Asset hierarchical self-adaptive anti-probing protection method and system under zero trust architecture

Abstract

The application provides an asset hierarchical adaptive anti-probing protection method and system under a zero trust architecture, relates to the technical field of zero trust security and asset anti-mapping, and comprises the following steps: S1: calculating a comprehensive risk grading value according to three-dimensional quantitative indexes of asset business value, secret level and access permission; S2: connecting a dynamic trusted authentication module of the zero trust architecture; S3: configuring hierarchical adaptive anti-probing protection rules; S4: extracting trusted data synchronized by S2 and substituting the trusted data into a trusted access judgment formula, and performing corresponding hierarchical protection disposal on the basis of binary distinction between zero trust trusted authorized access and malicious probing behavior; and S5: listening to zero trust dynamic permission change events. The application can capture zero trust platform permission change events in real time, simultaneously count the frequency of malicious probing interception within 10 minutes, dynamically correct the asset comprehensive risk grading value, and synchronously update the whole set of adaptive anti-probing protection rules.

Description

Technical Field

[0001] This invention relates to the fields of zero-trust security and asset anti-mapping technology, and more specifically, to a hierarchical adaptive anti-probing protection method and system for assets under a zero-trust architecture. Background Technology

[0002] Currently, there are two main existing technologies in the field of zero-trust network security and asset anti-mapping protection, both of which have obvious technical shortcomings: The first type of existing technology only completes the access control of zero-trust assets, only verifies the access qualification of the access subject, and only solves the problem of whether the authorized subject can access the asset. It does not have the proactive defense capabilities of asset fingerprint hiding, malicious scanning interception, and prevention of external network mapping, and cannot stop external scanning behavior from stealing asset characteristics.

[0003] The second category is the traditional static anti-probe protection solution, which adopts unified and fixed protection rules and does not divide asset levels through three-dimensional quantitative indicators such as business value, confidentiality level, and access permissions. On the one hand, the protection coverage of core confidential assets is insufficient, and fingerprints of multiple types of assets are easily leaked; on the other hand, the complete disguise of ordinary office assets will continuously consume system computing power and slow down the speed of normal business access.

[0004] Meanwhile, traditional static protection cannot connect to the zero-trust dynamic trusted authentication link, lacks a dynamic mapping and synchronization mechanism for assets, users, and devices with a 300-millisecond cycle, cannot synchronize the three types of trusted data: user identity, device trust, and access trajectory, and lacks multi-parameter joint judgment logic, making it extremely easy for trusted users to be mistakenly intercepted and for malicious probes to fail to provide protection. Summary of the Invention

[0005] The purpose of this invention is to solve the problem that current protection schemes cannot simultaneously take into account security protection strength and business operation efficiency, and to provide a counter-probing protection scheme that is quantifiable, graded, and adaptively optimized.

[0006] To achieve the above-mentioned objectives and improve the aforementioned problems, this invention provides an asset-tiered adaptive anti-probing protection method under a zero-trust architecture, comprising the following steps: S1: Calculate the comprehensive risk rating value based on the three-dimensional quantitative indicators of asset business value, confidentiality level, and access permissions, and divide the entire network's IT assets into three fixed protection levels: core confidential assets, important business assets, and ordinary office assets according to the numerical range. S2: Connects to the zero-trust architecture dynamic trusted authentication module, which synchronizes three types of trusted data—user identity, device trust, and access trajectory—in milliseconds, and establishes a dynamic mapping relationship between assets, users, and devices. S3: Configure layered adaptive anti-probe protection rules for the three levels of assets divided in S1; S4: Extract the trusted data synchronized from S2 and substitute it into the trusted access determination formula. A binary distinction is made between zero-trust trusted authorized access and malicious probing behavior, and corresponding tiered protection measures are implemented. The formula is: ; in For accessing trusted identifiers; For identity matching parameters; Assign trust parameters to the device; For trajectory compliance parameters; S5: Listen for dynamic permission change events in zero-trust environments.

