A boundary protection device strategy compliance auditing and hidden danger management method based on strategy intention graph and shadow probe watermark

Abstract

The application discloses a kind of based on strategy intent graph and shadow probe watermark boundary protection equipment strategy compliance audit and hidden danger management method, belong to electric power monitoring system network security hidden danger identification and management technical field;The method collects longitudinal encryption device, boundary router, firewall, host probe and the like strategy configuration and asset ledger, certificate, port and alarm data, is converted into structured field and text semantic by strategy parser, generates strategy intent graph with version signature;According to low-risk principle injection carries invisible watermark shadow probe, compares strategy intent, actual link, port service fingerprint and watermark propagation track, calculates strategy non-compliance, cross-border access, high-risk port exposure and management closed loop risk score, and calls hidden danger management knowledge base to generate disposal work order, regression verification and remote supervision report.

Description

Technical Field

[0001] This invention belongs to the field of remote monitoring technology for power monitoring systems, and particularly relates to a method for compliance review and hazard management of boundary protection equipment strategies based on policy intent maps and shadow probe watermarks. Background Technology

[0002] With the continuous improvement of the security protection system of power monitoring systems, vertical encryption devices, boundary routers, firewalls, servers, and host probes have been widely deployed between the production control area and the management information area, undertaking key functions such as cross-security zone access control, policy enforcement, port exposure surface convergence, and security status monitoring. Currently, the network boundary of power monitoring systems is characterized by the heterogeneous coexistence of devices from multiple vendors, frequent policy changes, and dynamic adjustments to business access relationships. Multiple sources of data, such as asset ledgers, certificate status, port service fingerprints, host probe telemetry, and kernel network flow metadata, are collected and stored by different management platforms. Industry compliance requirements are also becoming increasingly detailed, setting auditable, traceable, and governable regulatory objectives for boundary protection device policy configuration, port opening scope, and cross-zone access behavior.

[0003] Existing technical solutions for compliance auditing of border protection device policies mainly include: methods based on static policy text parsing and comparison, which extract firewall or router ACL rules for structured difference comparison; exposure surface detection methods based on active port scanning, which send probe packets to target devices to identify open ports and service versions; anomaly analysis methods based on traffic logs or alarm events, which use NetFlow, sFlow, or security alarm logs to statistically analyze access characteristics and trigger alarms; and policy effectiveness judgment based on a single data source (such as relying solely on border device logs or host probe reports). These solutions are mostly deployed independently, lack semantic-level unified processing for heterogeneous policies from multiple vendors, and heavily rely on manually set rules or anomaly sample annotation.

[0004] However, existing technologies have significant drawbacks: First, static policy text comparison cannot detect the actual execution effect of policies, making it difficult to identify policy version drift and device identity impersonation issues; second, proactive port scanning may disrupt power services, and analyzing any data source such as boundary logs, host probes, or kernel network flows alone cannot cross-verify whether policies are truly effective, posing single-point failure risks such as missing logs, probe bypass, or record tampering; third, the determination of port exposure and policy non-compliance lacks joint modeling with asset roles, network area affiliation, and business baselines, and lacks governance knowledge base support, making it difficult to automatically identify unauthorized cross-area access and form a standardized handling and regression verification closed loop, resulting in high-risk ports remaining open for a long time, and governance work relying on manual experience and being highly repetitive. Summary of the Invention

[0005] Purpose of the Invention: The purpose of this invention is to provide a method for compliance review and risk management of boundary protection equipment policies based on policy intent maps and shadow probe watermarks. By jointly modeling policy semantics, shadow probe watermarks, and multi-source measured data, this method addresses the technical problems in existing technologies, such as static comparison failing to perceive the actual execution effect of policies, single data sources failing to cross-verify the true effectiveness of policies, and the lack of joint modeling of asset area baselines and governance knowledge bases, which makes it difficult to automatically identify unauthorized access and form a closed-loop governance mechanism.

[0006] Technical Solution: The method for compliance review and risk management of boundary protection equipment based on strategy intent graph and shadow probe watermarking as described in this invention includes the following steps:

[0007] S1. During the operation of the power monitoring system, security policy configurations, access control rules, certificate status, asset ledgers, network zone labels, port open status, host probe telemetry, kernel network flow metadata, DNS resolution records, egress access events, and security alarm data are collected from vertical encryption devices, border routers, firewalls, and host probes. Among these, the security policy configurations and access control rules from vertical encryption devices, border routers, firewalls, and host probes from different vendors constitute a multi-vendor heterogeneous policy.

[0008] S2. Input the multi-vendor heterogeneous policies into the policy parser, extract the syntax rules, parameter fields, text semantics and compliance standards, and combine them with device identity, certificate status, asset ledger, port service baseline and network area label to generate a policy intent graph with policy version signature; the policy intent graph includes device nodes, allowed access edges, prohibited access edges, protocol port constraints, timeout retry constraints, vertical encryption channels and cross-area access boundaries;

[0009] S3. Generate a shadow probe that meets low-risk constraints based on the policy intent graph, and write an invisible policy path watermark into the request header, path fragment, request interval, port access sequence or load summary of the shadow probe; the low-risk constraints include using a read-only interface, health check path, idempotent query or path marked as a shadow request by the target service, the probe sampling rate is constrained by a preset sampling rate threshold, the probe validity period is within the probe time window, and the shadow probe does not write real business data, does not change the target device configuration or target device status;

[0010] S4. Observe the device identity, certificate fingerprint, five-tuple, port service, access path, response latency, return code, egress target and watermark propagation result of real service requests and shadow probe requests from the perspectives of boundary protection device logs, host probe telemetry and kernel network respectively.

