018] Fifthly, this application also provides a computer program product, including a computer program that, when executed by a processor, implements the steps in the method provided in the first aspect above.

[0019] The aforementioned network security protection methods, devices, computer equipment, computer-readable storage media, and computer program products acquire boundary security event data collected by boundary security devices and intranet security event data collected by intranet security devices. Based on the boundary security event data and intranet security event data, they generate event records containing event subject identifiers, target object identifiers, event occurrence times, access paths, and business behavior characteristics. By performing correlation analysis on the event records, they obtain a set of associated events for the target access subject. This set of associated events unifies the originally scattered boundary events and intranet events under the same subject, realizing the correlation of cross-regional events. By identifying boundary-side threat scores, intranet-side anomaly scores, subject trust levels, and behavioral deviation values ​​as access risk characteristics, a comprehensive risk value is obtained. This allows risk assessment to simultaneously cover multiple dimensions, including boundary threats, intranet anomalies, subject trust levels, and behavioral deviations. Based on the comprehensive risk value, boundary-side threat scores, and intranet-side anomaly scores, protection strategies are jointly determined and implemented. This ensures that the generation of protection strategies no longer relies solely on information from the boundary or intranet alone, but rather integrates the risk levels from both sides. This allows protection strategies to more accurately reflect the actual situation and stage of the current attack, thereby improving the targeting and effectiveness of network security protection and ultimately enhancing network security. Attached Figure Description

[0020] To more clearly illustrate the technical solutions in the embodiments of this application or related technologies, the drawings used in the description of the embodiments of this application or related technologies will be briefly introduced below. Obviously, the drawings described below are only some embodiments of this application. For those skilled in the art, other related drawings can be obtained based on these drawings without creative effort.

[0021] Figure 1 This is a flowchart illustrating a network security protection method in one embodiment;

[0022] Figure 2 This is a flowchart illustrating the process of determining the overall risk value in one embodiment;

[0023] Figure 3 This is a schematic diagram of the overall architecture of the coordinated defense system in one embodiment;

[0024] Figure 4 This is a flowchart illustrating a network security protection method in another embodiment;

[0025] Figure 5 This is a schematic diagram of the protection process in one embodiment when an attacker breaches the boundary;

[0026] Figure 6 This is a schematic diagram of the protection process in one embodiment when the attacker has not yet entered the internal network;

[0027] Figure 7 This is a structural block diagram of a network security protection device in one embodiment;

[0028] Figure 8 This is an internal structural diagram of a computer device in one embodiment. Detailed Implementation

[0029] To make the objectives, technical solutions, and advantages of this application clearer, the following detailed description is provided in conjunction with the accompanying drawings and embodiments. It should be understood that the specific embodiments described herein are merely illustrative and not intended to limit the scope of this application.

[0030] It should be noted that the terms "first," "second," etc., used in this application can be used to describe various elements, but these elements are not limited by these terms. These terms are only used to distinguish the first element from the second element. The terms "comprising" and "having," and any variations thereof, used in this application, are intended to cover non-exclusive inclusion. The term "multiple" used in this application refers to two or more. The term "and / or" used in this application refers to one of the embodiments, or any combination of multiple embodiments.

[0031] In one exemplary embodiment, such as Figure 1 As shown, a network security protection method is provided. Taking the application of this method to a server as an example, the server can be an independent physical server, a server cluster or distributed system composed of multiple physical servers, or a cloud server providing cloud computing services, including the following steps 102 to 110. Wherein:

[0032] Step 102: Obtain boundary security event data collected by boundary security devices deployed at the intranet network boundary, and intranet security event data collected by intranet security devices deployed on the intranet.

[0033] The internal network (IVN) refers to the protected internal network environment, typically including office terminals, business servers, databases, application systems, and the east-west communication network between them. The IVN is the primary area where attackers can continue to move laterally and spread their penetration after breaching the boundary. The IVN network boundary is the logical or physical dividing point between the IVN and external networks, such as the internet or partner networks. Boundary security devices are typically deployed at the IVN boundary to detect, filter, and block traffic entering and leaving the IVN. Boundary security devices are security devices deployed between the external and internal networks to detect, filter, block, or control access traffic, including firewalls, WAFs (Web Application Firewalls), and intrusion prevention devices. Boundary security devices are used to identify external attacks, block abnormal access, and coordinate with IVN security devices to perform collaborative defense. Boundary security event data is the information recorded by boundary security devices when they detect anomalies or potential threats. Boundary security event data may include, but is not limited to, the time of the event, the attack source IP (Internet Protocol) address, the target IP address, the access port, the protocol type, the alarm type, the threat level, and specific payload characteristics.

[0034] Internal network security devices refer to security protection or monitoring equipment deployed within an internal network, including endpoint security agents, log auditing devices, internal network traffic monitoring devices, and situational awareness platforms. These devices are used to detect abnormal endpoint behavior, lateral movement, abnormal business access, and other internal threat behaviors. Internal network security event data are information records generated by internal network security devices when they detect abnormal activity within the internal network. This data is a digital description of internal network behavior and is a key source of information for discovering advanced threats such as lateral movement, credential theft, and abnormal business behavior. Internal network security event data may include, but is not limited to, the time of the event, initiating entity information, target object information, behavior type, access path, business call interface, and description of abnormal characteristics.

[0035] Optionally, the server can establish a data receiving channel with boundary security devices deployed at the intranet network boundary, such as firewalls, WAFs, or intrusion prevention systems. During real-time monitoring of traffic entering and leaving the intranet, the boundary security devices generate corresponding boundary security event data upon detecting suspicious behavior such as external scanning, attack probing, or abnormal connection requests. The server can proactively request or retrieve boundary security event data from the boundary security devices through standardized log collection protocols, such as Syslog (System Log) or SNMPTrap (Simple Network Management Protocol Trap), or by calling the API (Application Programming Interface) provided by the devices. It can also passively receive boundary security event data proactively pushed by the boundary security devices. The server can also establish communication connections with intranet security devices deployed within the intranet, such as endpoint security agents, network traffic probes, log auditing systems, or situational awareness platforms. These intranet security devices can continuously monitor endpoint behavior, east-west network traffic, business access logs, and user authentication activities. When internal network security devices detect lateral movement, abnormal logins, abnormal service calls, or internal penetration activities, they also generate corresponding internal network security event data. Servers can obtain internal network security event data from internal network security devices through the same or different standardized interfaces.

[0036] For example, in the complex network of a digital power grid, servers can acquire boundary security event data. For instance, a next-generation firewall deployed at the network boundary of a power dispatch center might detect high-frequency port scanning of an internal SCADA (Supervisory Control and Data Acquisition) server from an external IP address, generating an alarm log containing the source IP address, target IP address, scanned port range, and timestamp. Simultaneously, servers can acquire intranet security event data. For example, a log auditing system deployed on the dispatch center's intranet might detect an operations and maintenance terminal attempting to log in to another core business server using an unauthorized account outside of working hours, generating an abnormal login log containing the hostname, source account, target server, login time, and login result. The server, through its log collection module, can simultaneously acquire these two security event data points from different devices and scenarios.

[0037] Step 104: Generate multiple event records based on boundary security event data and intranet security event data. Each event record includes the event subject identifier, target object identifier, event occurrence time, access path, and business behavior characteristics.

[0038] Event logs are structured data units generated by the server after acquiring perimeter security event data and intranet security event data, and then undergoing standardized processing. An event log can be a single text or binary data entry containing multiple fields, such as a record in JSON (JavaScript Object Notation), XML (Extensible Markup Language), or a database table. Each event log contains at least five core fields: event subject identifier, target object identifier, event occurrence time, access path, and business behavior characteristics.

[0039] The event subject identifier uniquely identifies the entity initiating the access or action. This identifier can be an IP address, MAC (Media Access Control) address, user account, device ID, session ID, or an identifier composed of multiple attributes. The event subject identifier can be directly extracted from raw security event data, such as from the source IP field of firewall logs, the login username of operating system logs, or the device identifier of a terminal agent. The target object identifier uniquely identifies the object being accessed, attacked, or manipulated. This identifier can be a target IP address, target hostname, resource URL (Uniform Resource Locator), service port, file path, database table name, etc. The target object identifier indicates the recipient of the current action in the event record, and together with the event subject identifier, constitutes a complete access relationship. The event occurrence time is a field that records the moment the event occurred. It can be represented as a timestamp, such as a Unix timestamp, an ISO 8601 (International Organization for Standardization 8601) string, or a database datetime type. The access path is a field describing the communication relationship or access link in the event. The access path can include the source address, destination address, protocol, port, network zone identifier (such as "external → DMZ (Demilitarized Zone) → internal network"), or intermediate nodes traversed. The business behavior characteristic is a field describing the specific business operation or behavior type involved in the event. The business behavior characteristic can be an enumeration value or a category label, such as "port scan," "abnormal login," "lateral access," "high-risk business call," "file download," "permission change," etc., or it can include more granular information such as "call interface name," "request parameter length," and "return code."

[0040] For example, the server can map each border security event data and intranet security event data into an event record with a unified format. In some embodiments, the server can extract the event subject identifier, target object identifier, event occurrence time, access path, and business behavior characteristics from the border security event data and intranet security event data according to preset field mapping rules. For example, for a firewall log, the server can use the source IP as the event subject identifier, the destination IP as the target object identifier, and the log timestamp as the event occurrence time, concatenate "source IP-destination IP-protocol-port" to form the access path, and classify it into business behavior characteristics such as "port scan" and "abnormal connection" according to the action type (such as "deny" or "allow") and whether an alarm rule is triggered. For intranet logs, the server can use the login account as the event subject identifier, the logged-in server IP as the target object identifier, extract the login time, represent the access path as "client IP → server IP", and mark login failure events as "abnormal login". After such processing, the border security event data and intranet security event data become event records with a unified set of five fields.