[0007] As a preferred technical solution of this application, step S1 specifically includes: S101: Unify the extraction of three pre-existing fixed quantitative indicators for all IT assets, with all indicator values ​​uniformly limited to integers between 0 and 100, and terminology consistent throughout the process: Represents the quantifiable value of business. Representative classification level assignment, This represents the threshold for basic access permissions to assets; S102: Substitute into the asset tiered quantitative calculation formula: ; in These are the overall risk rating values ​​for the assets, with 0.6, 0.3, and 0.1 being fixed weighting coefficients. S102: According to The numerical ranges do not overlap, dividing assets into three levels: 80≤ ≤100 are designated as core classified assets, 40≤ ≤79 is designated as an important business asset, 0≤ Assets ≤39 are classified as ordinary office assets, and the classification results are stored persistently.

[0008] As a preferred technical solution of this application, step S2 specifically includes: S201: Continuously connects to the zero-trust architecture dynamic trusted authentication module, pulling three types of fixed trusted data in real time: , , ; S202: Establish a static association mapping table for assets, users, and devices.

[0009] As a preferred technical solution of this application, step S3 specifically includes: S301: Perform seven-dimensional full-dimensional fingerprint erasure plus 10ms-level real-time detection and interception on core classified assets classified as S1. The seven-dimensional full-dimensional fingerprint includes operating system version, open port, service banner, server hardware serial number, database identifier, internal network router identifier, and background process name. All external outputs are random blank characters to hide the real fingerprint. S302: Perform dynamic rotation masquerading of four-dimensional features plus 200ms delay anomaly detection and interception on important business assets classified by S1. The four-dimensional features are open ports, service banners, business processes, and internal network routing identifiers. S303: Performs lightweight masking of idle ports on ordinary office assets classified as S1, only hiding the idle port identifier.

[0010] As a preferred technical solution of this application, in step S4, if... =1, indicating trusted authorized access; if =0, which is judged as malicious probing behavior, and the corresponding graded protection rules of the target asset S3 are retrieved.

[0011] As a preferred technical solution of this application, step S5 specifically includes: S501: Real-time capture of permission change events pushed by zero-trust platforms, and synchronous updates. Complete the correction of basic rating parameters; S502: Counts the total frequency of malicious probes intercepted by S4 on the target asset within 10 consecutive minutes. ,Will As a correction coefficient superposition This leads to an upward adjustment of the overall risk rating for assets subjected to high-frequency detection. S503: Adopting the revised new version The value is rematched to the S3 preset Level 3 asset protection rule range.

[0012] The asset-level adaptive anti-probing protection system under a zero-trust architecture includes an asset quantification and grading module, a zero-trust trusted data synchronization and mapping module, a tiered differentiated anti-probing strategy configuration module, an access behavior binary identification and handling module, and a protection strategy adaptive iterative optimization module. The asset quantification and grading module specifically includes: The three-dimensional indicator collection submodule uniformly collects three types of fixed quantitative indicators for IT assets across the entire network: business value, confidentiality level, and basic access permissions. The asset classification submodule comprehensively calculates the asset security risk level based on three types of indicators collected, and distinguishes three types of assets according to a fixed value range: core confidential assets, important business assets, and ordinary office assets.

[0013] As a preferred technical solution of this application, the zero-trust trusted data synchronization mapping module specifically includes: The trusted data interface submodule continuously interfaces with the external zero-trust architecture dynamic trusted authentication module, periodically pulling three types of trusted raw data: user identity identifier, device trust status, and access behavior trajectory. The association mapping submodule refreshes the binding mapping relationship between the three at a fixed period, eliminating the delay in permission update data.