[0011] S5. Construct a measured access graph based on the boundary protection device logs, host probe telemetry, port service fingerprints, kernel network flow metadata, DNS resolution records and egress access events, and perform a graph comparison between the measured access graph, the shadow probe watermark propagation trajectory and the policy intent graph to calculate policy deviation features, watermark missing features, device log and network flow observation discrepancy features, high-risk port exposure features and policy drift features.

[0012] S6. Input the policy deviation features, watermark missing features, device log and network flow observation discrepancy features, high-risk port exposure features and policy drift features into the risk fusion model, and combine asset importance, device criticality, certificate status, policy version and historical hidden danger accumulation factor to output the boundary protection device policy compliance risk score and hidden danger type.

[0013] S7. Based on the risk score and the type of potential danger, call the network security vulnerability governance knowledge base to generate tasks such as policy rectification, port closure, certificate rotation, access blocking, work order dispatch, status tracking and regression verification.

[0014] S8 generates a remote monitoring report based on policy version, device identity, certificate status, policy intent map, measured access map, shadow probe watermark, port service fingerprint, risk component, hidden danger type, remediation measures, and regression verification results.

[0015] Preferably, in step S1, the security policy configuration and access control rules include at least source service, target service, allowed action, denied action, redirection action, route weight, timeout constraint, retry constraint, egress boundary and policy version;

[0016] The certificate status includes at least the device identity URI, certificate fingerprint, certificate issuer, and certificate expiration time;

[0017] The host probe telemetry and boundary protection device logs include at least the source device, target device, access method, path digest, status code, response latency, number of retries, policy hit status, certificate serial number, policy version number, port service status, and watermark field.

[0018] The kernel network flow metadata includes at least the source host address, destination host address, source port, destination port, protocol type, connection establishment time, connection duration, number of bytes, number of packets, TCP state changes, DNS response address, egress gateway address, and vertical encryption channel identifier.

[0019] Preferably, in step S2, the strategy intent map is generated according to the following formula:

[0020]

[0021]

[0022] in, This represents the strategy intent diagram derived from the control surface at time t. Indicates the strategy intent generation function, This represents the set of control surface strategies at time t. This represents the set of device identities at time t. This indicates the runtime context, which includes the security zone, device account, certificate status, egress rules, and tenant tag. This represents the expected set of device nodes. This indicates the set of edges that are expected to be allowed to be accessed. Represents the set of edge attributes. This represents the signature attribute calculated from the policy version, certificate batch, and timestamp. This represents the expected access edge from service i to service j. A value of 1 indicates that access is allowed, and a value of 0 indicates that access is not allowed. Indicating in strategy version Download service Access target service Authorization function; and Let represent the certificate status of the source service and the target service at time t, respectively. This indicates that the certificate is valid.

[0023] Preferably, the shadow probe and the invisible strategy path watermark are generated according to the following formula:

[0024]

[0025]

[0026] in, This represents the set of shadow probes generated at time t. This represents the probe generation function. Indicates the probe sampling rate. This indicates a service importance constraint. Indicates the probe time window. This represents the r-th shadow probe. and Let represent the source service and target service of the r-th shadow probe, respectively. Indicates the probe path. Indicates the probe's validity period. Represents a one-time random number. Indicates the probe initiation time; This represents the invisible policy path watermark corresponding to the r-th shadow probe. This represents a key-based message authentication function, where k represents the watermark key, sid represents the monitoring session identifier, and the symbol "||" indicates field concatenation. , , , and They jointly participate in watermark calculation to prevent watermarks from being replayed on different paths, through different services, or at different times.

[0027] Preferably, in step S5, the measured access map and watermark propagation trajectory are generated according to the following formula:

[0028]

[0029]

[0030]

[0031] in, This represents the measured access graph observed from the data surface at time t. This represents the measured access graph generation function. This represents the set of host probe telemetry data at time t. This represents the kernel network stream metadata set at time t. This represents the set of DNS resolution records and exit access events at time t. Represents the set of measured device nodes. This represents the set of edges used in the actual test. Represents the set of measured edge attributes; Indicates host probe telemetry With kernel network flow The matching function between them takes a value of 1 to indicate that they correspond to the same device access, and a value of 0 to indicate that they do not match. This function maps device identities to critical host IPs. Indicates the source device. Indicates the target device. dstIP represents the source host address, and dstIP represents the destination host address. and These represent the times of host probe telemetry and kernel network flow, respectively. Indicates the allowed time alignment window; This represents the set of watermark propagation trajectories. This represents the r-th watermark trajectory. , and These represent whether the r-th watermark is observed by the host probe, kernel network flow, and boundary exit, respectively.

[0032] Preferably, in step S5, the policy deviation feature, watermark missing feature, device log and network flow observation divergence feature, high-risk port exposure feature, and policy drift feature are calculated according to the following formulas:

[0033]

[0034]

[0035]

[0036]

[0037]

[0038] Where Mpolicy represents the policy deviation component, and dG represents the graph distance function. This represents a strategy intent map. This represents the measured access graph. The values ​​represent policy deviations from the normalization scale; Mwm represents the missing watermark component; Wexp represents the expected set of observed watermarks; Wobs represents the actual set of observed watermarks; || represents the cardinality of the set; Mdual represents the divergence component between device logs and network flow observations; h represents host probe telemetry records; and k represents kernel network flow records. This represents the joint observation set of host probe telemetry and kernel network flow; Mport represents the high-risk port exposure component, NportHighRisk represents the number of high-risk port hits, and NportAll represents the total number of port accesses; Mdrift represents the policy drift component, revDevice represents the policy version loaded by the boundary protection device, revBaseline represents the compliance baseline policy version, policyState represents the policy state, and abnormal represents the abnormal policy state; the min function is used to truncate the component to the range of 0 to 1, and the max function is used to avoid the denominator being 0.