[0041] If a piece of raw data (border security event data or intranet security event data) contains multiple targets or multiple actions, the server can split it into multiple event records, each containing only a single subject-target pair. For example, a firewall log containing multiple scan targets can have the server generate an independent event record for each target. Each record will have the same event subject identifier, but different target object identifiers. The events will all occur at the same time, but the access paths will point to different targets, and the business behavior characteristic will all be "scanning." During the event record generation process, the server can also clean and supplement fields, such as resolving client IPs to device IDs or supplementing geographical location information using an address database.

[0042] Step 106: Perform correlation analysis on each event record to obtain the associated event set of the target access subject. The associated event set includes at least one event record associated with the target access subject.

[0043] Correlation analysis involves processing security event records from different sources and time points to uncover their inherent logical connections. The object of correlation analysis is the event record, each containing multi-dimensional information such as the event subject identifier, target object identifier, event occurrence time, access path, and business behavior characteristics. Correlation analysis can aggregate previously isolated and discrete boundary security events and internal network security events according to preset correlation rules, identifying which events may belong to the same behavioral sequence or attack activity, thereby breaking down data silos.

[0044] A target access subject is a logical entity identified as the core executor of a series of security events after correlation analysis. This logical entity does not refer to a specific physical device or user account, but rather an abstract behavioral subject based on the subject identifier in the event logs. A target access subject can be an IP address, user account, terminal device MAC address, hostname, or session identifier, etc. For example, in an attack scenario, an attacker first uses a stolen user account (admin) to log in to the internal network, and the internal network proxy collects the login events of this account. Subsequently, the attacker initiates lateral movement to multiple servers using the admin account, and the internal network traffic probe collects these lateral movement events. During correlation analysis, the server can associate these events based on the same subject identifier (admin account) and identify the admin account as the target access subject. At this point, the server's subsequent risk calculations and generated policies are all targeted at this admin account, even if the account may have been compromised.

[0045] A correlated event set is a collection of at least one event record related to the same target user, generated after performing correlation analysis on event records. A correlated event set can include a list or data group consisting of multiple event records, where each event record contains complete behavioral information of the target user at a specific time and location. Correlated event sets can provide risk assessment with a complete behavioral trajectory of the target user, enabling risk assessment to be based on a sequence of behaviors rather than a single event, thus allowing for a more accurate determination of the attack's stage and intent.

[0046] Optionally, the server can iterate through all event records to be analyzed and check whether there is a correlation between any two or more event records according to preset association conditions. Preset association conditions may include identical subject identifiers or shared origin characteristics, event occurrence time differences less than a preset time window, a continuous relationship between access paths or target object identifiers, and at least one event record containing abnormal characteristics. When the server detects that at least two event records meet the association conditions, it can determine that these event records are associated with the same target access subject, which can be identified through association analysis logic. For example, if two event records have the same subject identifier, the server can use that subject identifier as the target access subject; if two records have different subject identifiers but shared origin characteristics, the server can create a new abstract identifier as the target access subject and associate these two records with that identifier. The server can aggregate the event records determined to be associated to form an associated event set. This associated event set is a logical data collection, which can be stored as an index, linked list, or temporary data table pointing to these event records.

[0047] For example, if the server obtains the following two event records: Event Record 1: Subject identifier is "Source IP 192.168.1.100", target identifier is "External Server A", time is 10:00:00, access path is "Internet to Border Firewall", and business behavior characteristic is "Port Scan". Event Record 2: Subject identifier is "Source IP 192.168.1.100", target identifier is "Internal Server B", time is 10:03:00, access path is "Internal Switch to Server B", and business behavior characteristic is "Abnormal Login Attempt". The server can detect that the subject identifier of these two event records is "192.168.1.100", which satisfies the condition of identical subject identifier. The server can check the time difference; the time difference between 10:00:00 and 10:03:00 is 3 minutes, which is less than the preset 5-minute time window, thus satisfying the condition. The server can check the access path; although the targets are different, considering that the attacker may attempt to log in immediately after scanning, it can be considered that there is logical continuity. The server can determine that both event records contain abnormal characteristics (scanning and abnormal login). Based on this, the server can determine that these two event records are associated with the same target access subject, namely "IP 192.168.1.100", and generate an associated event set containing these two event records.

[0048] In some embodiments, the server can sort event records chronologically to facilitate time window detection. The server can also create a subject identifier index to improve lookup efficiency. For example, the server can create a hash table where the key is the subject identifier and the value is a list of event records associated with that subject identifier. When a new event record arrives, the server can quickly check if its subject identifier exists in the hash table. If it does, it further checks other conditions such as the time window. If the conditions are met, the event record is added to the subject's associated event set. If it does not exist or the conditions are not met, it may be used as the start of a new subject.

[0049] Step 108: Determine access risk characteristics based on the set of related events, and obtain the comprehensive risk value of the target access subject based on the access risk characteristics. The access risk characteristics include the target access subject's boundary-side threat score, intranet-side anomaly score, subject trust level, and behavioral deviation value.

[0050] Access risk characteristics are used to describe the multi-dimensional information relied upon when assessing the security status of a target access subject (such as a user account, a terminal device IP, or a system process). Access risk characteristics may include perimeter threat scores, intranet anomaly scores, subject trust levels, and behavioral deviation values.

[0051] Border-side threat scoring characterizes the threat level posed by external attack sources or external access requests based on data reported by border security devices. The data source for border-side threat scoring is external access traffic, abnormal connection requests, and border alarm events collected by border protection modules such as firewalls and WAFs. After receiving this raw data, the server converts it into a standardized border-side threat score, typically between 0 and 1, with higher values ​​indicating a greater threat. Internal network-side anomaly scoring characterizes the degree of anomaly in the behavior of a target access subject within the internal network based on data reported by internal network security devices. The data source for internal network-side anomaly scoring is internal network security modules such as endpoint security agents and internal network traffic probes, collecting endpoint behavior, east-west traffic, business access logs, and abnormal communication information. The server performs correlation analysis on this data to extract behavioral characteristics such as lateral movement, abnormal logins, and abnormal business calls, and then comprehensively calculates the internal network-side anomaly score. Subject trust level characterizes the assessment of the trustworthiness level of a target access subject (such as a user, endpoint, or system). For a high-trust access subject, even minor deviations in behavior may be tolerated; however, for a low-trust access subject, any abnormal behavior may trigger a higher-level alert. The behavior deviation value characterizes the degree to which a target access subject's current behavior deviates from its historical normal behavior baseline. Servers can use machine learning or statistical analysis methods to build a normal behavior model for each access subject, including its access time, communication frequency, access path, and business call patterns. The greater the difference between the current behavior and these baseline models, the higher the behavior deviation value.

[0052] The overall risk score is used to quantify and assess the overall security risk posed by the current behavior of a target user. For example, if the server calculates an overall risk score... The value is 0.2, which is lower than the preset linkage threshold. (Assuming a value of 0.6), it can be judged as normal or low risk, and only needs to be recorded without triggering coordinated defenses. For example, if the server calculates a comprehensive risk value... The value is 0.75, which is higher than the threshold. If the value is 0.6, it can be determined as a high risk, and the joint defense process needs to be initiated immediately.

[0053] For example, the server can parse based on a set of related events. For instance, the server can filter out all event records reported by perimeter security devices from the set, such as "external IP scan" and "SQL (Structured Query Language) injection attempt." The server analyzes the frequency, type, and target importance of these events, and combines this with a threat intelligence database to generate a standardized perimeter threat score. The server can also filter out event records reported by internal network security devices from the set of related events, such as "lateral connections," "abnormal logins," and "unauthorized access." The server analyzes the severity of these events, the value of the assets involved, and the suspiciousness of the behavior to generate an internal network anomaly score. Finally, the server can use the entity identifiers (such as user IDs and device fingerprints) carried in the set of related events to query its pre-established and maintained trust database to obtain information such as the entity's historical behavior baseline, authentication methods, and compliance status, thereby calculating the trust level of the target access entity. The server can compare the behaviors described in the current associated event set (such as access time, communication frequency, access path, and business call) with the normal behavior baseline of the subject stored in the subject trust database, calculate the deviations in each dimension (such as time deviation and frequency deviation), and finally obtain the behavior deviation value by weighted summation. The server can take the target access subject's boundary-side threat score, internal network-side anomaly score, subject trust level, and behavior deviation value as inputs, and substitute them into a preset comprehensive risk assessment model to obtain the comprehensive risk value of the target access subject.

[0054] Step 110: Based on the comprehensive risk value, the boundary-side threat score, and the internal network-side anomaly score, determine the protection strategy and carry out network security protection processing according to the protection strategy.

[0055] The protection policy serves as the operational instruction to guide network security protection processes. It can include two aspects: policy type and policy parameters. The policy type defines the category of actions to be performed, such as blocking, isolation, rate limiting, and raising detection thresholds. Policy parameters specify the specific objects to be targeted, such as the source IP address to be blocked, the terminal ID to be isolated, and the detection items to be raised. In actual network security protection, servers can dynamically generate protection policies with different policy types and parameters based on different risk scenarios.

