An in-situ security defense method, system, device and medium for an electric power isolation device in an extreme environment

Abstract

The application discloses an extreme environment-oriented power isolation device endogenous security defense method, system, equipment and medium, and belongs to the technical field of power isolation device security defense, and comprises the following steps: determining a key process abnormality proportion and an interface alarm area proportion according to process running data and external interface monitoring data; determining a traffic deviation degree according to network traffic and a historical traffic baseline, and adjusting the weights of both to form a composite security situation value; combining a mode switching threshold and a continuous time length to form a candidate mode switching judgment result, and switching the defense mode after confirmation through heterogeneous detection and redundant arbitration. Through the business traffic adaptive weight, the continuous time length constraint and the heterogeneous redundant arbitration, the application avoids directly triggering the defense mode switching caused by the increase of normal business traffic, the short-term situation fluctuation or the low confidence detection result.

Description

Technical Field

[0001] This invention relates to the field of security defense technology for power isolation devices, specifically to an intrinsic security defense method, system, equipment, and medium for power isolation devices in extreme environments. Background Technology

[0002] Power isolation devices are used for data isolation and controlled interaction between different security zones. During operation, they need to determine the current security status based on process running status, external interface alarms and network traffic changes, and adjust the defense mode accordingly.

[0003] Existing power isolation devices typically use fixed thresholds or single-item detection results for anomaly detection. When peak business periods lead to a simultaneous increase in network traffic and interface alarms, fixed judgment conditions are difficult to distinguish between normal business changes and traffic anomalies caused by attacks, which can easily lead to unnecessary switching of defense modes. When monitoring data shows instantaneous pulses or short-term fluctuations, a single violation of the judgment threshold may also directly trigger defense actions.

[0004] Furthermore, when mode switching is determined directly based on a single detection result, local detection anomalies may be directly transmitted to the mode switching process. How to combine internal process status, external interface status, and network traffic changes to determine persistent abnormal states, and to re-verify candidate determination results before mode switching, is a problem that needs to be solved in the security defense process of power isolation devices. Summary of the Invention

[0005] In view of the above-mentioned problems, the present invention provides an intrinsic security defense method, system, device and medium for power isolation devices in extreme environments.

[0006] Therefore, the technical problem solved by the present invention is that existing power isolation devices have difficulty accurately determining whether to switch defense modes when network service status changes, instantaneous monitoring data fluctuates, and different detection results are inconsistent. They are prone to incorrect switching of defense modes due to increased normal service traffic, short-term abnormal changes, or misjudgment of a single detection result, or the technical problem of delayed response to continuous abnormal states due to overly conservative judgment conditions.

[0007] To address the aforementioned technical problems, this invention provides the following technical solution: an intrinsic security defense method for power isolation devices in extreme environments, comprising, Determine the proportion of critical process anomalies based on process execution data, and determine the proportion of interface alarm areas based on external interface monitoring data; The traffic deviation is determined based on the network traffic and the historical traffic baseline. The weight allocation of the critical process anomaly ratio and the interface alarm area ratio is determined based on the traffic deviation. The critical process anomaly ratio and the interface alarm area ratio are weighted according to the weight allocation to determine the composite security posture value. The composite security situation value is subjected to a mode switching threshold determination with a duration constraint to form a candidate mode switching determination result; Heterogeneous detection is performed based on the candidate mode switching determination result to form a heterogeneous detection result. Redundancy arbitration is then performed based on the heterogeneous detection result to form a redundant arbitration result. When the redundant arbitration result confirms the candidate mode switching determination result, a mode switching instruction is generated, and the defense mode of the power isolation device is switched according to the mode switching instruction.

[0008] As a preferred embodiment of the intrinsic security defense method for power isolation devices in extreme environments described in this invention, the step of determining the proportion of critical process anomalies based on process operation data and determining the proportion of interface alarm areas based on external interface monitoring data includes: The number of abnormal critical processes is determined based on the process execution data, and the abnormality ratio of critical processes is determined based on the ratio of the number of abnormal critical processes to the total number of critical processes. The monitoring area that triggers the alarm rule is determined based on the external interface monitoring data; The number of monitoring areas that trigger alarm rules is determined by deduplicating the count. The interface alarm area ratio is determined based on the ratio of the number of monitored areas that trigger the alarm rule to the total number of monitored areas.

[0009] As a preferred embodiment of the intrinsic security defense method for power isolation devices in extreme environments described in this invention, the determination of the flow deviation and the weight allocation includes: The traffic deviation is determined based on the ratio of the network traffic to the historical traffic baseline; When the traffic deviation is greater than the traffic determination threshold and the critical process abnormality ratio is less than the critical process abnormality ratio threshold, the weight of the critical process abnormality ratio and the weight of the interface alarm area ratio are determined according to the traffic deviation to form the weight allocation. Once the weight allocation is formed, if the duration during which the traffic deviation is continuously greater than the traffic determination threshold reaches the confirmation duration, the weight allocation is maintained. When the traffic deviation is less than the weight recovery threshold, the weight allocation for the next cycle is determined cycle by cycle according to the preset recovery step size until the weight allocation is restored to the initial weight allocation.