[0014] As a preferred technical solution of this application, the hierarchical differentiated anti-probing strategy configuration module specifically includes: The core asset sub-module is configured with full-dimensional asset fingerprint hiding and high-speed detection and interception logic; The important asset sub-module is configured with periodically rotating business characteristic masquerading rules; The ordinary asset submodule only configures simple masking rules for idle ports.

[0015] As a preferred technical solution of this application, the access behavior binary screening and processing module specifically includes: The trusted parameter extraction submodule retrieves the complete set of trusted data output by the zero-trust trusted data synchronization mapping module; The classification and handling submodule performs a binary judgment on access behavior, identifying trusted authorized access behavior and malicious probing and scanning behavior; The adaptive iterative optimization module for the protection strategy specifically includes: The permission change monitoring and correction submodule captures permission change information from the zero-trust platform in real time and corrects the permission indicators required for asset classification. The detection situation statistics and correction submodule counts the frequency of malicious detection and interception per unit time and fine-tunes the overall asset risk level. The rule update and distribution submodule re-matches the protection strategy based on the revised asset level and writes the updated set of protection rules back to the hierarchical differentiated anti-detection strategy configuration module.

[0016] Compared with the prior art, the beneficial effects of the present invention are as follows: In the scheme of this application: 1. Based on the three-dimensional quantitative indicators of business value, confidentiality level, and access permissions, the comprehensive risk assessment of assets is calculated. The three-level assets are divided by non-overlapping fixed numerical ranges. The asset level judgment standard is unified and the results are objective and accurate. It provides a standardized quantitative basis for the deployment of differentiated anti-detection strategies and can fundamentally solve the defects of traditional one-size-fits-all protection that lacks layered judgment standards. 2. By configuring dedicated protection rules for Level 3 assets with completely differentiated protection dimensions and interception response latency: core confidential assets are subject to seven-dimensional full-dimensional fingerprint hiding combined with real-time detection and interception to minimize the leakage of asset characteristics; important business assets are disguised with four-dimensional features that are automatically rotated every 5 minutes, combined with 200-millisecond latency anomaly detection and interception; ordinary office assets are only subject to lightweight masking of idle ports without adding additional traffic verification logic, which greatly reduces system resource consumption and achieves precise matching between the security strength of different asset levels and business efficiency. 3. By combining three types of synchronous trusted parameters to jointly determine access behavior, trusted access is determined only when the identity, device, and access trajectory are all compliant. During the access process, the original fingerprint of the asset is temporarily retrieved and allowed. For malicious probe traffic, the fingerprint is directly matched with the corresponding protection rules of the target asset to perform fingerprint masking and connection blocking, which completely solves the problems of trusted users being mistakenly blocked and malicious scanning being missed. 4. It can capture permission change events of the zero trust platform in real time, and at the same time count the frequency of malicious probe interception within 10 consecutive minutes. It can dynamically correct the comprehensive risk rating of assets and update the full set of anti-probe protection rules in sync. The protection strategy can be adaptively adjusted in conjunction with the dynamic permissions of zero trust and the real-time attack situation, perfectly adapting to the dynamic security architecture of zero trust and making up for the shortcomings of poor adaptability of traditional static protection. Attached Figure Description

[0017] Figure 1 The flowchart shows the asset-level hierarchical adaptive anti-probing protection method and system provided in this application under the zero-trust architecture. Detailed Implementation

[0018] To enable those skilled in the art to better understand the present invention, the technical solutions of the present invention will be clearly and completely described below with reference to the accompanying drawings of the embodiments. Obviously, the described embodiments are only some embodiments of the present invention, and not all embodiments. Based on the embodiments of the present invention, all other embodiments obtained by those skilled in the art without creative effort should fall within the scope of protection of the present invention.

[0019] To enable those skilled in the art to better understand the present invention, the technical solutions in the embodiments of the present invention will be clearly and completely described below with reference to the accompanying drawings.

[0020] It should be noted that, unless otherwise specified, the embodiments and features and technical solutions in the embodiments of the present invention can be combined with each other.