[0056] Optionally, the server can determine protection strategies based on a comprehensive risk value, a border-side threat score, and an internal network anomaly score. For example, the server can compare the comprehensive risk value with several preset thresholds, and simultaneously compare the magnitude and level of the border-side threat score and the internal network anomaly score. Based on these comparison results, the server can match and determine one or more specific protection strategies from a predefined policy library. The server can convert and process the determined protection strategies, such as border reverse blocking strategies and internal network isolation strategies, through a unified policy distribution bus. The unified policy distribution bus can translate high-level policy descriptions into low-level control instructions that specific border security devices and internal network security devices can understand and execute, such as a firewall ACL (Access Control List) rule or a terminal isolation API call. The server can then distribute these instructions to the corresponding border security devices and internal network security devices to perform network security protection processing according to the protection strategies.

[0057] In the aforementioned network security protection method, boundary security event data collected by boundary security devices and intranet security event data collected by intranet security devices are acquired. Based on the boundary security event data and intranet security event data, event records containing event subject identifiers, target object identifiers, event occurrence time, access paths, and business behavior characteristics are generated. By performing correlation analysis on each event record, a set of associated events for the target access subject is obtained. This set of associated events unifies the originally scattered boundary events and intranet events under the same subject, realizing the correlation of cross-regional events. Based on the set of associated events, boundary-side threat scores, intranet-side anomaly scores, subject trust levels, and behavioral deviation values ​​are determined as access risk characteristics, and a comprehensive risk value is obtained. This allows the risk assessment to simultaneously cover multiple dimensions such as boundary threats, intranet anomalies, subject trust levels, and behavioral deviations. Based on the comprehensive risk value, boundary-side threat scores, and intranet-side anomaly scores, protection strategies are jointly determined and executed. This means that the generation of protection strategies no longer relies solely on information from the boundary or intranet side, but integrates the risk levels from both the boundary and intranet sides. This allows the protection strategies to more accurately reflect the actual situation and stage of the current attack, thereby improving the targeting and effectiveness of network security protection, and ultimately enhancing network security.

[0058] In an exemplary embodiment, the association analysis of each event record is performed to obtain the associated event set of the target access subject, including: when it is detected that at least two event records in each event record meet the preset association conditions, the target access subject associated with at least two event records is determined, and the associated event set of the target access subject is obtained based on the at least two event records; the preset association conditions include at least one of the following: the subject identifiers are the same or have the same source characteristics, the time difference between the events is less than a preset time window, there is a continuous relationship between the access path or the target object identifier, and at least one event record contains the characteristics of abnormal scanning, abnormal login, lateral access or high-risk business call.

[0059] The association criteria are used to determine whether two or more event records point to the same attack process or the same attacker. "Same subject identifier" means that the subject identifiers (such as source IP address, user account, device fingerprint) in different event records are completely identical. "Same source characteristics" means that although the surface identifiers are different, analysis (such as signatures based on the same attack tool, similar communication behavior patterns, common control server information, etc.) can infer that they come from the same attack source or attacker organization. For example, in one border event record, the subject identifier is IP address A; in another intranet event record, the subject identifier is also IP address A. The server can determine that they meet the condition of the same subject identifier. As another example, IP address A in the border event record comes from a known malicious network, while the terminal used by account B in the intranet event record has behavioral characteristics highly similar to the attack tool characteristics of IP address A. Even though IP address A and account B appear different, the server can determine that they are associated based on the same source characteristics.

[0060] The time difference between two events being less than a preset time window is used to associate security events that occur close in time. The preset time window is a configurable time range, such as 5 minutes or 30 minutes. If the time difference between two event records is less than this window, they are considered to be sequential in time and may belong to an attack chain, thus eliminating the possibility of incorrectly associating random events with large time spans and no connection. For example, if the server's preset time window is 10 minutes, and the first event record shows a scanning activity at the boundary at 10:00:00, while the second event record shows an abnormal login activity on the internal network at 10:05:00, the server can determine that they meet the time association condition because the time difference is 5 minutes, less than 10 minutes. Conversely, if the second event record occurs at 12:00:00, the time difference is 2 hours, and the server considers this condition not met.

[0061] A continuity relationship between access paths or target object identifiers is used to associate consecutive events along an attack path. A continuity relationship in access paths means that the target object of one event is the starting point or intermediate node of the access path in the next event. For example, an attacker first attacks a World Wide Web (WWW) server at the perimeter, and then uses that server as a springboard to launch attacks on internal network hosts. A continuity relationship between target object identifiers means that there is a logical connection between the target objects of the events, such as accessing different tables in the same database, or attacking different services on the same server. For example, event record A: the subject is the attacker's IP address, and the target is the perimeter web server. Event record B: the subject is the perimeter web server, and the target is the internal network core database. The server can determine that the attacker first compromised the web server and then used it as a springboard to attack the database, forming a continuity relationship in the access path. As another example, event record C: the target is database A. Event record D: the target is also database A. The server can determine that their target object identifiers are the same, indicating a continuity relationship.

[0062] At least one event record must contain characteristics of anomaly scanning, abnormal login, lateral access, or high-risk business calls to ensure that the associated event set has security threat significance. This requires that at least one event record involved in the association is itself a clearly identified malicious or suspicious behavior. This avoids mistakenly associating a large number of normal, threat-free events into a false positive attack chain. For example, the server obtains two event records: one showing terminal A accessing a file server, and the other showing terminal A accessing a print server. Both records are normal behaviors, and even if the subjects are the same and the times are close, the server will not associate them. However, if the first record is marked as anomaly scanning, the server can then perform association analysis with the other record.

[0063] Optionally, the server can perform correlation analysis on each acquired event record, checking whether each event record meets preset correlation conditions. For example, the server can check whether the subject identifiers of two event records are the same or have the same origin characteristics; if so, it can further check whether the difference in their timestamps is within a preset window; if the timestamps also meet the requirements, the server can continue to check whether their access paths or target objects have logical continuity; the server can confirm that at least one of these event records is marked as abnormal behavior (such as scanning, abnormal login, etc.). Only when all correlation conditions are met will the server determine that these two or more event records are correlated. Once the server successfully correlates at least two event records, it can extract a common behavioral subject or characteristic from these event records, thereby identifying a target access subject. The target access subject can be directly associated with a specific IP address or user account, or it can be a more abstract attacker profile. After identifying the target access subject, the server can aggregate all event records associated with that subject to form a complete set of correlated events.

[0064] In this embodiment, by performing multi-dimensional correlation analysis on each event record through preset correlation conditions, the barrier between boundary and intranet events in traditional security solutions, which cannot form an overall attack view, can be broken. The discrete alarms scattered across different devices and at different times can be effectively aggregated into a set of related events pointing to the same target access subject, which significantly improves the accuracy of attack identification and thus helps to improve network security.

[0065] In one exemplary embodiment, such as Figure 2 As shown, the process for determining the comprehensive risk value involves identifying access risk characteristics based on the set of related events, and then obtaining the comprehensive risk value of the target access subject based on these characteristics. This includes steps 202 to 206. Wherein:

[0066] Step 202: Based on the event records included in the associated event set, determine the boundary-side threat score, intranet-side anomaly score, subject trust level, and behavioral deviation value of the target access subject.

[0067] Optionally, the server can extract the intensity, frequency, and type of external attacks from event records belonging to border-side devices, such as the number of port scans, abnormal connection requests, and attack payload characteristics, and quantify the border-side threat score accordingly. The server can analyze the range of lateral movement, the number of abnormal authentications, and abnormal business call behavior from event records belonging to internal-network devices, thereby quantifying the internal-network anomaly score. For subject trust, the server can conduct a comprehensive assessment based on the target access subject's authentication strength, behavioral stability, and asset registration information in historical records. The behavioral deviation value can be calculated by comparing the target access subject's current behavioral characteristics (such as access time, frequency, path, and business type) with a long-established historical baseline reflecting its normal behavioral patterns.

[0068] For example, the server has associated two event logs with the user "Zhang San": one is an external access record from the perimeter firewall, which may indicate that Zhang San accessed the network from home via a VPN (Virtual Private Network); the other is an abnormal SQL query recorded by the internal network log audit server. Based on the perimeter event log, the server can calculate its perimeter threat score, for example, set to 0.2, because the VPN access is normal. Based on the internal network event log, it can calculate its internal network anomaly score, for example, set to 0.9, because its SQL query involves sensitive data and has an abnormal frequency. The server can query the historical behavior database and find that "Zhang San" has never performed any SQL queries, and its account is a low-privilege account; therefore, its principal trust level can be set to 0.5. The server compares its current access time (3 AM) with the historical baseline (9 AM to 6 PM on weekdays), calculates a high time deviation, and thus sets the overall behavior deviation value to 0.8.

[0069] Step 204: Based on the boundary-side threat score, the intranet-side anomaly score, the subject trust level, and the behavioral deviation value, the access risk characteristics are obtained.

[0070] For example, the server can encapsulate the numerical values ​​corresponding to the four dimensions—border-side threat score, intranet-side anomaly score, subject trust level, and behavioral deviation value—to obtain access risk characteristics. For instance, the server can combine the four calculated values—border-side threat score 0.2, intranet-side anomaly score 0.9, subject trust level 0.5, and behavioral deviation value 0.8—into a structured access risk characteristic. This access risk characteristic indicates that the user's subject trust level is at a moderate level, but their behavioral deviation is extremely high, and their behavior is highly anomalous within the intranet, while remaining relatively normal at the border.

[0071] Step 206: Calculate the comprehensive risk value of the target access subject by weighting the threat score on the boundary side, the anomaly score on the internal network side, the subject's trust level, and the behavioral deviation value.