[0010] As a preferred embodiment of the intrinsic security defense method for power isolation devices in extreme environments described in this invention, the determination of the composite security status value includes: The abnormal proportion of the critical process and the alarm area of ​​the interface are weighted according to the weight allocation to form the original composite security posture value. The magnitude of the situation change is determined by the absolute value of the difference between adjacent composite security situation values ​​in the historical composite security situation value sequence; When two consecutive changes in the situation are both greater than the change amplitude threshold, a valid fluctuation is determined, and the fluctuation frequency is determined based on the number of valid fluctuations within the statistical period. The damping parameters are determined based on the comparison between the fluctuation frequency and the fluctuation frequency threshold. The composite safety situation value is determined by weighting the previous cycle composite safety situation value with the original composite safety situation value based on the damping parameters.

[0011] As a preferred embodiment of the intrinsic security defense method for power isolation devices in extreme environments described in this invention, the determination of the mode switching threshold with duration constraints on the composite security status value includes: The mode switching threshold includes a first mode switching threshold and a second mode switching threshold, wherein the first mode switching threshold is greater than the second mode switching threshold; When the power isolation device is in the normal defense mode, and the composite security situation value is greater than the first mode switching threshold for a duration of a first duration, a candidate mode switching determination result for switching to the isolation defense mode is formed. When the power isolation device is in the isolation defense mode, and the duration for which the composite security status value is continuously less than the second mode switching threshold reaches the second duration, a candidate mode switching determination result for switching to the conventional defense mode is formed.

[0012] As a preferred embodiment of the intrinsic security defense method for power isolation devices in extreme environments described in this invention, the heterogeneous detection includes signature detection, process anomaly detection, and traffic resource anomaly detection. A majority vote is conducted based on the heterogeneous detection results to form a voting result, and the confidence weight is determined based on the historical accuracy. When the heterogeneous detection results are consistent, the redundant arbitration result is formed based on the voting result; When the heterogeneous detection results are inconsistent, a majority confidence weight is formed by summing the confidence weights of the heterogeneous detections that are consistent with the voting results, and a minority confidence weight is formed by summing the confidence weights of the heterogeneous detections that are inconsistent with the voting results. When the majority confidence weight is greater than or equal to the minority confidence weight, the redundant arbitration result is formed based on the voting result; when the majority confidence weight is less than the minority confidence weight, the heterogeneous detection is re-executed.

[0013] As a preferred embodiment of the intrinsic security defense method for power isolation devices in extreme environments described in this invention, it further includes: When the redundant arbitration result confirms the candidate mode switching determination result for switching to the isolation defense mode, the difference between the composite security situation value and the first mode switching threshold is determined, and the self-healing level is determined based on the comparison result between the difference and the self-healing grading threshold. The attack type is determined based on the heterogeneous detection results, the self-healing operation is determined based on the attack type and the self-healing level, and the self-healing operation is executed.

[0014] This invention provides an intrinsic security defense system for power isolation devices designed for extreme environments.

[0015] To address the aforementioned technical problems, the present invention provides the following technical solution: an intrinsic security defense system for power isolation devices in extreme environments, comprising: a processing module, configured to determine the proportion of critical process anomalies based on process operation data, determine the proportion of interface alarm areas based on external interface monitoring data, determine the traffic deviation based on network traffic and historical traffic baseline, determine the weight allocation of the proportion of critical process anomalies and the proportion of interface alarm areas based on the traffic deviation, weight the proportion of critical process anomalies and the proportion of interface alarm areas based on the weight allocation to determine a composite security posture value, perform a mode switching threshold determination with a duration constraint on the composite security posture value to form a candidate mode switching determination result, perform heterogeneous detection based on the candidate mode switching determination result to form a heterogeneous detection result, and perform redundancy arbitration based on the heterogeneous detection result to form a redundant arbitration result; The execution module is used to generate a mode switching instruction when the redundant arbitration result confirms the candidate mode switching determination result, and to switch the defense mode of the power isolation device according to the mode switching instruction.

[0016] The present invention provides a computer device, including a memory and a processor, wherein the memory stores a computer program, and the processor executes the computer program to implement the steps of the described intrinsic security defense method for a power isolation device for extreme environments.

[0017] The present invention provides a computer-readable storage medium having a computer program stored thereon, wherein the computer program, when executed by a processor, implements the steps of the described intrinsic security defense method for a power isolation device for extreme environments.

[0018] The beneficial effects of this invention are as follows: This application adjusts the weight allocation of the critical process abnormality ratio and the interface alarm area ratio according to the traffic deviation of network traffic relative to the historical traffic baseline. When network traffic increases but critical processes do not show abnormalities synchronously, the contribution of the interface alarm area ratio to the composite security posture value is reduced accordingly, thus avoiding the increase of normal business traffic from directly driving the composite security posture value to change towards the mode switching threshold.

[0019] This application adjusts the damping parameters based on the fluctuations of historical composite security situation values, and uses the comparison results of composite security situation values ​​and mode switching thresholds, along with their duration, to form candidate mode switching determination results. This ensures that short-term situation fluctuations will not directly generate mode switching commands due to a single crossing of the mode switching threshold, and reduces frequent switching of defense modes caused by repeated changes in composite security situation values ​​near the threshold.