[0039] Preferably, in step S6, the risk fusion model calculates the risk score and determines the hazard type according to the following formula:

[0040]

[0041]

[0042]

[0043]

[0044] in, This represents the risk feature vector, where Asset represents asset importance, Crit represents equipment criticality, and Hist represents the historical risk accumulation factor. denoted as the historical hazard accumulation factor at time t, and λ as the attenuation coefficient with a value range of 0 to 1, used to reduce the impact of earlier hazards; Let σ represent the risk score at time t, and let σ represent the normalization function. Let w represent the bias term and w represent the weight vector. This represents the inner product of the weight vector and the risk feature vector; Θ represents the hazard type, and Θ represents the hazard type determination function. This represents a strategy intent map. This represents the measured access graph. This represents the set of watermark propagation trajectories. The runtime context is indicated; the types of vulnerabilities include at least one or more of the following: policy non-compliance, missing vertical encryption policy, device identity impersonation, certificate anomaly, policy version drift, missing shadow probe watermark, high-risk port opening, unauthorized cross-region access, and abnormal cross-region access.

[0045] Preferably, in steps S7 and S8, when the risk score exceeds a preset threshold or the hazard type is classified as high-risk, remediation measures are generated and a remote monitoring report is formed according to the following formula:

[0046]

[0047]

[0048] in, This represents the set of governance measures output at time t. This represents the function that generates the governance strategy. This represents the risk score at time t. Indicates the type of hazard. This indicates the asset importance of the affected device or critical host at time t; limit indicates the rate limiting policy; isolate indicates the isolation of critical hosts; rollback indicates rolling back or revising the boundary protection device policy; revokeCert indicates revoking or rotating device certificates; closePort indicates closing high-risk ports; dispatchTicket indicates generating a disposal ticket; report indicates generating a remote monitoring report; Report indicates the remote monitoring report object; S indicates the monitoring session anchor point; P indicates the control plane policy set; I indicates the device identity set; H indicates the host probe telemetry set; K indicates the kernel network flow set; D indicates the DNS resolution record and egress access event set. Represents the set of shadow probes. This represents the risk feature vector. If the risk comes from policy bypass or discrepancies between device logs and network flow observations, the boundary protection device policy should be revised first and access blocking should be implemented. If the risk comes from certificate anomalies or device identity impersonation, the certificate should be rotated or revoked first. If the risk comes from high-risk port opening, the port should be closed first and a regression verification task should be generated.

[0049] The boundary protection equipment strategy compliance review and hidden danger management system based on strategy intent map and shadow probe watermark as described in this invention includes a data acquisition module, a strategy parsing module, a strategy intent generation module, a shadow probe module, a dual observation alignment module, a risk fusion module, a hidden danger management knowledge base module, and a reporting module.

[0050] The data collection module is used to collect policy configurations, access control rules, asset ledgers, certificate status, port status, host probe telemetry, kernel network flow metadata, DNS resolution records, egress access events, and security alarm data.

[0051] The strategy parsing module is used to convert heterogeneous strategies from multiple vendors into structured fields and text semantics;

[0052] The policy intent generation module is used to generate a policy intent graph with a policy version signature;

[0053] The shadow probe module is used to generate and inject low-risk shadow probes with invisible policy path watermarks.

[0054] The dual observation alignment module is used to perform time window alignment and graph comparison on boundary protection device logs, host probe telemetry, kernel network flow metadata, port service fingerprints, DNS resolution records and egress access events;

[0055] The risk fusion module is used to calculate the policy deviation component, watermark missing component, device log and network flow observation divergence component, high-risk port exposure component, and policy drift component, and outputs the risk score and hazard type.

[0056] The hazard management knowledge base module is used to generate management measures, handling work orders, status tracking rules, and regression verification rules.

[0057] The reporting module is used to output remote monitoring reports.

[0058] An electronic device and a computer-readable storage medium are disclosed. The electronic device includes a processor and a memory. The memory stores a computer program, which, when executed by the processor, implements the method for policy compliance review and hazard management of boundary protection devices based on policy intent maps and shadow probe watermarks. The computer-readable storage medium stores a computer program, which, when executed by the processor, implements the method for policy compliance review and hazard management of boundary protection devices based on policy intent maps and shadow probe watermarks.

[0059] Beneficial Effects: Compared with existing technologies, this invention has the following significant advantages: 1. By establishing an automatic replacement mechanism between shadow probes (fast resources) and policy intent maps and governance knowledge bases (slow resources), the compliance judgment pressure is proactively transferred to slow deep verification before the probe observation resources are exhausted, alleviating the decline in grid balancing capacity caused by the exhaustion of fast resources and the idleness of slow resources under the fluctuation of new energy sources, and ensuring frequency stability; 2. Linking the policy intent map with the actual test trajectory of shadow probes carrying invisible watermarks for review, it is possible to verify whether cross-regional access truly follows the policy without decrypting the business payload, alleviating the deviation problem between static rules and actual execution paths; 3. By combining boundary device logs, host probe telemetry and kernel network flow metadata for multi-perspective alignment, it identifies abnormal connections that only appear in the network layer or only appear in the log side, alleviating misjudgments and missed reports caused by single data sources; 4. By integrating asset importance, certificate status, policy version and historical risk factors, and automatically generating closed-loop governance tasks such as blocking, certificate rotation, and port closure, it accurately locates risks such as unauthorized external connections and policy drift, alleviating the problem of lagging manual governance. Attached Figure Description

[0060] Figure 1 This is a schematic diagram of the method flow of the present invention;

[0061] Figure 2 This is a diagram of the risk fusion algorithm of the present invention. Detailed Implementation

[0062] The technical solution of the present invention will be further described below with reference to the accompanying drawings. The steps, data objects, and formulas in the embodiments are used to illustrate the implementation of the technical solution. Without departing from the technical concept of the present invention, equivalent substitutions or combinations can be made according to different plants, different safety areas, different manufacturers' equipment, and different monitoring platforms.