[0072] Optionally, the server can apply a pre-defined evaluation model, such as a linear weighted formula, to input boundary-side threat scores, intranet-side anomaly scores, subject trust levels, and behavioral deviation values. Each value is assigned a pre-defined weight coefficient, which reflects the system's emphasis on different risk dimensions. For example, in some scenarios, the weight of intranet behavior can be set higher, while in other scenarios, the weight of boundary threats is more critical. By performing a weighted summation calculation, the server ultimately obtains a comprehensive risk value that represents the overall risk level of the target access subject.

[0073] In this embodiment, by extracting multidimensional risk features from the set of related events and calculating a weighted comprehensive risk value, the comprehensiveness and accuracy of risk assessment are improved.

[0074] In an exemplary embodiment, the behavior deviation value is calculated by weighting time deviation, frequency deviation, path deviation, and business deviation; wherein, time deviation reflects the difference between the current access time and the normal time pattern, frequency deviation reflects the difference between the current access frequency and the historical average frequency, path deviation reflects the difference between the current access path and the historical legal path, and business deviation reflects the difference between the current business call and the normal business model.

[0075] For example, a server can extract and construct a baseline of normal behavior for a target user from historical security event records related to that user. This baseline is a multi-dimensional profile, specifically including normal time patterns, historical average frequencies, historical legitimate paths, and normal business models. This baseline data can be derived by the server through long-term, large-scale machine learning analysis, or it can be based on manually preset rules.

[0076] Once the server receives current event logs from border security devices or intranet security devices regarding the target access subject, it can begin calculating various deviation components. The server can extract the timestamp from the current event logs and compare it with the subject's normal time pattern to calculate the time deviation. The server can calculate the frequency of the subject's access to a specific target object within the current time window and compare it with the historical average frequency to obtain the frequency deviation. The server can also analyze network path information in the current event logs, such as source IP, destination IP, and port, and match it with historical legitimate path maps to obtain the path deviation. The server can parse business behavior characteristics in the current event logs, such as called API interfaces, executed SQL statements, and modified files, and compare them with the subject's normal business model to obtain the business deviation. After obtaining the four deviation components, the server can perform a weighted sum of these four components according to preset weighting coefficients, such as w1, w2, w3, and w4, to calculate the behavior deviation value. The weighting coefficients can be dynamically adjusted based on the network environment, business importance, or security policies. For example, in a system with extremely high data security requirements, the weight w4 for business deviations can be set higher.

[0077] In this embodiment, by introducing deviation measurements of four dimensions—time deviation, frequency deviation, path deviation, and business deviation—a multi-faceted and comprehensive evaluation of access behavior is achieved. This can more comprehensively and accurately reflect the degree of abnormal behavior, effectively reduce the risk of misjudgment caused by occasional anomalies in normal behavior, and significantly enhance the pertinence and scenario adaptability of the protection strategy.

[0078] In an exemplary embodiment, a protection strategy is determined based on a comprehensive risk value, a border-side threat score, and an internal network anomaly score, and network security protection processing is performed according to the protection strategy. This includes: when the comprehensive risk value exceeds a first threshold and the internal network anomaly score is higher than the border-side threat score, the protection strategy includes a border reverse blocking strategy and an internal network isolation strategy. Network security protection processing is performed using border security devices according to the border reverse blocking strategy and using internal network security devices according to the internal network isolation strategy. When the comprehensive risk value exceeds the first threshold and the border-side threat score is higher than the internal network anomaly score, the protection strategy includes an internal network threshold raising strategy, a key monitoring strategy, or a least privilege convergence strategy. Network security protection processing is performed using internal network security devices according to the protection strategy. When the comprehensive risk value exceeds a second threshold and both the border-side threat score and the internal network anomaly score are higher than their respective corresponding score thresholds, the protection strategy includes a border blocking strategy, an internal network isolation strategy, and an audit enhancement strategy. Network security protection processing is performed using border security devices according to the border blocking strategy and using internal network security devices according to the internal network isolation strategy and the audit enhancement strategy. The second threshold is greater than the first threshold.

[0079] The first threshold is used to determine whether the overall risk value of the target access subject reaches a level requiring the activation of basic collaborative defense. The first threshold can be a value between 0 and 1, consistent with the dimension of the overall risk value. When the overall risk value exceeds the first threshold, it indicates that the target access subject's current behavior is significantly abnormal, the network system faces a potential threat, and corresponding protection strategies need to be triggered for intervention. The level of the first threshold determines the sensitivity to abnormal behavior; the lower the value, the more sensitive the system, but this may increase false alarms.

[0080] Boundary reverse blocking is an access control policy triggered by an internal network security event and ultimately executed on the boundary security device. In other words, the protective action is opposite to the direction of the attack flow. After the internal network security module detects an anomaly, it drives the boundary device to block the attack source at its origin. A boundary reverse blocking policy can include a set of instructions containing the IP address of the attack source to be blocked, session ID, user account, or the signature of a specific access request. The server, through a unified policy distribution bus, converts this boundary reverse blocking policy into rules recognizable by the boundary security device, such as a firewall ACL deny rule or a WAF IP blacklist, to block all subsequent external access from that source.

[0081] Internal network isolation policies are restrictive measures taken against hosts, terminals, or users identified as abnormal or high-risk within an internal network. The aim is to isolate them from the rest of the internal network and prevent the lateral spread of threats. Internal network isolation policies can include identifiers of the isolated object, such as the terminal's MAC address, IP address, hostname, or user account, as well as the isolation scope and actions, such as prohibiting communication with any internal network devices, allowing communication only with the isolation server, or placing it in a Virtual Local Area Network (VLAN). The server enforces this policy through internal network security modules, such as a switch's SDN (Software Defined Networking) controller or an endpoint security agent, restricting its network access permissions.

[0082] Internal network threshold escalation is a preventative, proactive strategy to enhance the sensitivity of internal network detection. Instead of directly blocking access, it adjusts the detection parameters of internal network security devices to make them more sensitive to abnormal behavior. An internal network threshold escalation strategy can include a set of parameter adjustment instructions, such as reducing the threshold for abnormal login attempts from 5 times / minute to 2 times / minute, reducing the lateral connection frequency alarm threshold by 50%, and increasing the weight score of suspicious file behavior. The server distributes these parameters to internal network security devices, such as log auditing systems, traffic probes, and endpoint detection and response systems, through a unified policy distribution bus.

[0083] A key monitoring strategy guides servers or intranet security modules to conduct more granular, frequent, and in-depth data collection and analysis on specific targets, users, or business systems. A key monitoring strategy may include a list of monitoring tasks, such as enabling full traffic auditing for critical database servers, real-time screen recording and keylogging of all user A's operations, and deep packet inspection of every call to core business interfaces. The server can distribute the key monitoring strategy to relevant intranet security devices, enabling them to prioritize the allocation of these resources to the designated targets.

[0084] The least privilege policy is a strategy that dynamically adjusts user or system permissions to minimize potential risks without completely blocking business operations. It temporarily narrows the scope of authorization, restoring the user to the minimum permissions required to perform the task. A least privilege policy may include a set of permission change instructions, such as revoking user B's temporary administrative privileges or disabling access to high-risk ports. The server executes this policy through an identity and access management platform or host security agent to dynamically adjust user or system permissions.

[0085] The second threshold is a higher risk threshold than the first threshold. It identifies attacks with extremely high risk, solid evidence, and the potential for a serious security incident. When the overall risk value exceeds the second threshold, it indicates that the attack has entered a more advanced or dangerous phase, requiring more stringent and comprehensive emergency response measures. The scoring threshold is an independent criterion set separately for boundary-side threat scoring and internal network anomaly scoring. It determines whether the risk in both dimensions has reached a "high" level. The scoring threshold can be a specific numerical value, such as 0.8. The server compares the boundary-side threat score and the internal network anomaly score to their respective scoring thresholds. Only when both exceed the threshold, combined with the condition that the overall risk value exceeds the second threshold, does the server trigger the most stringent combined strategy of "boundary blocking, internal network isolation, and enhanced auditing."

[0086] Boundary blocking strategies can target confirmed, high-risk attack sources or behaviors, not only blocking the current session but also potentially providing more thorough blocking, even disrupting the entire attack source IP segment or communication protocol. Internal network isolation strategies are designed to meet the needs of post-incident tracing and forensic investigation. Used in conjunction with proactive blocking and isolation strategies, internal network isolation strategies aim to improve the detail, retention duration, and coverage of event logs. Audit enhancement strategies are also designed to meet the needs of post-incident tracing and forensic investigation. Used in conjunction with proactive blocking and isolation strategies, audit enhancement strategies aim to improve the detail, retention duration, and coverage of event logs.

[0087] Optionally, when the server determines that the overall risk value exceeds the first threshold and the anomaly score on the internal network side is higher than the threat score on the perimeter side, the server can determine that the main stage of the current attack is internal network penetration and spread. The server can generate a perimeter reverse blocking policy targeting the attack source and an internal network isolation policy targeting the affected internal network assets. The server can convert the generated perimeter reverse blocking policy into instructions that can be executed by perimeter security devices such as firewalls through a unified policy distribution bus. For example, it can add a blocking rule on the firewall with the source IP being the attacker's IP and the action being drop. The server can also convert the generated internal network isolation policy into instructions that can be executed by internal network security devices such as switches and endpoint security agents through a unified policy distribution bus. For example, it can assign the switch port where the infected terminal is located to an isolated VLAN and disconnect its network connection from other non-isolated zones. After receiving the instructions, the perimeter security devices can perform blocking operations to cut off the attacker's external connection from the network boundary; after receiving the instructions, the internal network security devices can perform isolation operations to isolate the abnormal terminal from the normal business network and prevent it from continuing to launch lateral attacks on other assets within the internal network.