[0020] After the candidate mode switching determination result is formed, this application generates heterogeneous detection results through signature detection, process anomaly detection, and traffic resource anomaly detection, and then performs majority voting and confidence comparison in sequence; when the confidence of the majority of detection results is insufficient, the current candidate mode switching determination result is not executed and re-detection is performed, so that a single detection result or a majority of low-confidence results cannot directly trigger the defense mode switching of the power isolation device. Attached Figure Description

[0021] To more clearly illustrate the technical solutions of the embodiments of the present invention, the accompanying drawings used in the description of the embodiments will be briefly introduced below. Obviously, the accompanying drawings described below are only some embodiments of the present invention. For those skilled in the art, other drawings can be obtained based on these drawings without creative effort.

[0022] Figure 1 This is a general flowchart of an intrinsic security defense method for power isolation devices in extreme environments, provided as an embodiment of the present invention.

[0023] Figure 2 A redundancy arbitration flowchart is provided for an embodiment of the present invention of an intrinsic security defense method for power isolation devices in extreme environments.

[0024] Figure 3 This is a module interaction timing diagram of an intrinsic security defense system for power isolation devices in extreme environments, provided as an embodiment of the present invention. Detailed Implementation

[0025] To make the present invention more apparent and understandable, the specific embodiments of the present invention will be described in detail below with reference to the accompanying drawings. Obviously, the described embodiments are only a part of the embodiments of the present invention, not all of them. Based on the embodiments of the present invention, all other embodiments obtained by those skilled in the art without creative effort should fall within the protection scope of the present invention.

[0026] Example 1, referring to Figure 1 and Figure 2 This is one embodiment of the present invention, which provides an intrinsic security defense method for power isolation devices in extreme environments, comprising: S1. Determine the proportion of critical process anomalies based on process execution data, and determine the proportion of interface alarm areas based on external interface monitoring data.

[0027] Understandably, process execution data reflects the operational status of critical processes within the power isolation device, while external interface monitoring data reflects the traffic, protocols, and alarm status of the power isolation device's external network interfaces. By processing these two types of data separately, the proportion of critical process anomalies and the proportion of interface alarm areas are generated, using different data sources to characterize the degree of operational anomalies within the power isolation device and the scope of external interface alarms.

[0028] In the embodiments of this application, process execution data includes process liveness status, process CPU utilization, process memory utilization, and context switching frequency; external interface monitoring data includes network traffic, protocol type, and alarm logs. The power isolation device also acquires system CPU utilization, system memory utilization, and board temperature as system resource data.

[0029] In some embodiments, the step S1, which involves determining the proportion of critical process anomalies based on process execution data and determining the proportion of interface alarm areas based on external interface monitoring data, includes steps S11 to S14, wherein: S11. Determine the number of critical abnormal processes based on process execution data.

[0030] Specifically, a critical process whitelist is pre-configured. This whitelist is determined by factory defaults and user configuration, and records critical processes responsible for core business processing, protocol parsing, and security detection functions, including message forwarding processes, authentication processes, and heartbeat monitoring processes. The number of critical processes recorded in the whitelist is recorded as the total number of critical processes. .

[0031] For critical processes in the critical process whitelist, anomaly determination is performed based on process liveness status, process CPU utilization, and context switching frequency. When a critical process is in a non-live state, it is identified as an abnormal critical process; when the process CPU utilization of a critical process exceeds a process CPU utilization threshold and reaches the determination window, it is identified as an abnormal critical process; when the deviation of the context switching frequency of a critical process from the historical baseline average of context switching reaches a context switching deviation threshold, it is identified as an abnormal critical process. The anomaly determination conditions are logically ORed, and a critical process satisfying any one of the anomaly determination conditions is counted in the number of abnormal critical processes. .

[0032] In one implementation, the process CPU utilization threshold can be set to 95%, the judgment window can be set to 3 seconds, and the context switching deviation threshold can be set to 50% of the historical baseline average of context switching. For example, when the process CPU utilization of critical process P1 reaches 98% and lasts for 3 seconds, critical process P1 is counted in the number of abnormal critical processes; when the context switching frequency of critical process P5 reaches twice the historical baseline average of context switching, critical process P5 is counted in the number of abnormal critical processes.

[0033] S12. Determine the critical process abnormality ratio based on the ratio of the number of abnormal critical processes to the total number of critical processes.

[0034] Specifically, the proportion of critical process anomalies is recorded as follows: The critical process anomaly ratio is determined by the ratio of the number of abnormal critical processes to the total number of critical processes, i.e.: in, Indicates the percentage of critical processes that are abnormal. Indicates the number of critical processes that are abnormal. This indicates the total number of critical processes.

[0035] For example, when the total number of critical processes =10, Number of critical abnormal processes When =2, the proportion of critical process anomalies =2 / 10=0.2.

[0036] S13. Determine the monitoring area that triggers the alarm rule based on the external interface monitoring data.

[0037] Specifically, monitoring areas are divided based on the physical ports or logical VLANs of the external network interfaces of the power isolation device, and traffic anomaly detection rules, protocol compliance detection rules, port scan detection rules, and unauthorized access detection rules are configured for each monitoring area. Currently active monitoring areas can be dynamically added or deleted according to actual networking needs, and the monitoring area division results remain unchanged within a composite security posture value calculation cycle.