[0063] like Figure 1As shown, the overall processing flow of this invention includes the following steps: collecting data from vertical encryption devices, border routers, firewalls, host probe policies, asset ledgers, port status, and alarms; uniformly processing heterogeneous policies from multiple vendors through a policy parser, extracting syntax rules, parameter fields, text semantics, and compliance standards; generating a policy intent graph with version signatures and marking allowed access edges, prohibited access edges, protocol ports, and cross-region boundaries; generating shadow probes that meet low-risk constraints and writing invisible policy path watermarks to verify the actual policy execution path; aligning border device logs, host probe telemetry, kernel network flow, and port service fingerprints to calculate potential risks; and finally, calling the potential risk management knowledge base to generate rectification suggestions, handling work orders, status tracking, regression verification, and remote monitoring reports. Figure 1 Each processing box in the table corresponds to steps 1 through 7.

[0064] like Figure 2 As shown, the risk fusion algorithm of this invention takes policy P, asset A, port L, host probe H, network flow K, and alarm D as inputs, and completes unified structured processing of syntax rules, parameter fields, text semantics, and compliance standards through a policy parser; on the one hand, it generates a policy intent graph. On the other hand, it generates shadow probe strategy path watermarks. And combine it with the knowledge base of hidden danger management to form actual measurement evidence diagrams. The risk component is then composed of the policy deviation component Mpolicy, the watermark missing component Mwm, the device log and network flow observation divergence component Mdual, the high-risk port exposure component Mport, and the policy drift component Mdrift, and is input into the fusion scoring model. It outputs the type of hidden danger and generates a remediation work order, strategy rectification, status tracking and regression verification report. Figure 2 The algorithm nodes in the steps 2 to 7 correspond to strategy intent graph generation, shadow probe watermark generation, measured access graph generation, risk component calculation, risk fusion and governance output.

[0065] Example 1: A remote monitoring method for automatic review of border protection equipment strategies.

[0066] Step 1: Define the anchor point for the boundary protection policy audit session. A boundary protection policy audit cycle is defined as a monitoring session object determined by the monitoring platform identifier, site identifier, security zone, policy version, certificate batch, and start time. Under this monitoring session, the following sets of data are collected: boundary protection device policy set, device identity set, host probe telemetry set, kernel network flow set, port service fingerprint set, DNS resolution set, and egress access set.

[0067] A session can be represented by S, where S represents a single monitoring session; mid is the monitoring platform or mesh identifier; cid is the cluster identifier; ns is the set of security zones; rev is the control plane policy version; ca is the certificate batch; and t0 is the start time of the monitoring period. The control plane policy set is represented as... ,in For the i-th strategy, and They are the source service and the target service, respectively. Indicates an action to allow, deny, or redirect. Indicates the route weight. Indicates a timeout constraint. This indicates a retry constraint. Indicates the export boundary. Indicates the strategy version.

[0068] The device identity set is represented as ,in For the j-th device identity object, Indicates the service name. Indicates the device account. Indicates a safe zone. The device identity URI, Represents the certificate fingerprint. Indicates the certificate issuer, Indicates the certificate expiration time. The host probe telemetry set is represented as... The kernel network flow set is represented as The DNS and egress access event set is represented as H, K, and D are used together to reconstruct the actual behavior of encrypted boundary access traffic at the device identity layer and network connectivity layer.

[0069] Step 2: Policy Intent Map Generation. A policy intent map is generated based on the perimeter protection device policy, device identity, asset ledger, port service baseline, and operational context. The policy intent map can be represented as follows: ,in This represents the expected access graph derived from the control surface at time t. Indicates the strategy intent generation function, This represents the set of control surface strategies at time t. This represents the set of device identities at time t. This indicates the runtime context, including the security zone, device account, certificate status, exit rules, and tenant label. This represents the expected set of device nodes. This indicates the set of edges that are expected to be allowed to be accessed. Represents the set of edge attributes. This represents the signature attribute calculated from the policy version, certificate batch, and timestamp.

[0070] The expected visit edge in the strategy intent graph can be represented as .in, This represents the expected access edge from service i to service j. A value of 1 indicates that access is allowed, and a value of 0 indicates that access is not allowed. Indicating in strategy version Download service Access target service Authorization function; and These represent the certificate status of the source service and the target service at time t, respectively, with "valid" indicating that the certificate is valid. This allows us to express, under the current policy version, device certificate status, and compliance standards, which devices should be allowed to access each other, which access should be prohibited, which port services should be closed, and which cross-regional accesses should enter a vertical encryption channel.

[0071] Step 3: Shadow Probe and Policy Path Watermark Generation. A set of shadow probes is generated without altering the target service's state. Shadow probes can use read-only interfaces, health check paths, idempotent queries, or paths explicitly marked as shadow requests by the target service. For devices that do not allow custom headers, an invisible watermark can be formed using port access sequences or request interval sequences.

[0072] The set of shadow probes can be represented as .in, This represents the set of shadow probes generated at time t. This represents the probe generation function. Indicates the probe sampling rate. This indicates a service importance constraint. Indicates the probe time window. This represents the r-th shadow probe. and Let represent the source service and target service of the r-th shadow probe, respectively. Indicates the probe path. Indicates the probe's validity period. Represents a one-time random number. Indicates the probe initiation time.