[0088] When the server determines that the overall risk value exceeds the first threshold and the threat score on the boundary side is higher than the anomaly score on the internal network side, the server can conclude that the current attack is still in the boundary probing or intrusion preparation stage, and the internal defenses have not yet been breached. The protection policies generated by the server include internal network threshold escalation policies, key monitoring policies, or least privilege convergence policies. The server can distribute the generated protection policies to internal network security devices via a unified policy distribution bus. Internal network security devices (such as endpoint agents, traffic probes, and log auditing systems) can execute corresponding adjustments upon receiving the instructions. For example, traffic probes can increase the sampling frequency and detection depth of east-west traffic, endpoint agents can strengthen monitoring of abnormal process startups, and log auditing systems can add alerts for abnormal login events.

[0089] When the server determines that the overall risk value exceeds the second threshold, and that both the border-side threat score and the internal network anomaly score are higher than their respective preset score thresholds (e.g., the border-side threat score exceeds 0.8, and the internal network anomaly score exceeds 0.75), the server can conclude that the current attack constitutes a complex, cross-regional, multi-stage attack. The server can generate border blocking policies, internal network isolation policies, and audit enhancement policies, package these three policies together, and distribute them simultaneously to both border security devices and internal network security devices via a unified policy distribution bus. Border security devices can receive border blocking commands, while internal network security devices can simultaneously receive internal network isolation commands and audit enhancement commands. Border security devices can perform aggressive blocking operations, such as setting blacklisted IP range blocking rules on the firewall. Internal network security devices can perform strong isolation operations, such as disconnecting the entire affected subnet from the core network. Internal network security devices (such as log auditing systems) can begin performing full auditing, recording the header and payload information of all network packets.

[0090] In this embodiment, by setting a first threshold and a second threshold, and combining the comparison between the threat score on the boundary side and the anomaly score on the internal network side, a refined hierarchical linkage based on the attack stage and risk level is achieved, which improves the accuracy of defense decisions and thus enhances network security.

[0091] In an exemplary embodiment, the network security protection method further includes: obtaining the execution result of network security protection processing according to the protection policy; updating the protection policy according to the execution result; and performing network security protection processing through the updated protection policy.

[0092] The execution result refers to the data returned by the boundary security devices and intranet security devices after the corresponding protection instructions are issued and executed according to the determined protection policy. This data characterizes the execution status of the protection action. The execution result can be a structured status report, log file, counter value, or simple Boolean identifier. For example, the execution result can include a JSON format data packet containing fields such as policy ID, device ID, executed action, and execution status.

[0093] Optionally, the server can obtain the execution results of network security protection processing according to the protection policy. For example, the server can proactively initiate query requests to the boundary security devices and intranet security devices that have issued the protection policy to obtain the execution results after the boundary security devices and intranet security devices have executed the policy. Alternatively, the boundary security devices and intranet security devices can also proactively return the execution results to the server after the protection policy has been executed. The server can dynamically adjust the original protection policy and reissue the updated protection policy for execution, thereby forming an automated closed loop. In some embodiments, the server can pre-set policy update rules. For example, if the execution result reflects that the current policy is effective (e.g., the risk score has decreased), the server can maintain the current policy and gradually reduce the defense level to avoid affecting normal business operations. Conversely, if the execution result reflects that the current policy is ineffective (e.g., lateral movement within the intranet is still continuing), the server can increase the strength of the policy. For example, the server can upgrade the isolation policy to a forced shutdown policy or expand the blocking scope. The updated protection policy will also be distributed to the corresponding boundary security devices or intranet security devices through the unified policy distribution bus and processed by their network security protection.

[0094] In this embodiment, by introducing a closed-loop feedback mechanism for obtaining execution results and updating protection strategies according to the execution results, subsequent defense actions can be dynamically adjusted based on the real security situation data after the protection strategy is executed. This improves the accuracy of the protection strategy, avoids protection failures caused by initial assessment bias or attack evolution, and thus enhances network security.

[0095] This application also provides an application scenario in which the above-described network security protection method is applied. Specifically, the network security protection method is applied in this scenario as follows:

[0096] With the rapid development of digital power grid services, traditional static protection models relying on perimeter devices such as firewalls and WAFs are insufficient to cope with complex attacks that allow attackers to move laterally and continuously penetrate the internal network after breaching the perimeter. In existing technologies, perimeter protection and internal network detection mostly operate independently, resulting in insufficient threat information sharing, lagging policy linkage, and weak cross-regional collaborative response capabilities, making it difficult to form a comprehensive defense loop. Therefore, it is necessary to build a defense system that coordinates perimeter and internal network operations, improving overall protection against advanced and complex attacks such as APTs (Advanced Persistent Threats) through unified policy distribution, anomaly information sharing, and dynamic defense linkage.

[0097] Traditional technologies primarily employ perimeter security devices for access control and attack interception, supplemented by intranet endpoint protection, log auditing, traffic monitoring, and situational awareness to achieve localized security detection. While these technologies can provide some protection at the perimeter or intranet level, they still suffer from the following technical limitations in complex network environments, especially in scenarios involving sustained penetration after attackers have breached the perimeter and entered the intranet:

[0098] 1. Boundary security protection and intranet security protection are independent of each other and lack a unified coordination mechanism.

[0099] Most existing network security protection systems still revolve around perimeter security devices, primarily relying on firewalls and access control lists to intercept and control external access. Internal network security typically employs endpoint protection, log auditing, traffic monitoring, or situational awareness for localized detection. Because perimeter and internal network devices are relatively independent in terms of deployment architecture, information awareness, and policy enforcement, they generally lack a unified threat information sharing channel, policy coordination mechanism, and joint response mechanism, making effective collaboration between different security zones difficult.

[0100] In this situation, when internal network security devices detect abnormal lateral movement, unusual service access, or suspicious terminal behavior, the relevant threat characteristics often cannot be synchronized to border devices in a timely manner for source blocking. Conversely, when border devices detect scanning probes, abnormal connections, or high-risk access requests, it is difficult to promptly notify internal network security devices to upgrade defense levels, tighten access permissions, or implement focused monitoring. This results in a disconnect between border protection and internal network protection, making it difficult to form a comprehensive joint defense and control capability against complex cross-regional and multi-stage attacks.

[0101] 2. Existing access control methods primarily rely on static rules, which are ill-suited to adapting to dynamically changing attack behaviors in complex network environments.

[0102] Traditional access control policies are mostly statically configured based on IP addresses, MAC addresses, communication ports, user roles, or ACL rules, belonging to the traditional "allow / block" discrete control mode. This approach can play a certain role in scenarios with clear network boundaries and stable business relationships, but when facing open network environments such as digital power grids with blurred network boundaries, complex business interactions, and diverse terminal types, fixed policies are difficult to fully reflect real-time security status and risk changes.

[0103] Especially in attack scenarios such as APT attacks, internal network penetration, credential theft, and lateral movement, attack behaviors are typically persistent, covert, and dynamically evolving. Existing static rules are difficult to adapt to changes in security status, behavioral deviations, and risk levels in a timely manner, easily leading to problems such as policy lag, overly broad rules, ineffectiveness, or even failure. Once attackers bypass perimeter protection and enter the internal network, traditional technologies often struggle to quickly implement dynamic restrictions, isolation, or coordinated blocking against their subsequent penetration and spread, thus affecting the overall defense effectiveness.

[0104] 3. Existing security assessments are relatively singular in dimensions and lack closed-loop prevention and control capabilities that address both the subjects and objects of security measures and business activities.

[0105] Existing security technologies typically focus on network layer attributes or single device status when identifying and assessing access control objects, lacking comprehensive measurement capabilities for user, terminal, system, and business behaviors. For complex threats such as forged device access, abnormal service calls, access during abnormal time periods, abnormal communication frequencies, and cross-system abnormal behavior, existing solutions often lack joint analysis and trust assessment mechanisms based on multi-dimensional information such as device characteristics, system behavior, time attributes, business attributes, and communication patterns. Therefore, they struggle to accurately identify abnormal subjects and behaviors in complex scenarios.

[0106] At the same time, traditional technologies often lack the integrated closed-loop capability of "security status acquisition - risk measurement and assessment - policy generation and adjustment - boundary and intranet linkage execution", resulting in the dispersion of detection, assessment and disposal, making it difficult to transform risk identification results into collaborative protection actions across devices and regions in a timely manner, and thus failing to meet the technical requirements for accurate identification, dynamic decision-making and overall linkage defense in complex network environments.

[0107] Based on this, the network security protection method provided in this application takes a unified security policy distribution and linkage control mechanism as its core, and constructs a two-way threat information sharing and collaborative response link between the boundary protection module and the internal network security module. This enables threats such as abnormal lateral movement and abnormal business behavior detected by the internal network to drive the boundary devices to block them at the source in real time. At the same time, abnormal probing or suspicious access detected by the boundary devices can also trigger the internal network devices to dynamically raise the defense threshold and tighten access control policies. This transforms the traditional static and fragmented single-point protection method into an integrated closed-loop defense system of "boundary-internal network" based on security status perception, risk joint judgment and policy adaptive adjustment, which significantly enhances the overall identification, linkage blocking and defense-in-depth capabilities against cross-regional and persistent complex attacks such as APTs.