[0038] When network traffic, protocol type, or alarm logs within a monitored area meet the corresponding alarm rules, the corresponding monitored area is designated as the monitoring area that triggers the alarm rule. For example, when the instantaneous network traffic within the monitored area exceeds the dynamic baseline threshold, non-business protocol messages appear, or abnormal connection requests are detected, the alarm rule for the corresponding monitored area is triggered.

[0039] In one implementation, the dynamic baseline threshold is determined based on historical network traffic collected when the corresponding monitoring area is in normal operation. The variation range of the historical network traffic over multiple calculation periods is statistically analyzed to form a normal network traffic baseline for the corresponding monitoring area. A dynamic baseline threshold is then set based on this normal network traffic baseline. As the network traffic level changes under normal operation, the normal network traffic baseline and the dynamic baseline threshold are updated based on newly collected normal network traffic, ensuring that the dynamic baseline threshold is adapted to the normal network traffic level of the corresponding monitoring area.

[0040] S14. Perform deduplication and count of the monitoring areas that trigger alarm rules to determine the number of monitoring areas that trigger alarm rules. Determine the interface alarm area ratio based on the ratio of the number of monitoring areas that trigger alarm rules to the total number of monitoring areas.

[0041] Specifically, within a composite security situation value calculation cycle, the monitoring areas that trigger alarm rules are counted repeatedly. When the same monitoring area triggers one alarm rule or triggers different alarm rules simultaneously, the monitoring area is counted only once.

[0042] The number of monitored areas that triggered the alarm rules is recorded as follows: The total number of currently active monitoring areas is recorded as follows: The proportion of the interface alarm area is recorded as The interface alarm area ratio is determined by the ratio of the number of monitored areas that triggered alarm rules to the total number of monitored areas, i.e.: in, Indicates the proportion of interface alarm areas. This indicates the number of monitored areas that triggered the alarm rule. This indicates the total number of monitored areas.

[0043] For example, the total number of monitored areas =4, where monitoring area 1 detected an abnormal HTTP protocol message and triggered one alarm rule, monitoring area 2 detected a sudden surge in traffic and triggered two alarm rules, and monitoring areas 3 and 4 did not trigger any alarm rules. Since monitoring area 2 is only counted once, the number of monitoring areas that triggered alarm rules is... =2, Interface alarm area ratio =2 / 4=0.5.

[0044] Step S1 limits the scope of internal anomaly statistics by using a whitelist of critical processes and uses a deduplication method for monitoring areas to count the scope of external interface alarms. This ensures that the proportion of critical process anomalies and the proportion of interface alarm areas reflect the degree of anomalies in internal critical processes and the scope of external interfaces being affected, respectively, thus avoiding the repeated triggering of different alarm rules in the same monitoring area and causing the proportion of interface alarm areas to be artificially high.

[0045] S2. Determine the traffic deviation based on the network traffic and historical traffic baseline, determine the weight allocation of the critical process anomaly ratio and the interface alarm area ratio based on the traffic deviation, and weight the critical process anomaly ratio and the interface alarm area ratio based on the weight allocation to determine the composite security posture value.

[0046] It is understandable that network traffic to power isolation devices varies with service hours and load. To differentiate the impact of normal service traffic changes and security anomalies on the composite security posture value, the weight allocation of the proportion of critical process anomalies and the proportion of interface alarm areas is determined based on the deviation of current network traffic from the historical traffic baseline; simultaneously, the damping level of the current composite security posture value is adjusted according to the fluctuation of historical composite security posture values.

[0047] In the embodiments of this application, the historical traffic baseline is determined based on historical network traffic, and the weight allocation includes the weight of the proportion of critical process anomalies and the weight of the proportion of interface alarm areas. An original composite security posture value is formed based on the weight allocation, and then a damping parameter is determined based on the fluctuation frequency of the historical composite security posture value. The original composite security posture value is then processed using the damping parameter to form a new composite security posture value.

[0048] In some embodiments, step S2, which involves determining the traffic deviation based on the network traffic and the historical traffic baseline, determining the weight allocation based on the traffic deviation, and determining the composite security posture value based on the weight allocation, includes steps S21 to S29, wherein: S21. Determine the traffic deviation based on the ratio of network traffic to the historical traffic baseline.

[0049] Specifically, a 7-day traffic sliding time window is maintained. Historical network traffic that occurs at the same time as the current calculation within the traffic sliding time window is obtained daily. The average value is calculated based on the obtained historical network traffic, and the obtained average value is determined as the historical traffic baseline. .

[0050] In one implementation, a service period feature library is established, which stores clock interval labels for typical service periods. For example, 9:00 AM to 11:00 AM can be set as a typical peak service period, and 2:00 AM to 4:00 AM can be set as a typical off-peak service period. The service period feature library is used to determine candidate service periods, and the actual service status is dynamically calibrated based on historical traffic baselines.