[0073] Invisible strategy path watermarking can be represented as .in, This represents the invisible policy path watermark corresponding to the r-th shadow probe. This represents a key-based message authentication function, where k represents the watermark key, sid represents the monitoring session identifier, and the symbol "||" indicates field concatenation. , , , and They jointly participate in watermark calculation to prevent watermarks from being replayed on different paths, through different services, or at different times.

[0074] Step 4: Generation of Measured Access Graph and Watermark Propagation Trajectory. Time-window alignment is performed on the boundary protection device logs, host probe telemetry, port service fingerprints, and kernel network flow metadata to construct the measured access graph. For shadow probes, the propagation status of each watermark in the boundary protection device, host probe, target device, egress gateway, and kernel flow is further recorded.

[0075] The measured access graph can be represented as follows .in, This represents the measured access graph observed from the data surface at time t. This represents the measured access graph generation function. This represents the set of host probe telemetry data at time t. This represents the kernel network stream metadata set at time t. This represents the set of DNS resolution records and exit access events at time t. Represents the set of measured device nodes. This represents the set of edges used in the actual test. This represents the set of measured edge attributes.

[0076] The matching function between host probe telemetry and kernel network flow can be expressed as: The `Match` function takes a value of 1 to indicate that both devices accessed the same device, and a value of 0 to indicate that they do not match; `mapIP` is used to map device identities to critical host IPs. This represents the allowed time alignment window. The set of watermark propagation trajectories can be represented as... ,in This represents the r-th watermark trajectory. , and These represent whether the r-th watermark is observed by the host probe, kernel network flow, and boundary exit, respectively.

[0077] Step 5: Risk Component Calculation. Calculate the policy deviation component, watermark missing component, device log / network flow observation divergence component, high-risk port exposure component, and policy drift component separately. The policy deviation component is represented as... , is used to measure the graph structure difference between the policy intent graph and the measured access graph; dG represents the graph distance function, which can be obtained by weighting missing edges, overweighted edges, weight offsets and path offsets; εR represents the policy deviation normalization scale.

[0078] The missing watermark component is represented as Where Wexp represents the expected set of watermarks to be observed, and Wobs represents the actual set of watermarks observed. The divergence component between device logs and network flow observations is represented as follows: ,in This represents the joint observation set of host probe telemetry and kernel network flow. The high-risk port exposure component is represented as Mport=min(1,NportHighRisk / max(NportAll,1)), where NportHighRisk represents the number of high-risk port hits, and NportAll represents the total number of port accesses. The policy drift component is represented as Mdrift=1[revDevice≠revBaseline∨policyState=abnormal], where revDevice represents the policy version loaded by the perimeter protection device, revBaseline represents the compliance baseline policy version, policyState represents the policy state, and abnormal indicates an abnormal policy state. The min function truncates the component to the range of 0 to 1, and the max function avoids a denominator of 0.

[0079] Step 6: Risk Fusion Model. Construct a risk feature vector and calculate a risk score by combining asset importance, certificate status, strategy version, and historical risk accumulation factors. The risk feature vector is represented as follows: Where Asset represents asset importance, Crit represents equipment criticality, and Hist represents the historical hazard accumulation factor. The historical hazard accumulation factor is expressed as... , where λ represents the attenuation coefficient, which ranges from 0 to 1 and is used to reduce the impact of early hidden dangers.

[0080] Risk score is expressed as ,in Let σ represent the risk score at time t, and let σ represent the normalization function. Let w represent the bias term and w represent the weight vector. This represents the inner product of the weight vector and the risk feature vector. The hazard type is represented as... Θ represents the vulnerability type determination function, whose inputs include risk feature vector, policy intent map, measured access map, watermark propagation trajectory, and runtime context. Vulnerability types can include policy non-compliance, missing vertical encryption policy, device identity impersonation, certificate anomaly, policy version drift, missing shadow probe watermark, high-risk port opening, unauthorized cross-region access, and abnormal cross-region access.

[0081] Step 7: Hazard Management Control Function. When the risk score exceeds a preset threshold, a disposal strategy is generated based on the hazard type, asset importance, and management knowledge base rules. The management measures can be represented as follows: .in, This represents the set of governance measures output at time t. This represents the function that generates the governance strategy. This represents the risk score at time t. Indicates the type of hazard. This indicates the asset importance of the affected device or critical host at time t. Limit indicates the rate limiting policy, isolate indicates the isolation of critical hosts, rollback indicates the rollback or revision of the boundary protection device policy, revokeCert indicates the revocation or rotation of device certificates, closePort indicates the closure of high-risk ports, dispatchTicket indicates the generation of a disposal ticket, and report indicates the generation of a remote monitoring report.

[0082] If the risk stems from policy bypass or discrepancies between device logs and network flow observations, priority should be given to revising the perimeter protection device policy and implementing access blocking; if the risk originates from certificate anomalies or device identity impersonation, priority should be given to rotating or revoking certificates; if the risk arises from open high-risk ports, priority should be given to closing the ports and generating regression verification tasks. The governance knowledge base may include hazard classification standards, handling cases, industry standards, regression verification rules, and report templates, thereby transforming findings into an actionable, traceable, and verifiable governance loop.