[0108] The network security protection method provided in this application can be applied to collaborative defense systems of intranet and boundary security devices for complex networks, and is suitable for network environments such as digital power grids where network boundaries are blurred, terminal types are diverse, and business interactions are complex. Figure 3 The diagram shown illustrates the overall system architecture of the network security protection method provided in this application scenario. The system includes a boundary protection module, an intranet security module, a threat analysis and trust assessment module, a coordinated decision-making module, and a unified policy distribution bus. Its overall technical approach is as follows: security events are collected from both the boundary and intranet sides, and after unified analysis, risk assessment, and policy decision-making, coordinated defense is automatically triggered to achieve integrated dynamic prevention and control of the boundary and intranet.

[0109] The boundary protection module is deployed at the network boundary and is executed by boundary security devices such as firewalls and WAFs. It is used to collect external access traffic, abnormal connection requests and boundary alarm events, and output suspicious source addresses, access characteristics and blocking results.

[0110] The intranet security module is deployed on terminals, servers, or intranet monitoring nodes. It is executed by intranet security devices such as terminal security agents, traffic probes, log auditing devices, or situational awareness platforms. It is used to collect terminal behavior, east-west traffic, business access logs, and abnormal communication information, and output lateral movement events, abnormal behavior tags, and risk candidate data.

[0111] The threat analysis and trust assessment module is executed by the server or security management platform. It is used to uniformly process the data uploaded from the boundary side and the internal network side, extract threat characteristics such as attack sources, abnormal paths, communication frequencies, and abnormal business access, and conduct a comprehensive risk assessment by combining the subject's trust level and behavioral deviations.

[0112] The linkage decision module is configured to generate a collaborative defense policy according to a risk assessment result; the unified policy distribution bus is configured to convert the collaborative defense policy into control instructions executable by different security devices, and deliver the control instructions to the boundary protection module and the intranet security module for execution. The linkage decision module and the unified policy distribution bus may be implemented by a server.

[0113] In the network security protection process, as shown in Figure 4 , event data (boundary security event data and intranet security event data) is mainly generated by the boundary protection module of the boundary security device and the intranet security module of the intranet security device. The boundary protection module collects external access traffic, connection requests, protocol features and alarm events; the intranet security module collects terminal behaviors, login logs, service access records, intranet traffic and abnormal communication relationships. The above data is uploaded by the boundary device and the intranet device to the threat analysis and trust assessment module respectively.

[0114] The threat analysis and trust assessment module of the server first performs standardization processing and correlation analysis on multi-source data, then extracts abnormal behavior features, identity information, access path features and service behavior features, to generate a comprehensive risk value. When the comprehensive risk value reaches a preset threshold, the linkage decision module of the server is triggered to generate a boundary blocking policy, an intranet isolation policy, a permission convergence policy or a threshold improvement policy.

[0115] Subsequently, the unified policy distribution bus of the server converts the above policies into control instructions recognizable by various security devices, and delivers the control instructions to the boundary protection module and the intranet security module for execution respectively. The boundary security device performs blocking, intercepting or traffic limiting operations, and the intranet security device performs isolation, alarm enhancement, permission restriction or key monitoring operations. After the execution is completed, the relevant results are fed back to the server again for subsequent risk review and policy optimization, so as to form closed-loop defense.

[0116] To realize intelligent collaborative linkage between the boundary security device and the intranet security device, the present application introduces a multi-source threat correlation algorithm, a risk assessment algorithm and a linkage decision algorithm into the threat analysis and trust assessment module, so as to achieve the technical goal of "introducing security state quantities, deviation quantities and control algorithms, and converting the traditional pass / block discrete control into adaptive dynamic prevention and control". Specifically includes:

[0117] 1. Threat feature extraction and multi-source correlation algorithm

[0118] After receiving the standardized event data uploaded from the boundary side and the intranet side, the threat analysis and trust assessment module first performs event aggregation according to the subject identifier, target identifier, timestamp, access path and service object, and maps discrete security events from different devices into a unified attack chain. For this purpose, each event record can be expressed as:

[0119]

[0120] in, Indicates the main identifier of the event. Indicates the target object identifier. Indicates the time when the event occurred. Indicates the access path. This indicates the characteristics of business behavior.

[0121] The system correlates different events based on subject consistency, temporal proximity, and behavioral continuity. Events are identified as related events in the same attack chain when the following conditions are met:

[0122] The main identifiers are the same or have the same origin;

[0123] The time difference between the occurrence of the events is less than the preset time window;

[0124] There is a continuous relationship between the access path or business object;

[0125] At least one event contains characteristics of abnormal scanning, abnormal login, lateral access, or high-risk business calls.

[0126] The above method can achieve a unified association between suspicious boundary probing behavior and abnormal lateral movement behavior within the intranet, solving the problem of the separation between boundary events and intranet events in existing technologies.

[0127] 2. Comprehensive Risk Assessment and Trust Calculation Algorithm

[0128] After completing the event correlation, the system further calculates the overall risk value of the subject. To reflect the combined impact of perimeter threats, internal network anomalies, subject trust levels, and behavioral deviations on defense decisions, in one implementation, the following comprehensive risk assessment model can be adopted:

[0129]

[0130] in:

[0131] This represents the overall risk value;

[0132] This represents the boundary-side threat score, used to characterize the intensity of abnormal access detected by boundary devices;

[0133] This represents the anomaly score on the internal network side, used to characterize the degree of lateral movement, abnormal communication, or abnormal service access detected by internal network devices.

[0134] It represents the level of trust in the subject and is used to characterize the current level of trustworthiness of the user, terminal, or system.

[0135] This represents the behavioral deviation value, used to characterize the degree to which the current behavior deviates from the normal behavioral baseline;

[0136] For the weighting coefficients, satisfying .

[0137] Among them, subject trust level The behavioral deviation value can be determined comprehensively based on device identity, historical behavior stability, authentication results, and business matching degree. It can be calculated by weighting the deviations based on access time, communication frequency, access path, and service call.

[0138] In one alternative implementation, the behavioral deviation value It can be represented as:

[0139]

[0140] in:

[0141] This indicates the time deviation, reflecting the difference between the current access time and the normal time pattern;

[0142] This indicates frequency deviation, reflecting the difference between the current access frequency and the historical average frequency.

[0143] This indicates path deviation, reflecting the difference between the current access path and the historical legitimate path;

[0144] This indicates a business deviation, reflecting the difference between the current business call and the normal business model;

[0145] For the corresponding weights.

[0146] When the comprehensive risk value Greater than the preset linkage threshold When the current behavior is determined to require triggering collaborative defense, it is determined that the action needs to be coordinated.

[0147] 3. Algorithm for generating and dynamically adjusting linkage strategies

[0148] The collaborative decision-making module is based on the comprehensive risk value. The system automatically selects the appropriate linkage strategy based on the attack phase and the location of the anomaly. In one implementation, the following determination rule can be used:

[0149] when And internal network anomaly scoring Higher than the border threat score When the attack is determined to have entered the internal network propagation stage, a boundary reverse blocking strategy and an internal network isolation strategy are generated first.

[0150] when And the border threat score Higher than the internal network anomaly score When the current attack is determined to be in the boundary probing or intrusion preparation stage, priority is given to generating internal network threshold raising strategies, key monitoring strategies, or least privilege convergence strategies.

[0151] when and and At the same time, when it is relatively high, among which > The system determines that the current attack is a complex cross-regional attack and simultaneously triggers three linked actions: boundary blocking, internal network isolation, and audit enhancement.

[0152] During the dynamic adjustment of the strategy, the system can also modify the weight coefficients and linkage thresholds based on the execution feedback results. For example, if the number of internal network anomalies continues to rise after the boundary is blocked, the priority of the internal network isolation strategy is increased; if the number of anomaly alarms decreases significantly after the internal network defense threshold is raised, the current convergence strategy is maintained and the intensity of subsequent linkages is reduced. In this way, this application can adaptively optimize based on the actual execution effect, rather than rigidly executing preset rules.

[0153] In one implementation, if the intranet security module first detects abnormal lateral movement, abnormal authentication behavior, or abnormal service access, the threat analysis and trust assessment module extracts the corresponding threat characteristics and calculates the risk value in conjunction with the aforementioned comprehensive risk model. When the risk value reaches a threshold, the linkage decision module generates a boundary blocking policy and distributes it to the boundary protection module through the unified policy distribution bus. The boundary device then blocks the attack source address, abnormal session, or suspicious access request at the source. At the same time, it isolates or revokes permissions on abnormal intranet terminals.

[0154] In another implementation, if the boundary protection module first detects abnormal scanning, suspicious probing, or high-risk access requests, the linkage decision module generates an internal network defense enhancement strategy, which is then distributed to the internal network security module through a unified policy distribution bus. This strategy can raise the detection threshold, narrow the communication range, or initiate key monitoring to enhance defense capabilities before an attack enters the internal network.

[0155] Through the aforementioned algorithm model and execution method, this application realizes bidirectional information sharing, risk joint judgment, and policy linkage between the boundary side and the internal network side. This enables risks discovered by the boundary devices to drive early defense within the internal network, and anomalies discovered by the internal network to drive source blocking at the boundary, thereby improving the overall defense effect against complex attacks such as APTs.

[0156] In one embodiment, a coordinated blocking process is involved to prevent an attacker from moving laterally within the intranet after breaching the boundary. After bypassing static access control on the boundary side and entering the intranet, the attacker uses acquired accounts or terminals to initiate continuous access to multiple servers, accompanied by abnormal authentication attempts and abnormal business interface calls, thus constituting lateral movement behavior. This scenario corresponds to situations where an attacker may continue to operate within the intranet even after breaching external security boundaries.