[0051] When the candidate service period determined by the service period feature library is inconsistent with the judgment result formed based on the historical traffic baseline, the current service status is determined based on the judgment result formed based on the historical traffic baseline. For example, if the service period feature library marks the current time as a low-traffic period, but the current network traffic deviation from the historical traffic baseline is greater than the traffic judgment threshold and the critical process abnormality ratio is less than the critical process abnormality ratio threshold, the corresponding weight processing is still performed according to the service peak state; if the service period feature library marks the current time as a service peak period, but the traffic deviation does not reach the traffic judgment threshold, the weight allocation is not directly changed based on the clock interval label.

[0052] Furthermore, for continuous network traffic data involved in traffic deviation calculation, the box plot quartile truncation method is used to identify outliers. Network traffic samples within the traffic statistics window preceding the current statistical period are obtained, and the first quartile is determined based on these samples. and the third and fourth quartiles The interquartile range is determined according to the following formula: in, Indicates the interquartile range. Indicates the first quartile. This represents the third quartile. According to... -1.5× Determine the lower limit of the cutoff interval, based on +1.5× Determine the upper limit of the truncation interval.

[0053] In one implementation, the flow statistics window can be one hour, including valid sampling points within the most recent 3600 seconds, and can be adjusted within 15 minutes to 2 hours based on data changes from the power isolation device. False alarms identified as hardware faults are excluded before determining the first quartile, third quartile, and interquartile range.

[0054] For network traffic samples exceeding the truncation interval, these samples are marked as pending anomalies and temporarily stored. Simultaneously, a short-term observation window (5 seconds) is initiated to reacquire network traffic. When the reacquired network traffic returns to the truncation interval, the original network traffic sample is identified as instantaneous pulse data and excluded. If the reacquired network traffic remains outside the truncation interval, and the proportion of abnormal critical processes increases concurrently or a non-business protocol appears, the original network traffic sample is retained. If the reacquired network traffic remains outside the truncation interval and does not meet the cross-validation conditions for attack characteristics, the network traffic sample is truncated to the corresponding truncation interval boundary before being used in the calculation.

[0055] When the ratio of current network traffic to historical traffic baseline is less than or equal to 1.5, and the proportion of critical process anomalies is less than the critical process anomaly proportion threshold, the corresponding short-term network traffic changes can be identified as normal business instantaneous fluctuations, and the instantaneous pulse data can be processed according to the box plot quartile truncation method. Interface alarm area proportion data directly generated from alarm logs and process non-liveness status data are not subject to box plot quartile truncation processing.

[0056] Record the current network traffic as The flow deviation is recorded as Traffic deviation is determined by the ratio of current network traffic to the historical traffic baseline, i.e.: in, Indicates the degree of flow deviation. Indicates current network traffic. This represents the historical traffic baseline.

[0057] S22. When the traffic deviation is greater than the traffic judgment threshold and the critical process abnormality ratio is less than the critical process abnormality ratio threshold, the weight of the critical process abnormality ratio and the weight of the interface alarm area ratio are determined according to the traffic deviation to form a weight allocation.

[0058] The weight of the abnormality rate of critical processes is denoted as: The weight of the proportion of interface alarm areas is recorded as: When the power isolation device is first put into operation, the initial weight allocation can be set to... =0.5、 =0.5. The allowable value range for the weights of the critical process anomaly ratio and the interface alarm area ratio is [0.1, 0.9], and satisfies: In one implementation, the typical weight allocation for regular business hours can be: =0.5、 =0.5; the typical weight during peak business hours can be... =0.7~0.8、 =0.2~0.3; the typical weight for business off-peak periods can be 0.2~0.3. =0.2~0.3、 =0.7~0.8. The values ​​are used to represent typical weight configurations under different business conditions; during peak business conditions, the actual weight is determined according to the continuous calculation relationship of traffic deviation, instead of setting the typical value range as a fixed weight level.

[0059] Let the traffic determination threshold be denoted as The threshold for the abnormal proportion of critical processes is denoted as... When the flow deviation meets the requirements > And the proportion of critical process anomalies meets the requirements. < At that time, based on the flow deviation Determine the weight of the proportion of anomalies in critical processes Weighting of the proportion of interface alarm areas .

[0060] In one implementation, the traffic determination threshold A weight of 1.5 can be used for the proportion of interface alarm areas. Determined according to the following formula: Weight of the proportion of critical process anomalies Determined according to the following formula: Among them, the threshold for the abnormal proportion of key processes A pre-defined security boundary for critical processes is used to determine whether critical processes are simultaneously in an abnormal state when network traffic increases.

[0061] In one implementation, multiple historical calculation periods during which the power isolation device is in normal operation are selected, the proportion of critical process anomalies within the historical calculation periods is obtained, the range of change of the proportion of critical process anomalies under normal operation is statistically analyzed, and a threshold for the proportion of critical process anomalies is set based on the range of change. The critical process abnormality ratio threshold is used to distinguish between the normal fluctuations of the critical process abnormality ratio under normal operating conditions and the critical process abnormality ratio that exceeds the normal operating range, so that the weight allocation judgment when the flow deviation is greater than the flow judgment threshold is adapted to the normal critical process operating level of the power isolation device.

[0062] For example, when the current network traffic is twice the historical traffic baseline, that is... When = 2.0, the result is obtained according to the continuous calculation relationship. =0.4、 =0.6.

[0063] S23. When the weight allocation is formed, if the duration for which the traffic deviation is greater than the traffic determination threshold reaches the confirmation duration, the weight allocation is maintained.