[0083] Example 2: Based on a similar inventive concept, this embodiment of the invention also provides a system for compliance review and hazard management of boundary protection equipment strategies based on strategy intent maps and shadow probe watermarks, corresponding to the method for compliance review and hazard management of boundary protection equipment strategies based on strategy intent maps and shadow probe watermarks. The system includes a data acquisition module, a strategy parsing module, a strategy intent generation module, a shadow probe module, a dual observation alignment module, a risk fusion module, a hazard management knowledge base module, and a reporting module.

[0084] The data collection module is used to collect policy configurations, access control rules, asset ledgers, certificate status, port status, host probe telemetry, kernel network flow metadata, DNS resolution records, egress access events, and security alarm data.

[0085] The strategy parsing module is used to convert heterogeneous strategies from multiple vendors into structured fields and text semantics;

[0086] The policy intent generation module is used to generate a policy intent graph with a policy version signature;

[0087] The shadow probe module is used to generate and inject low-risk shadow probes with invisible policy path watermarks.

[0088] The dual observation alignment module is used to perform time window alignment and graph comparison on boundary protection device logs, host probe telemetry, kernel network flow metadata, port service fingerprints, DNS resolution records and egress access events;

[0089] The risk fusion module is used to calculate the policy deviation component, watermark missing component, device log and network flow observation divergence component, high-risk port exposure component, and policy drift component, and outputs the risk score and hazard type.

[0090] The hazard management knowledge base module is used to generate management measures, handling work orders, status tracking rules, and regression verification rules.

[0091] The reporting module is used to output remote monitoring reports.

[0092] Example 3: Extended Implementation for Multi-Region Power Monitoring Systems. In a multi-region power monitoring system scenario, different power plants, dispatching stations, and security zones have different asset ledgers, boundary policies, and port service baselines. This invention generates an independent policy intent graph within each security zone and imposes higher probe coverage and stricter port service constraints on cross-security zone access edges. When a critical device bypasses boundary protection devices to directly access devices in another security zone, a cross-region 5-tuple will appear in the kernel network flow, but no corresponding access record will be found in the boundary protection device logs or host probe telemetry. The divergence component between the device logs and network flow observations increases. If the connection is also not a allowed edge in the policy intent graph, the policy deviation component increases, and the system classifies the vulnerability as unauthorized cross-region access.

[0093] Example 4: Generation of Hazard Management Knowledge Base and Remote Monitoring Report. When the risk score exceeds the threshold or the hazard type is classified as high-risk, the network security hazard management knowledge base is invoked to generate a remote monitoring report and a handling work order. The report includes policy version, device identity, certificate status, policy intent diagram, measured access diagram, shadow probe watermark, port service fingerprint, risk components, hazard type, remediation measures, and regression verification results. The report object can be represented as... Where Report represents the remote monitoring report object, S represents the monitoring session anchor point, P represents the perimeter protection policy set, I represents the device identity set, H represents the host probe telemetry set, K represents the kernel network flow set, and D represents the DNS and egress access event set. and These represent the strategy intent graph and the measured access graph, respectively. Represents the set of shadow probes. Indicates the watermark propagation trajectory, Represents the risk feature vector. Indicates risk score, Indicates the type of hazard. This indicates the governance measures that are ultimately implemented.

[0094] Through the above technical solution, without disrupting power monitoring services, with heterogeneous policy configurations and some protocol payloads that cannot be directly decrypted, the joint analysis of the policy intent to be executed by the boundary protection device, the actual access evidence of the device, the port service fingerprint, and the propagation trajectory of the shadow probe watermark can discover network security vulnerabilities that are difficult to identify by traditional static policy auditing, active port scanning, or single alarm analysis. It can also output governance measures, handling work orders, status tracking, regression verification, and remote monitoring reports.

[0095] Example 5: The present invention also discloses an electronic device.

[0096] Specifically, the electronic device can be a desktop computer, laptop computer, handheld computer, or cloud server, etc. This computer device may include, but is not limited to, a processor and memory. The processor and memory can be connected via a bus or other means. The processor can be a Central Processing Unit (CPU). The processor can also be other general-purpose processors, digital signal processors (DSPs), application-specific integrated circuits (ASICs), field-programmable gate arrays (FPGAs) or other programmable logic devices, graphics processing units (GPUs), embedded neural network processing units (NPUs) or other dedicated deep learning coprocessors, discrete gate or transistor logic devices, discrete hardware components, or combinations of the above types of chips.

[0097] Memory, as a non-transitory computer-readable storage medium, can be used to store non-transitory software programs, non-transitory computer-executable programs, and modules. The processor executes various functional applications and data processing by running non-transitory software programs, instructions, and modules stored in memory. Memory may include a program storage area and a data storage area. The program storage area may store the control unit and the application program required for at least one function; the data storage area may store data created by the processor, etc. Furthermore, memory may include high-speed random access memory and non-transitory memory. In some embodiments, memory may optionally include memory remotely located relative to the processor, which can be connected to the processor via a network. Examples of such networks include, but are not limited to, the Internet, corporate intranets, local area networks, mobile communication networks, and combinations thereof.

[0098] Example 6: The present invention also discloses a computer-readable storage medium.

[0099] Specifically, the computer-readable storage medium is used to store a computer program, which, when executed by a processor, implements the methods described in the above method implementation.

[0100] Those skilled in the art will understand that all or part of the processes in the methods described above can be implemented by a computer program instructing related hardware. The program can be stored in a computer-readable storage medium, and when executed, it can include the processes of the embodiments described above. The storage medium can be a magnetic disk, optical disk, read-only memory (ROM), random access memory (RAM), flash memory, hard disk drive (HDD), or solid-state drive (SSD), etc.; the storage medium can also include combinations of the above types of memory.