[0157] In this embodiment, as Figure 5 As shown, the intranet security module detected that a terminal continuously accessed five different servers within 10 minutes, resulting in three abnormal authentication attempts and two abnormal business interface calls. After the threat analysis and trust assessment module completed the event correlation, it obtained a threat score on the perimeter. =0.85, Internal Network Anomaly Score =0.85, Subject Trust Level =0.40, behavioral deviation value =0.75. Let the weighting coefficients be respectively... Given β=0.2, γ=0.4, γ=0.2, and δ=0.2, substituting these values ​​into the comprehensive risk assessment formula yields:

[0158]

[0159] If the system preset linkage threshold is =0.60, then because The current action was determined to be a high-risk lateral movement attack. Furthermore, due to... > The linkage decision module determines that the attack has entered the internal network propagation stage and generates a boundary reverse blocking strategy and an internal network isolation strategy.

[0160] Subsequently, the unified policy distribution bus distributes the boundary reverse blocking policy to the boundary protection module, enabling boundary devices to block abnormal source addresses, abnormal sessions, or suspicious access requests. Simultaneously, it distributes the intranet isolation policy to the intranet security module, isolating abnormal terminals and tightening their access permissions. After policy execution, the boundary protection module and the intranet security module feed back the results to the threat analysis and trust assessment module. If the subsequent risk value drops below the threshold, the current round of coordinated action ends; if persistent anomalies remain, additional policies are generated to achieve continuous dynamic prevention and control.

[0161] In an embodiment, the process of early linkage to enhance intranet defense after detecting suspicious probing at the boundary is involved. At this time, the attacker has not yet entered the intranet, and the boundary protection module first detects abnormal scanning, abnormal connection probing from the external network, or high-frequency access requests for sensitive resources. This scenario belongs to the probing stage in the early phase of the attack chain, corresponding to the application scenario where protection needs to be enhanced in a dynamic adaptive manner in the face of constantly changing external attack behaviors.

[0162] In this embodiment, as shown in Figure 6 , the boundary protection module monitors that a certain external source address initiates probing requests to multiple sensitive interfaces within 5 minutes, wherein the number of port scans is 12, the abnormal access frequency value is 0.80, the degree of request deviation from the normal model is 0.70, and the target resource sensitivity level is 0.90. Assuming that the relevant weight coefficients are respectively λ1=0.25, λ2=0.25, λ3=0.20, λ4=0.30, then after substituting into the aforementioned boundary threat scoring formula, the boundary-side threat score is obtained through normalization processing =0.82. At the same time, the system combines the subject trust degree T=0.55, the behavior deviation value D=0.60 and the relatively low intranet anomaly score =0.20, and substitutes them into the comprehensive risk assessment formula to calculate the comprehensive risk value R=0.64.

[0163] When the preset linkage threshold =0.60, since and , the linkage decision module determines that the current attack is in the boundary probing stage, and generates an intranet defense enhancement policy. The policy includes increasing the sensitivity of anomaly detection, enhancing the granularity of log collection, narrowing the allowed communication range, and launching key monitoring of critical systems. Subsequently, the unified policy distribution bus delivers the policy to the intranet security module for execution, so that the intranet devices monitor login behaviors, lateral access and service calls with higher sensitivity in the subsequent observation period.

[0164] If abnormal login, abnormal communication or abnormal service call is further detected within the observation period, the system continues to trigger the lateral movement linkage blocking process in the first embodiment; if no subsequent anomaly is found, the normal defense threshold is gradually restored after the preset time ends, thereby balancing security and service availability. This process embodies the technical idea of dynamically adjusting access control policies and permissions by collecting and analyzing user context information.

[0165] By incorporating a boundary protection module, an intranet security module, a threat analysis and trust assessment module, a coordinated decision-making module, and a unified policy distribution bus, this application achieves threat information sharing and collaborative response between boundary security devices and intranet security devices, overcoming the problem in existing technologies where boundary protection and intranet protection are independent and difficult to form an integrated defense. The system can proactively enhance intranet defense when anomalies are detected at the boundary, and can also reversely coordinate with the boundary to block attacks at the source when lateral movement is detected within the intranet, thereby improving the overall defense capability against complex cross-regional attacks.

[0166] Meanwhile, this application upgrades the traditional static access control method based on fixed rules to a dynamic adaptive prevention and control method based on changes in security status by introducing technical means such as multi-source event correlation, risk assessment, trust analysis and behavior deviation judgment. This overcomes the problems of static policies, delayed response and difficulty in adapting to complex attack evolution in the existing technology, and improves the identification accuracy and timeliness of handling APT attacks, lateral penetration and persistent attack behaviors.

[0167] Furthermore, this application achieves centralized orchestration, automatic distribution, and closed-loop optimization of security policies through a unified policy distribution and execution feedback mechanism. This overcomes the problems of decentralized policy management, reliance on manual adjustment, and low linkage efficiency in existing technologies, and further improves the automation level and overall stability of security protection in complex network environments.

[0168] It should be understood that although the steps in the flowcharts of the embodiments described above are shown sequentially according to the arrows, these steps are not necessarily executed in the order indicated by the arrows. Unless explicitly stated herein, there is no strict order restriction on the execution of these steps, and they can be executed in other orders. Moreover, at least some steps in the flowcharts of the embodiments described above may include multiple steps or multiple stages. These steps or stages are not necessarily completed at the same time, but can be executed at different times. The execution order of these steps or stages is not necessarily sequential, but can be performed alternately or in turn with other steps or at least some of the steps or stages in other steps. It is understood that the steps in different embodiments can be freely combined as needed, and all non-contradictory solutions formed by such combinations are within the scope of protection of this application.

[0169] Based on the same inventive concept, this application also provides a network security protection device for implementing the network security protection method described above. The solution provided by this device is similar to the solution described in the above method; therefore, the specific limitations in one or more network security protection device embodiments provided below can be found in the limitations of the network security protection method described above, and will not be repeated here.

[0170] In one exemplary embodiment, such as Figure 7 As shown, a network security protection device 700 is provided, including: an event data acquisition module 702, an event log generation module 704, an event association module 706, a risk value determination module 708, and a protection policy execution module 710, wherein:

[0171] The event data acquisition module 702 is used to acquire boundary security event data collected by boundary security devices deployed at the boundary of the intranet network, and intranet security event data collected by intranet security devices deployed in the intranet.

[0172] The event log generation module 704 is used to generate multiple event logs based on boundary security event data and intranet security event data. Each event log includes the event subject identifier, target object identifier, event occurrence time, access path, and business behavior characteristics.

[0173] The event association module 706 is used to perform association analysis on each event record to obtain the associated event set of the target access subject. The associated event set includes at least one event record associated with the target access subject.

[0174] The risk value determination module 708 is used to determine access risk characteristics based on the set of related events, and to obtain the comprehensive risk value of the target access subject based on the access risk characteristics. The access risk characteristics include the target access subject's boundary-side threat score, intranet-side anomaly score, subject trust level, and behavioral deviation value.

[0175] The protection policy execution module 710 is used to determine the protection policy based on the comprehensive risk value, the boundary-side threat score and the internal network-side anomaly score, and to perform network security protection processing according to the protection policy.

[0176] In some embodiments, the event association module 706 is further configured to determine the target access subject associated with at least two event records when it is detected that at least two event records in each event record meet the preset association conditions, and obtain the associated event set of the target access subject based on the at least two event records; the preset association conditions include at least one of the following: the subject identifiers are the same or have the same source characteristics, the time difference between the events is less than a preset time window, there is a continuous relationship between the access path or the target object identifier, and at least one event record contains the characteristics of abnormal scanning, abnormal login, lateral access or high-risk business call.

[0177] In some embodiments, the risk value determination module 708 is further configured to determine the boundary-side threat score, intranet-side anomaly score, subject trust level, and behavioral deviation value of the target access subject based on the event records included in the associated event set; obtain access risk characteristics based on the boundary-side threat score, intranet-side anomaly score, subject trust level, and behavioral deviation value; and obtain the comprehensive risk value of the target access subject by performing a weighted calculation based on the boundary-side threat score, intranet-side anomaly score, subject trust level, and behavioral deviation value.

[0178] In some embodiments, the behavior deviation value is calculated by weighting time deviation, frequency deviation, path deviation, and business deviation; wherein, time deviation reflects the difference between the current access time and the normal time pattern, frequency deviation reflects the difference between the current access frequency and the historical average frequency, path deviation reflects the difference between the current access path and the historical legal path, and business deviation reflects the difference between the current business call and the normal business model.

[0179] In some embodiments, the protection policy execution module 710 is further configured to: determine that the protection policy includes a boundary reverse blocking policy and an intranet isolation policy when the overall risk value exceeds a first threshold and the intranet-side anomaly score is higher than the boundary-side threat score; perform network security protection processing through the boundary security device according to the boundary reverse blocking policy and through the intranet security device according to the intranet isolation policy when the overall risk value exceeds the first threshold and the boundary-side threat score is higher than the intranet-side anomaly score; determine that the protection policy includes an intranet threshold raising policy, a key monitoring policy, or a least privilege convergence policy when the boundary security device performs network security protection processing according to the protection policy when the boundary security device performs network security protection processing according to the protection policy when the overall risk value exceeds a second threshold and both the boundary-side threat score and the intranet-side anomaly score are higher than their respective corresponding score thresholds when the protection policy includes a boundary blocking policy, an intranet isolation policy, and an audit enhancement policy; perform network security protection processing through the boundary security device according to the boundary blocking policy and through the intranet security device according to the intranet isolation policy and the audit enhancement policy when the boundary security device performs network security protection processing according to the intranet isolation policy and the audit enhancement policy when the boundary security device performs network security protection processing according to the intranet isolation policy; the second threshold is greater than the first threshold.