[0021] It should be noted that similar labels and letters in the following figures indicate similar items. Therefore, once an item is defined in one figure, it does not need to be further defined and explained in subsequent figures.

[0022] The Zero Trust Architecture Dynamic Trusted Authentication Module is based on the "Zero Trust System Technical Specification" (T / CESA1165-2021).

[0023] Please refer to Figure 1 The asset-tiered adaptive anti-probing protection method under a zero-trust architecture includes the following steps: S1: Calculate the comprehensive risk rating value based on the three-dimensional quantitative indicators of asset business value, confidentiality level, and access permissions, and divide the entire network's IT assets into three fixed protection levels: core confidential assets, important business assets, and ordinary office assets according to the numerical range. S2: Connects to the zero-trust architecture dynamic trusted authentication module, which synchronizes three types of trusted data—user identity, device trust, and access trajectory—in milliseconds, and establishes a dynamic mapping relationship between assets, users, and devices. S3: For the three levels of assets divided by S1, configure layered adaptive anti-probe protection rules with completely different dimensions and response latency; S4: Extract the trusted data synchronized from S2 and substitute it into the trusted access determination formula. A binary distinction is made between zero-trust trusted authorized access and malicious probing behavior, and corresponding tiered protection measures are implemented. The formula is: ; in To access the trusted determination identifier, output only 1 or 0; For identity matching parameters, the value is 1 for authorized users and 0 for unknown users; Set the device's credit parameters: 1 for device authentication and 0 for unauthorized device. For trajectory compliance parameters, the value is 1 for normal business trajectories and 0 for scanning and detection trajectories; only when all three parameters are 1. =1; S5: Monitor zero-trust dynamic permission change events, calculate asset detection frequency to correct the comprehensive risk rating of S1, and adaptively update all anti-detection protection rules of S3.

[0024] Furthermore, S1 specifically includes: S101: Unify the extraction of three pre-existing fixed quantitative indicators for all IT assets, with all indicator values ​​uniformly limited to integers between 0 and 100, and terminology consistent throughout the process: Represents the quantifiable value of business. Representative classification level assignment, The three indicators represent the basic access thresholds for assets. The values ​​are directly entered based on the company's asset ledger, confidential filing documents, and zero-trust initial access list, without any subjective or ambiguous manual division. S102: Substitute into the asset tiered quantitative calculation formula: ; in The comprehensive risk rating values ​​for assets are 0.6, 0.3, and 0.1, which are fixed weighting coefficients. The weights are based on the priority of government and enterprise asset safety and cannot be modified. S102: According to The numerical ranges do not overlap, dividing assets into three levels: 80≤ ≤100 are designated as core classified assets, 40≤ ≤79 is designated as an important business asset, 0≤ ≤39 are classified as ordinary office assets, and the classification results are persistently stored as the basic input parameters for S3 and S5.

[0025] Furthermore, S2 specifically includes: S201: Continuously connects to the zero-trust architecture dynamic trusted authentication module, pulling three types of fixed trusted data in real time: , , ; S202: Build a static association mapping table of assets, users and devices, set a fixed refresh cycle of 300 milliseconds, and automatically synchronize the permission change data of the zero-trust platform every cycle to eliminate the data synchronization delay between permission updates and protection policies.

[0026] Furthermore, S3 specifically includes: S301: Perform seven-dimensional full-dimensional fingerprint erasure plus 10ms-level real-time detection and interception on core classified assets classified as S1. The seven-dimensional full-dimensional fingerprint includes operating system version, open port, service banner, server hardware serial number, database identifier, internal network router identifier, and background process name. All external outputs are random blank characters to hide the real fingerprint. S302: Perform dynamic rotation masquerading with four-dimensional features plus 200ms delay anomaly detection and interception on important business assets classified as S1. The four-dimensional features are open ports, service banners, business processes, and internal network routing identifiers. The masquerading features are automatically and randomly changed every 5 minutes. S303: Performs lightweight masking of idle ports on ordinary office assets classified as S1, only hiding the idle port identifier, without modifying system or process characteristics, without adding extra traffic verification logic, thus reducing system resource consumption.