Claims

1. A method for policy compliance review and hazard management of boundary protection equipment based on policy intent graphs and shadow probe watermarks, characterized in that, Includes the following steps: S1. During the operation of the power monitoring system, security policy configurations, access control rules, certificate status, asset ledgers, network zone labels, port open status, host probe telemetry, kernel network flow metadata, DNS resolution records, egress access events, and security alarm data are collected from vertical encryption devices, border routers, firewalls, and host probes. Among these, the security policy configurations and access control rules from vertical encryption devices, border routers, firewalls, and host probes from different vendors constitute a multi-vendor heterogeneous policy. S2. Input the multi-vendor heterogeneous policies into the policy parser, extract the syntax rules, parameter fields, text semantics and compliance standards, and combine them with device identity, certificate status, asset ledger, port service baseline and network area label to generate a policy intent graph with policy version signature; the policy intent graph includes device nodes, allowed access edges, prohibited access edges, protocol port constraints, timeout retry constraints, vertical encryption channels and cross-area access boundaries; S3. Generate a shadow probe that meets low-risk constraints based on the policy intent graph, and write an invisible policy path watermark into the request header, path fragment, request interval, port access sequence or load summary of the shadow probe; the low-risk constraints include using a read-only interface, health check path, idempotent query or path marked as a shadow request by the target service, the probe sampling rate is constrained by a preset sampling rate threshold, the probe validity period is within the probe time window, and the shadow probe does not write real business data, does not change the target device configuration or target device status; S4. Observe the device identity, certificate fingerprint, five-tuple, port service, access path, response latency, return code, egress target and watermark propagation result of real service requests and shadow probe requests from the perspectives of boundary protection device logs, host probe telemetry and kernel network respectively. S5. Construct a measured access graph based on the boundary protection device logs, host probe telemetry, port service fingerprints, kernel network flow metadata, DNS resolution records and egress access events, and perform a graph comparison between the measured access graph, the shadow probe watermark propagation trajectory and the policy intent graph to calculate policy deviation features, watermark missing features, device log and network flow observation discrepancy features, high-risk port exposure features and policy drift features. S6. Input the policy deviation features, watermark missing features, device log and network flow observation discrepancy features, high-risk port exposure features and policy drift features into the risk fusion model, and combine asset importance, device criticality, certificate status, policy version and historical hidden danger accumulation factor to output the boundary protection device policy compliance risk score and hidden danger type. S7. Based on the risk score and the type of potential danger, call the network security vulnerability governance knowledge base to generate tasks such as policy rectification, port closure, certificate rotation, access blocking, work order dispatch, status tracking and regression verification. S8 generates a remote monitoring report based on policy version, device identity, certificate status, policy intent map, measured access map, shadow probe watermark, port service fingerprint, risk component, hidden danger type, remediation measures, and regression verification results.

2. The method according to claim 1, characterized in that, In step S1, the security policy configuration and access control rules include at least source service, target service, allowed action, denied action, redirection action, route weight, timeout constraint, retry constraint, egress boundary and policy version; The certificate status includes at least the device identity URI, certificate fingerprint, certificate issuer, and certificate expiration time; The host probe telemetry and boundary protection device logs include at least the source device, target device, access method, path digest, status code, response latency, number of retries, policy hit status, certificate serial number, policy version number, port service status, and watermark field. The kernel network flow metadata includes at least the source host address, destination host address, source port, destination port, protocol type, connection establishment time, connection duration, number of bytes, number of packets, TCP state changes, DNS response address, egress gateway address, and vertical encryption channel identifier.

3. The method according to claim 2, characterized in that, In step S2, the strategy intent map is generated according to the following formula: ; ;in, This represents the strategy intent diagram derived from the control surface at time t. Indicates the strategy intent generation function, This represents the set of control surface strategies at time t. This represents the set of device identities at time t. This indicates the runtime context, which includes the security zone, device account, certificate status, egress rules, and tenant tag. This represents the expected set of device nodes. This indicates the set of edges that are expected to be allowed to be accessed. Represents the set of edge attributes. This represents the signature attribute calculated from the policy version, certificate batch, and timestamp. This represents the expected access edge from service i to service j. A value of 1 indicates that access is allowed, and a value of 0 indicates that access is not allowed. Indicating in strategy version Download service Access target service Authorization function; and Let represent the certificate status of the source service and the target service at time t, respectively. This indicates that the certificate is valid.

4. The method according to claim 3, characterized in that, The shadow probe and the invisible strategy path watermark are generated according to the following formula: ; ;in, This represents the set of shadow probes generated at time t. This represents the probe generation function. Indicates the probe sampling rate. This indicates a service importance constraint. Indicates the probe time window. This represents the r-th shadow probe. and Let R represent the source service and target service of the r-th shadow probe, respectively. Indicates the probe path. Indicates the probe's validity period. Represents a one-time random number. Indicates the probe initiation time; This represents the invisible policy path watermark corresponding to the r-th shadow probe. This represents a key-based message authentication function, where k represents the watermark key, sid represents the monitoring session identifier, and the symbol "||" indicates field concatenation. , , , and They jointly participate in watermark calculation to prevent watermarks from being replayed on different paths, through different services, or at different times.

5. The method according to claim 4, characterized in that, In step S5, the measured access map and watermark propagation trajectory are generated according to the following formula: ; ; ;in, This represents the measured access graph observed from the data surface at time t. This represents the measured access graph generation function. This represents the set of host probe telemetry data at time t. This represents the kernel network stream metadata set at time t. This represents the set of DNS resolution records and exit access events at time t. Represents the set of measured device nodes. This represents the set of edges used in the actual test. Represents the set of measured edge attributes; Indicates host probe telemetry With kernel network flow The matching function between them takes a value of 1 to indicate that they correspond to the same device access, and a value of 0 to indicate that they do not match. This function maps device identities to critical host IPs. Indicates the source device. Indicates the target device. dstIP represents the source host address, and dstIP represents the destination host address. and These represent the times of host probe telemetry and kernel network flow, respectively. Indicates the allowed time alignment window; This represents the set of watermark propagation trajectories. This represents the r-th watermark trajectory. , and These represent whether the r-th watermark is observed by the host probe, kernel network flow, and boundary exit, respectively.