[0180] In some embodiments, the protection policy execution module 710 is further configured to obtain the execution result of network security protection processing according to the protection policy; update the protection policy according to the execution result; and perform network security protection processing through the updated protection policy.

[0181] Each module in the aforementioned network security protection device can be implemented entirely or partially through software, hardware, or a combination thereof. These modules can be embedded in the processor of a computer device in hardware form or independent of it, or stored in the memory of the computer device in software form, so that the processor can call and execute the operations corresponding to each module.

[0182] In one exemplary embodiment, a computer device is provided, which may be a server, and its internal structure diagram may be as follows: Figure 8 As shown, this computer device includes a processor, memory, input / output interfaces (I / O), and a communication interface. The processor, memory, and I / O interfaces are connected via a system bus, and the communication interface is also connected to the system bus via the I / O interfaces. The processor provides computational and control capabilities. The memory includes non-volatile storage media and internal memory. The non-volatile storage media stores the operating system, computer programs, and a database. The internal memory provides an environment for the operation of the operating system and computer programs stored in the non-volatile storage media. The database stores various data involved in network security protection methods. The I / O interfaces are used for exchanging information between the processor and external devices. The communication interface is used for communicating with external terminals via a network connection. When the computer program is executed by the processor, it implements a network security protection method.

[0183] Those skilled in the art will understand that Figure 8 The structure shown is merely a block diagram of a portion of the structure related to the present application and does not constitute a limitation on the computer device to which the present application is applied. Specific computer devices may include more or fewer components than those shown in the figure, or combine certain components, or have different component arrangements.

[0184] In one embodiment, a computer device is also provided, including a memory and a processor, wherein the memory stores a computer program, and the processor executes the computer program to implement the steps in the above method embodiments.

[0185] In one embodiment, a computer-readable storage medium is provided storing a computer program that, when executed by a processor, implements the steps in the above method embodiments.

[0186] In one embodiment, a computer program product is provided, including a computer program that, when executed by a processor, implements the steps in the above method embodiments.

[0187] It should be noted that the user information (including but not limited to user device information, user personal information, etc.) and data (including but not limited to data used for analysis, data stored, data displayed, etc.) involved in this application are all information and data authorized by the user or fully authorized by all parties, and the collection, use and processing of the relevant data must comply with relevant regulations.

[0188] Those skilled in the art will understand that all or part of the processes in the methods of the above embodiments can be implemented by a computer program instructing related hardware. The computer program can be stored in a non-volatile computer-readable storage medium, and when executed, it can include the processes of the embodiments of the above methods. Any references to memory, databases, or other media used in the embodiments provided in this application can include at least one of non-volatile memory and volatile memory. Non-volatile memory can include read-only memory (ROM), magnetic tape, floppy disk, flash memory, optical memory, high-density embedded non-volatile memory, resistive random access memory (ReRAM), magnetic random access memory (MRAM), ferroelectric random access memory (FRAM), phase change memory (PCM), graphene memory, etc. Volatile memory can include random access memory (RAM) or external cache memory, etc. By way of illustration and not limitation, RAM can take many forms, such as Static Random Access Memory (SRAM) or Dynamic Random Access Memory (DRAM). The databases involved in the embodiments provided in this application may include at least one type of relational database and non-relational database. Non-relational databases may include, but are not limited to, blockchain-based distributed databases. The processors involved in the embodiments provided in this application may be general-purpose processors, central processing units, graphics processing units, digital signal processors, programmable logic devices, quantum computing-based data processing logic devices, artificial intelligence (AI) processors, etc., and are not limited to these.

[0189] The technical features of the above embodiments can be combined in any way. For the sake of brevity, not all possible combinations of the technical features in the above embodiments are described. However, as long as there is no contradiction in the combination of these technical features, they should be considered to be within the scope of this application.

[0190] The embodiments described above are merely illustrative of several implementation methods of this application, and while the descriptions are specific and detailed, they should not be construed as limiting the scope of this patent application. It should be noted that those skilled in the art can make various modifications and improvements without departing from the concept of this application, and these all fall within the protection scope of this application. Therefore, the protection scope of this application should be determined by the appended claims.

Claims

1. A network security protection method, characterized in that, The method includes: Acquire boundary security event data collected by boundary security devices deployed at the boundary of the intranet network, and intranet security event data collected by intranet security devices deployed in the intranet; Multiple event records are generated based on the boundary security event data and the intranet security event data. Each event record includes the event subject identifier, target object identifier, event occurrence time, access path, and business behavior characteristics. The event records are analyzed for correlation to obtain the associated event set of the target access subject. The associated event set includes at least one event record associated with the target access subject. Access risk characteristics are determined based on the set of related events, and a comprehensive risk value of the target access subject is obtained based on the access risk characteristics. The access risk characteristics include the target access subject's boundary-side threat score, intranet-side anomaly score, subject trust level, and behavioral deviation value. Based on the comprehensive risk value, the boundary-side threat score, and the intranet-side anomaly score, a protection strategy is determined, and network security protection is carried out in accordance with the protection strategy.

2. The method according to claim 1, characterized in that, The step of performing correlation analysis on the event records to obtain the set of related events for the target access subject includes: When it is detected that at least two event records in each of the event records meet the preset association conditions, the target access subject associated with the at least two event records is determined, and the associated event set of the target access subject is obtained based on the at least two event records; The preset association conditions include at least one of the following: the subject identifiers are the same or have the same source characteristics, the time difference between the events is less than a preset time window, there is a continuous relationship between the access path or the target object identifier, and at least one event record contains the characteristics of abnormal scanning, abnormal login, lateral access or high-risk business call.

3. The method according to claim 1, characterized in that, The step of determining access risk characteristics based on the associated event set and obtaining a comprehensive risk value for the target access subject based on the access risk characteristics includes: Based on the event records included in the associated event set, the boundary-side threat score, intranet-side anomaly score, subject trust level, and behavioral deviation value of the target access subject are determined respectively. Access risk characteristics are obtained based on the boundary-side threat score, the intranet-side anomaly score, the subject trust level, and the behavioral deviation value; The comprehensive risk value of the target access subject is obtained by weighting the boundary-side threat score, the intranet-side anomaly score, the subject trust level, and the behavioral deviation value.

4. The method according to claim 1, characterized in that, The behavioral deviation value is calculated by weighting time deviation, frequency deviation, path deviation, and service deviation. The time deviation reflects the difference between the current access time and the normal time pattern; the frequency deviation reflects the difference between the current access frequency and the historical average frequency; the path deviation reflects the difference between the current access path and the historical valid path; and the business deviation reflects the difference between the current business call and the normal business model.

5. The method according to claim 1, characterized in that, The process of determining a protection strategy based on the comprehensive risk value, the boundary-side threat score, and the internal network-side anomaly score, and then performing network security protection processing according to the protection strategy, includes: If the overall risk value exceeds the first threshold and the internal network anomaly score is higher than the boundary threat score, the protection strategy is determined to include a boundary reverse blocking strategy and an internal network isolation strategy. Network security protection is performed by the boundary security device according to the boundary reverse blocking strategy and by the internal network security device according to the internal network isolation strategy. If the overall risk value exceeds the first threshold and the boundary-side threat score is higher than the intranet-side anomaly score, the protection strategy is determined to include an intranet threshold raising strategy, a key monitoring strategy, or a least privilege convergence strategy, and network security protection is performed by the intranet security device according to the protection strategy. If the overall risk value exceeds the second threshold, and both the boundary-side threat score and the intranet-side anomaly score are higher than their respective score thresholds, the protection strategy is determined to include a boundary blocking strategy, an intranet isolation strategy, and an audit enhancement strategy. Network security protection is performed by the boundary security device according to the boundary blocking strategy, and by the intranet security device according to the intranet isolation strategy and the audit enhancement strategy; the second threshold is greater than the first threshold.

6. The method according to any one of claims 1 to 5, characterized in that, The method further includes: Obtain the execution result of network security protection processing according to the described protection strategy; The protection policy is updated according to the execution result, and network security protection is performed using the updated protection policy.

7. A network security protection device, characterized in that, The device includes: The event data acquisition module is used to acquire boundary security event data collected by boundary security devices deployed at the boundary of the intranet network, and intranet security event data collected by intranet security devices deployed in the intranet. The event log generation module is used to generate multiple event logs based on the boundary security event data and the intranet security event data. Each event log includes an event subject identifier, a target object identifier, an event occurrence time, an access path, and business behavior characteristics. The event association module is used to perform association analysis on each of the event records to obtain the associated event set of the target access subject. The associated event set includes at least one event record associated with the target access subject. The risk value determination module is used to determine access risk characteristics based on the associated event set, and to obtain the comprehensive risk value of the target access subject according to the access risk characteristics. The access risk characteristics include the target access subject's boundary-side threat score, intranet-side anomaly score, subject trust level, and behavioral deviation value. The protection strategy execution module is used to determine the protection strategy based on the comprehensive risk value, the boundary-side threat score and the intranet-side anomaly score, and to perform network security protection processing according to the protection strategy.

8. A computer device comprising a memory and a processor, wherein the memory stores a computer program, characterized in that, When the processor executes the computer program, it implements the steps of the method according to any one of claims 1 to 6.

9. A computer-readable storage medium having a computer program stored thereon, characterized in that, When the computer program is executed by a processor, it implements the steps of the method according to any one of claims 1 to 6.

10. A computer program product, comprising a computer program, characterized in that, When the computer program is executed by a processor, it implements the steps of the method according to any one of claims 1 to 6.

Images