[0027] Furthermore, in S4, if =1, indicating trusted authorized access; if =0, which is judged as malicious probing behavior, and the corresponding graded protection rules of the target asset S3 are retrieved.

[0028] Furthermore, S5 specifically includes: S501: Real-time capture of permission change events pushed by zero-trust platforms, and synchronous updates. Complete the correction of basic rating parameters; S502: Counts the total frequency of malicious probes intercepted by S4 on the target asset within 10 consecutive minutes. ,Will As a correction coefficient superposition This leads to an upward adjustment of the overall risk rating for assets subjected to high-frequency detection. S503: Adopting the revised new version The value is rematched with the S3 preset three-level asset protection rule range, the fingerprint spoofing field is updated synchronously, the detection and interception response latency is updated, the protection strategy is adaptively linked and adjusted, and the updated rules are written back to S3 as the basis for the next round of access handling.

[0029] The asset-level adaptive anti-probing protection system under a zero-trust architecture includes an asset quantification and grading module, a zero-trust trusted data synchronization and mapping module, a tiered differentiated anti-probing strategy configuration module, an access behavior binary screening and handling module, and a protection strategy adaptive iterative optimization module. The asset quantification and grading module specifically includes: The three-dimensional indicator collection submodule uniformly collects three types of fixed quantitative indicators for IT assets across the entire network: business value, confidentiality level, and basic access permissions. The asset classification submodule comprehensively calculates the asset security risk level based on the three types of indicators collected. It distinguishes three types of assets—core confidential assets, important business assets, and ordinary office assets—based on a fixed value range. The asset classification label is then persistently output to the classification-differentiated anti-detection strategy configuration module and the protection strategy adaptive iterative optimization module.

[0030] The zero-trust trusted data synchronization mapping module specifically includes: The trusted data interface submodule continuously interfaces with the external zero-trust architecture dynamic trusted authentication module, periodically pulling three types of trusted raw data: user identity identifier, device trust status, and access behavior trajectory. The association mapping submodule refreshes the binding mapping relationship among the three at fixed intervals, eliminates the delay in permission update data, generates a dynamic mapping form and pushes it synchronously to the access behavior binary identification and handling module and the protection strategy adaptive iterative optimization module.

[0031] The hierarchical differentiated anti-probing strategy configuration module specifically includes: The core asset sub-module is configured with full-dimensional asset fingerprint hiding and high-speed detection and interception logic; The important asset sub-module is configured with periodically rotating business characteristic masquerading rules; The ordinary asset submodule only configures simple masking rules for idle ports; all established protection rules are uniformly stored and distributed to the access behavior binary identification and handling module.

[0032] The binary screening and handling module for access behavior specifically includes: The trusted parameter extraction submodule retrieves the complete set of trusted data output by the zero-trust trusted data synchronization mapping module; The classification and handling submodule performs a binary judgment on access behavior, identifying trusted authorized access behavior and malicious probe scanning behavior. Trusted access directly retrieves the original fingerprint of the asset and allows it to pass without being noticed. Malicious probes match the hierarchical protection rules corresponding to the target asset and perform fingerprint masking and connection blocking operations. The adaptive iterative optimization module for protection strategies specifically includes: The permission change monitoring and correction submodule captures permission change information from the zero-trust platform in real time and corrects the permission indicators required for asset classification. The detection situation statistics and correction submodule counts the frequency of malicious detection and interception per unit time and fine-tunes the overall asset risk level. The rule update and distribution submodule re-matches the protection strategy based on the revised asset level, and writes the updated set of protection rules back to the hierarchical differentiated anti-probing strategy configuration module to complete the closed-loop adaptive adjustment of the strategy.