[0064] Specifically, from the perspective of flow deviation Greater than the flow determination threshold The calculation cycle begins to accumulate duration. Before the confirmation duration is reached, the current weight allocation is determined based on the traffic deviation of the current calculation cycle. When the duration during which the traffic deviation is continuously greater than the traffic determination threshold reaches the confirmation duration, the weight allocation already formed in the current calculation cycle is maintained, and the weight allocation is not re-determined based on small changes in traffic deviation in adjacent calculation cycles. In one implementation, the confirmation duration can be 3 statistical cycles.

[0065] Furthermore, the weight recovery threshold is denoted as... ,and < When the weight allocation has been maintained, and the traffic deviation... Greater than or equal to the weight recovery threshold When the current weight allocation is maintained, the current weight allocation is retained. Therefore, in a state where the weight allocation is already maintained, when... ≤ ≤ At that time, no new weight allocation is determined based on the traffic deviation, nor is weight restoration performed.

[0066] S24. When the flow deviation is less than the weight recovery threshold, the weight allocation is determined cycle by cycle according to the preset recovery step size until the initial weight allocation is restored.

[0067] Specifically, when the weight allocation has been maintained and < At that time, the weight recovery process is initiated. In one implementation, the weight recovery threshold is... You can choose 1.2, and the preset recovery step size can be 0.05.

[0068] For example, the current weight allocation is =0.7、 When the value is 0.3, the weight of the abnormal proportion of critical processes is adjusted after each calculation cycle. Adjust the value by 0.05 from the initial value of 0.5, and simultaneously adjust the weight of the interface alarm area ratio. Adjust the weights by 0.05 from the initial value of 0.5 until the initial weight allocation is restored. =0.5、 =0.5.

[0069] S25. Based on the weight allocation, the proportion of critical process anomalies and the proportion of interface alarm areas are weighted to form the original composite security situation value.

[0070] Specifically, the original composite security situation value is denoted as Determined according to the following formula: in, This represents the original composite security situation value. The weights representing the proportion of abnormal processes in critical processes. The weights representing the proportion of alarm areas on the interface Indicates the percentage of critical processes that are abnormal. This indicates the proportion of interface alarm areas.

[0071] For example, when =0.5、 =0.5、 =0.2、 When =0.5: When using typical weights during peak business hours =0.7、 =0.3, and =0.2、 When =0.5: When the flow deviation When = 2.0, the result is obtained according to the continuous calculation relationship in step S22. =0.6、 =0.4; if at this time =0.1、 =0.7, then: Using initial weights =0.5、 =0.5 When calculating the same data, the original composite security situation value is 0.40.

[0072] S26. Determine the magnitude of the situation change based on the absolute value of the difference between adjacent composite security situation values ​​in the historical composite security situation value sequence.

[0073] Specifically, a composite security situation value statistics window is established, and historical composite security situation values ​​that have been output are recorded within the composite security situation value statistics window according to a fixed calculation period. In one embodiment, the composite security situation value statistics window can be 1 hour, and the composite security situation value calculation period can be 5 seconds.

[0074] The historical composite security situation value in the kth calculation period is denoted as... The historical composite security situation value for the (k-1)th calculation period is denoted as... The magnitude of the situational change in the kth calculation period is denoted as... Determined according to the following formula: in, This represents the magnitude of the situational change during the k-th calculation period.

[0075] S27. Determine the effective fluctuation based on the magnitude of the situation change, and determine the fluctuation frequency based on the effective fluctuation.

[0076] Let the threshold of the change range be denoted as When the magnitude of two consecutive changes in the situation both exceed the magnitude threshold... At that time, a valid fluctuation is determined. In one implementation, the change amplitude threshold is used. You can take 0.05.

[0077] The number of valid fluctuations occurring within the statistical window of the composite security situation value is counted, and the number of valid fluctuations is determined as the fluctuation frequency. The fluctuation frequency threshold is denoted as... When the statistical window for the composite security situation value is 1 hour, the fluctuation frequency threshold is... You can take 10 times per hour.

[0078] S28. Determine the damping parameters based on the comparison results between the fluctuation frequency and the fluctuation frequency threshold.

[0079] Let the damping parameter be denoted as The damping parameter of the previous calculation cycle is denoted as The adjustment step size of the damping parameter is denoted as In one implementation, the damping parameter ranges from [0, 0.5], the initial damping parameter is 0, and the damping parameter adjustment step size is... You can take 0.05.

[0080] When the fluctuation frequency Greater than the fluctuation frequency threshold At that time, the damping parameter for the current calculation period is determined according to the following formula: When the fluctuation frequency Less than or equal to the fluctuation frequency threshold At that time, the damping parameter for the current calculation period is determined according to the following formula: in, This represents the damping parameter for the current calculation period. This represents the damping parameter of the previous calculation cycle. This indicates the step size for adjusting the damping parameter.

[0081] S29. Based on the damping parameters, the composite safety situation value of the previous cycle and the original composite safety situation value are weighted to determine the composite safety situation value.