6. The method according to claim 5, characterized in that, In step S5, the policy deviation feature, watermark missing feature, device log and network flow observation divergence feature, high-risk port exposure feature, and policy drift feature are calculated according to the following formulas: ; ; ; ; Where Mpolicy represents the policy deviation component, and dG represents the graph distance function. This represents a strategy intent map. This represents the measured access graph. The values ​​represent policy deviations from the normalization scale; Mwm represents the missing watermark component; Wexp represents the expected set of observed watermarks; Wobs represents the actual set of observed watermarks; || represents the cardinality of the set; Mdual represents the divergence component between device logs and network flow observations; h represents host probe telemetry records; and k represents kernel network flow records. This represents the joint observation set of host probe telemetry and kernel network flow; Mport represents the high-risk port exposure component, NportHighRisk represents the number of high-risk port hits, and NportAll represents the total number of port accesses; Mdrift represents the policy drift component, revDevice represents the policy version loaded by the boundary protection device, revBaseline represents the compliance baseline policy version, policyState represents the policy state, and abnormal represents the abnormal policy state; the min function is used to truncate the component to the range of 0 to 1, and the max function is used to avoid the denominator being 0.

7. The method according to claim 6, characterized in that, In step S6, the risk fusion model calculates the risk score and determines the hazard type according to the following formula: ; ; ; ;in, This represents the risk feature vector, where Asset represents asset importance, Crit represents equipment criticality, and Hist represents the historical risk accumulation factor. denoted as the historical hazard accumulation factor at time t, and λ as the attenuation coefficient with a value range of 0 to 1, used to reduce the impact of earlier hazards; Let σ represent the risk score at time t, and let σ represent the normalization function. Let w represent the bias term and w represent the weight vector. This represents the inner product of the weight vector and the risk feature vector; Θ represents the hazard type, and Θ represents the hazard type determination function. This represents a strategy intent map. This represents the measured access graph. This represents the set of watermark propagation trajectories. The runtime context is indicated; the types of vulnerabilities include at least one or more of the following: policy non-compliance, missing vertical encryption policy, device identity impersonation, certificate anomaly, policy version drift, missing shadow probe watermark, high-risk port opening, unauthorized cross-region access, and abnormal cross-region access.

8. The method according to claim 7, characterized in that, In steps S7 and S8, when the risk score exceeds a preset threshold or the hazard type is classified as high-risk, remediation measures are generated and a remote monitoring report is formed according to the following formula: ; ;in, This represents the set of governance measures output at time t. This represents the function that generates the governance strategy. This represents the risk score at time t. Indicates the type of hazard. This indicates the asset importance of the affected device or critical host at time t; limit indicates the rate limiting policy; isolate indicates the isolation of critical hosts; rollback indicates rolling back or revising the boundary protection device policy; revokeCert indicates revoking or rotating device certificates; closePort indicates closing high-risk ports; dispatchTicket indicates generating a disposal ticket; report indicates generating a remote monitoring report; Report indicates the remote monitoring report object; S indicates the monitoring session anchor point; P indicates the control plane policy set; I indicates the device identity set; H indicates the host probe telemetry set; K indicates the kernel network flow set; D indicates the DNS resolution record and egress access event set. Represents the set of shadow probes. This represents the risk feature vector. If the risk comes from policy bypass or discrepancies between device logs and network flow observations, the boundary protection device policy should be revised first and access blocking should be implemented. If the risk comes from certificate anomalies or device identity impersonation, the certificate should be rotated or revoked first. If the risk comes from high-risk port opening, the port should be closed first and a regression verification task should be generated.

9. A system for policy compliance review and hazard management of boundary protection equipment based on policy intent graphs and shadow probe watermarking, characterized in that, It includes a data acquisition module, a strategy parsing module, a strategy intent generation module, a shadow probe module, a dual observation alignment module, a risk fusion module, a hazard management knowledge base module, and a reporting module; The data collection module is used to collect policy configurations, access control rules, asset ledgers, certificate status, port status, host probe telemetry, kernel network flow metadata, DNS resolution records, egress access events, and security alarm data. The strategy parsing module is used to convert heterogeneous strategies from multiple vendors into structured fields and text semantics; The policy intent generation module is used to generate a policy intent graph with a policy version signature; The shadow probe module is used to generate and inject low-risk shadow probes with invisible policy path watermarks. The dual observation alignment module is used to perform time window alignment and graph comparison on boundary protection device logs, host probe telemetry, kernel network flow metadata, port service fingerprints, DNS resolution records and egress access events; The risk fusion module is used to calculate the policy deviation component, watermark missing component, device log and network flow observation divergence component, high-risk port exposure component, and policy drift component, and outputs the risk score and hazard type. The hazard management knowledge base module is used to generate management measures, handling work orders, status tracking rules, and regression verification rules. The reporting module is used to output remote monitoring reports.

10. An electronic device and a computer-readable storage medium, characterized in that, The electronic device includes a processor and a memory, the memory storing a computer program that, when executed by the processor, implements the method according to any one of claims 1 to 8; the computer-readable storage medium stores a computer program that, when executed by the processor, implements the method according to any one of claims 1 to 8.

Images