[0033] In this invention, unless otherwise explicitly specified and limited, the terms "installation," "connection," "linking," and "fixing," etc., should be interpreted broadly. For example, they can refer to a fixed connection, a detachable connection, or an integral part; they can refer to a mechanical connection, an electrical connection, or a connection that allows communication between them; they can refer to a direct connection or an indirect connection through an intermediate medium; they can refer to the internal communication of two components or the interaction between two components, unless otherwise explicitly limited. Those skilled in the art can understand the specific meaning of the above terms in this invention according to the specific circumstances.

[0034] Obviously, the embodiments described above are merely some embodiments of the present invention, not all embodiments. The accompanying drawings show preferred embodiments of the present invention, but do not limit the patent scope of the present invention. The present invention can be implemented in many different forms; rather, these embodiments are provided to provide a more thorough and complete understanding of the disclosure of the present invention. Although the present invention has been described in detail with reference to the foregoing embodiments, those skilled in the art can still modify the technical solutions described in the foregoing specific embodiments, or make equivalent substitutions for some of the technical features. Any equivalent structures made using the content of this specification and drawings, directly or indirectly applied to other related technical fields, are similarly within the patent protection scope of this invention.

Claims

1. An asset-tiered adaptive anti-probing protection method under a zero-trust architecture, characterized in that, The following steps are included: S1: Calculate the comprehensive risk rating value based on the three-dimensional quantitative indicators of asset business value, confidentiality level, and access permissions, and divide the entire network's IT assets into three fixed protection levels: core confidential assets, important business assets, and ordinary office assets according to the numerical range. S2: Connects to the zero-trust architecture dynamic trusted authentication module, which synchronizes three types of trusted data—user identity, device trust, and access trajectory—in milliseconds, and establishes a dynamic mapping relationship between assets, users, and devices. S3: Configure layered adaptive anti-probe protection rules for the three levels of assets divided in S1; S4: Extract the trusted data synchronized from S2 and substitute it into the trusted access determination formula. A binary distinction is made between zero-trust trusted authorized access and malicious probing behavior, and corresponding tiered protection measures are implemented. The formula is: ； in For access to trusted identification identifiers; For identity matching parameters; Assign trust parameters to the device; For trajectory compliance parameters; S5: Listen for dynamic permission change events in zero-trust environments.

2. The asset-tiered adaptive anti-probing protection method under a zero-trust architecture according to claim 1, characterized in that, Specifically, S1 includes: S101: Unify the extraction of three pre-existing fixed quantitative indicators for all IT assets, with all indicator values ​​uniformly limited to integers between 0 and 100, and terminology consistent throughout the process: Represents the quantifiable value of business. Representative classification level assignment, This represents the threshold for basic access permissions to assets; S102: Substitute into the asset tiered quantitative calculation formula: ； in These are the overall risk rating values ​​for the assets, with 0.6, 0.3, and 0.1 being fixed weighting coefficients. S102: According to The numerical ranges do not overlap, dividing assets into three levels: 80≤ ≤100 are designated as core classified assets, 40≤ ≤79 is designated as an important business asset, 0≤ Assets ≤39 are classified as ordinary office assets, and the classification results are stored persistently.

3. The asset-tiered adaptive anti-probing protection method under a zero-trust architecture according to claim 2, characterized in that, Specifically, S2 includes: S201: Continuously connects to the zero-trust architecture dynamic trusted authentication module, pulling three types of fixed trusted data in real time: , , ; S202: Establish a static association mapping table for assets, users, and devices.

4. The asset-tiered adaptive anti-probing protection method under a zero-trust architecture according to claim 3, characterized in that, Specifically, S3 includes: S301: Perform seven-dimensional full-dimensional fingerprint erasure plus 10ms-level real-time detection and interception on core classified assets classified as S1. The seven-dimensional full-dimensional fingerprint includes operating system version, open port, service banner, server hardware serial number, database identifier, internal network router identifier, and background process name. All external outputs are random blank characters to hide the real fingerprint. S302: Perform dynamic rotation masquerading of four-dimensional features plus 200ms delay for anomaly detection and interception on important business assets classified by S1. The four-dimensional features are open ports, service banners, business processes, and internal network routing identifiers. S303: Performs lightweight masking of idle ports on ordinary office assets classified as S1, only hiding the idle port identifier.