[0082] The composite security situation value of the previous period is denoted as... The composite security situation value for the current calculation period is denoted as... Determined according to the following formula: in, This represents the composite security situation value for the current calculation period. This represents the composite security situation value of the previous period. This represents the original composite security situation value for the current calculation period. This represents the damping parameter for the current calculation period. When the composite safety situation value is first formed, the initial damping parameter is 0. At this time, the composite safety situation value for the current calculation period is determined by the original composite safety situation value for the current calculation period.

[0083] For example, when =0.3、 =0.25、 When =0.45: When the subsequent fluctuation frequency exceeds the fluctuation frequency threshold, causing the damping parameter to increase to 0.35, and the original composite safety situation value for the next calculation period is 0.28: Through step S2, the degree of network traffic deviation can change the contribution of the proportion of critical process anomalies and the proportion of interface alarm areas in the composite security situation value. The weight maintenance and gradual recovery prevent the weight from frequently switching due to changes in traffic near the judgment boundary. The damping parameter formed based on the historical composite security situation value fluctuation frequency further changes the response amplitude of the composite security situation value to changes in data in a single calculation cycle, so that changes in business traffic, continuous security anomalies and instantaneous fluctuations can be distinguished in the same situation calculation process.

[0084] S3. Determine the mode switching threshold with a duration constraint on the composite security situation value to form a candidate mode switching determination result.

[0085] It is understood that the mode switching threshold is used to limit the range of security states corresponding to the composite security posture value, and the duration is used to limit the time during which the corresponding mode switching conditions need to be met continuously. The candidate mode switching determination result indicates that the corresponding defense mode switching condition has been met, and the defense mode of the power isolation device is not directly changed based on the candidate mode switching determination result.

[0086] In the embodiments of this application, the defense modes include a conventional defense mode and an isolated defense mode. A first mode switching threshold is used to determine the mode switching conditions for switching from the conventional defense mode to the isolated defense mode, and a second mode switching threshold is used to determine the mode switching conditions for switching from the isolated defense mode to the conventional defense mode.

[0087] In some embodiments, the determination of the mode switching threshold with duration constraint on the composite security situation value in step S3 includes steps S31 to S34, wherein: S31. Determine the first mode switching threshold, the second mode switching threshold, the first duration, and the second duration.

[0088] Specifically, the initial value of the mode switching threshold is determined based on historical normal operation data and typical attack samples. A composite security posture value is obtained for 30 consecutive days of normal operation, and the average of the obtained composite security posture values ​​is calculated. and standard deviation The threshold for switching to the first mode is denoted as The threshold for switching to the second mode is denoted as ,in: First mode switching threshold Greater than the second mode switching threshold .

[0089] In one implementation, the first mode switching threshold A value of 0.7 can be used as the threshold for switching to the second mode. The value can be 0.3, and the initial value can be fine-tuned according to the actual operation.

[0090] Furthermore, an intermediate control threshold is set between the first mode switching threshold and the second mode switching threshold. ,in: In one implementation, the intermediate control threshold You can take 0.5.

[0091] When the composite security posture value is between the second mode switching threshold and the intermediate control threshold, the current defense mode is maintained, an early warning is sent to the management center, early warning observation is initiated, and the data throughput of non-critical services is limited. When the composite security posture value is between the intermediate control threshold and the first mode switching threshold, the isolation defense mode is not switched, and early warning observation is maintained or external data throughput restrictions are strengthened based on the state of the composite security posture value within the specified range. The intermediate control threshold is used to determine the intermediate control processing before mode switching and is not used to form the candidate mode switching judgment result.

[0092] The first duration is denoted as The second duration is recorded as The first and second durations are determined based on the attack duration distribution in historical attack samples and are adapted to the data sampling period and the composite security posture value calculation period, ensuring that the first and second durations are integer multiples of the corresponding periods. In one implementation, the composite security posture value calculation period can be 5 seconds, and the first duration... You can choose 30 seconds, the second duration. You can take 60 seconds.

[0093] S32. Based on the relationship between the composite security posture value and the first mode switching threshold under the conventional defense mode, a candidate mode switching judgment result for switching to the isolation defense mode is formed.

[0094] Specifically, when the power isolation device is in normal defense mode and the composite security status value Greater than the first mode switching threshold When the cumulative composite security situation value is continuously greater than the first mode switching threshold, the duration of the accumulated value is determined; when the duration reaches the first duration... At that time, a candidate mode switching judgment result is generated, which is the switch from the conventional defense mode to the isolation defense mode.

[0095] S33. Based on the relationship between the composite security situation value under the isolation defense mode and the second mode switching threshold, a candidate mode switching judgment result for switching to the conventional defense mode is formed.

[0096] Specifically, when the power isolation device is in isolation defense mode, and the composite security status value... Less than the second mode switching threshold When the cumulative composite security situation value is continuously less than the second mode switching threshold, the duration of the cumulative value is determined; when the duration reaches the second duration... At that time, a candidate mode switching judgment result is generated for switching from isolation defense mode to regular defense mode.

[0097] S34. The cumulative duration based on the continuous satisfaction of the mode switching threshold condition.