5. The asset-tiered adaptive anti-probing protection method under a zero-trust architecture according to claim 4, characterized in that, In S4, if =1, indicating trusted authorized access; like =0, which is judged as malicious probing behavior, and the corresponding graded protection rules of the target asset S3 are retrieved.

6. The asset-tiered adaptive anti-probing protection method under a zero-trust architecture according to claim 5, characterized in that, Specifically, S5 includes: S501: Real-time capture of permission change events pushed by zero-trust platforms, and synchronous updates. Complete the correction of basic rating parameters; S502: Counts the total frequency of malicious probes intercepted by S4 on the target asset within 10 consecutive minutes. ,Will As a correction coefficient superposition This leads to an upward adjustment of the overall risk rating for assets subjected to high-frequency detection. S503: Adopting the revised new version The value is rematched to the S3 preset Level 3 asset protection rule range.

7. A zero-trust architecture-based asset-tiered adaptive anti-probing protection system, employing the zero-trust architecture-based asset-tiered adaptive anti-probing protection method as described in any one of claims 1-6, characterized in that... The system includes an asset quantification and grading module, a zero-trust trusted data synchronization and mapping module, a tiered and differentiated anti-probing strategy configuration module, an access behavior binary screening and handling module, and a protection strategy adaptive iterative optimization module. Specifically, the asset quantification and grading module includes: The three-dimensional indicator collection submodule uniformly collects three types of fixed quantitative indicators for IT assets across the entire network: business value, confidentiality level, and basic access permissions. The asset classification submodule comprehensively calculates the asset security risk level based on three types of indicators collected, and distinguishes three types of assets according to a fixed value range: core confidential assets, important business assets, and ordinary office assets.

8. The asset-tiered adaptive anti-probing protection system under a zero-trust architecture according to claim 7, characterized in that, The zero-trust trusted data synchronization mapping module specifically includes: The trusted data interface submodule continuously interfaces with the external zero-trust architecture dynamic trusted authentication module, periodically pulling three types of trusted raw data: user identity identifier, device trust status, and access behavior trajectory. The association mapping submodule refreshes the binding mapping relationship between the three at a fixed period, eliminating the delay in permission update data.

9. The asset-tiered adaptive anti-probing protection system under a zero-trust architecture according to claim 7, characterized in that, The hierarchical differentiated anti-probing strategy configuration module specifically includes: The core asset sub-module is configured with full-dimensional asset fingerprint hiding and high-speed detection and interception logic; The important asset sub-module is configured with periodically rotating business characteristic masquerading rules; The ordinary asset submodule only configures simple masking rules for idle ports.

10. The asset-tiered adaptive anti-probing protection system under a zero-trust architecture according to claim 7, characterized in that, The access behavior binary screening and handling module specifically includes: The trusted parameter extraction submodule retrieves the complete set of trusted data output by the zero-trust trusted data synchronization mapping module; The classification and handling submodule performs a binary judgment on access behavior, identifying trusted authorized access behavior and malicious probing and scanning behavior; The adaptive iterative optimization module for the protection strategy specifically includes: The permission change monitoring and correction submodule captures permission change information from the zero-trust platform in real time and corrects the permission indicators required for asset classification. The detection situation statistics and correction submodule counts the frequency of malicious detection and interception per unit time and fine-tunes the overall asset risk level. The rule update and distribution submodule re-matches the protection strategy based on the revised asset level and writes the updated set of protection rules back to the hierarchical differentiated anti-detection strategy configuration module.

Images