[0098] Specifically, within each calculation cycle of the composite security situation value, it is determined whether the composite security situation value continues to meet the mode switching threshold condition corresponding to the current defense mode. When the corresponding mode switching threshold condition is met for consecutive calculation cycles, the duration is accumulated. Before the accumulated duration reaches the first duration or the second duration, if the corresponding mode switching threshold condition is no longer met in any calculation cycle, the accumulated duration of this round is cleared to zero. When the composite security situation value meets the corresponding mode switching threshold condition again, the duration is re-accumulated from the current calculation cycle, and the accumulated duration before the condition was interrupted is not used.

[0099] For example, the first mode switching threshold =0.7, First Duration =30 seconds, and the calculation cycle of the composite security situation value is 5 seconds. The composite security situation values ​​are 0.75, 0.80 and 0.68 respectively. Then, the third calculation cycle no longer meets the condition that the composite security situation value is greater than the first mode switching threshold, and the previously accumulated duration is cleared.

[0100] In step S3, the magnitude relationship of the composite security situation value and the duration of continuous satisfaction are used together as the candidate mode switching judgment condition, so that the instantaneous threshold crossing in a single calculation cycle will not directly change the defense mode; the first mode switching threshold and the second mode switching threshold constitute switching boundaries in different directions, and the intermediate control threshold implements early warning and traffic restriction without triggering mode switching, thereby reducing the repeated switching of the defense mode near the threshold.

[0101] S4. Perform heterogeneous detection based on the candidate mode switching determination result to form a heterogeneous detection result. Perform redundancy arbitration based on the heterogeneous detection result to form a redundant arbitration result.

[0102] Understandably, heterogeneous detection uses different data sources and detection logic to independently verify the current security status. Heterogeneous detection includes signature detection, process anomaly detection, and traffic resource anomaly detection. The binary judgment result generated by heterogeneous detection is used for majority voting and confidence comparison. When heterogeneous detection identifies a specific anomaly type, it also retains the corresponding valid attack type label.

[0103] In the embodiments of this application, the heterogeneous detection result includes a binary determination result indicating whether the attack is normal or abnormal, and a valid attack type label generated during the anomaly detection process. The binary determination result is used for redundancy arbitration, and the valid attack type label is used to characterize the attack type identified by the heterogeneous detection.

[0104] In some embodiments, such as Figure 2 As shown, the heterogeneous detection and redundancy arbitration performed in step S4 includes steps S41 to S46, wherein: S41. Perform signature detection, process anomaly detection, and traffic resource anomaly detection to generate heterogeneous detection results.

[0105] The signature detection reads the protocol type and alarm logs from external interface monitoring data and pre-configures a known attack signature database. It matches the event characteristics in the current alarm logs against this database; when an event characteristic matches an attack signature, an anomaly is determined, while also referencing the current composite security posture value. The signature detection result is formed by further confirming the mode switching threshold range in which the composite security situation value is located.

[0106] Process anomaly detection reads process runtime data, including process liveness status, process CPU utilization, process memory utilization, and context switching frequency, and processes it according to key process anomaly judgment conditions. When a key process becomes non-live, the process CPU utilization exceeds the process CPU utilization threshold and reaches the judgment window, or the deviation of the context switching frequency from the historical baseline average of context switching reaches the context switching deviation threshold, an internal process anomaly judgment is formed. This judgment is then cross-validated by combining the current composite security posture value with the mode switching threshold range to form the process anomaly detection result.

[0107] Traffic resource anomaly detection reads network traffic, protocol type, and system resource data, including system CPU utilization, system memory utilization, and board temperature. A box plot quartile truncation method is used to process continuous data in the network traffic and system resource data, calculating the traffic deviation of the current network traffic relative to the 7-day historical traffic average. Simultaneously, system resource usage is monitored to see if it exceeds a dynamic baseline. A traffic resource anomaly detection result is formed based on the network traffic deviation, protocol type, and system resource usage. In one implementation, when the traffic deviation is greater than 1.5 and no attack signature cross-validation is triggered, the corresponding network traffic is identified as abnormal traffic, and this is combined with system resource usage to form the traffic resource anomaly detection result.

[0108] Furthermore, the system resource dynamic baseline is determined based on the system CPU utilization, system memory utilization, and board temperature collected when the power isolation device is in normal operation. The normal variation range over multiple calculation cycles is statistically analyzed according to the type of system resource data to form the corresponding system resource dynamic baseline. As the system resource occupancy level changes under normal operation, the corresponding system resource dynamic baseline is updated based on newly collected system resource data. Traffic resource anomaly detection compares the current system resource data with the corresponding system resource dynamic baseline to determine whether the system resource occupancy deviates from the normal operating level.

[0109] The signature detection results, process anomaly detection results, and traffic resource anomaly detection results all form a binary judgment result of normal or abnormal. When network layer anomalies, system resource anomalies, persistent external attacks, or internal process anomalies are identified during heterogeneous detection, the corresponding valid attack type label is recorded. The binary judgment result and the valid attack type label together constitute the heterogeneous detection result.

[0110] S42. Based on the heterogeneous detection results, a majority vote is conducted to form the voting result.

[0111] Specifically, the binary judgment results from the signature detection result, process anomaly detection result, and traffic resource anomaly detection result are obtained. When the three binary judgment results are consistent, the consistent binary judgment result is determined as the voting result; when the three binary judgment results are inconsistent, the binary judgment result that accounts for the majority of the three binary judgment results is determined as the voting result.

[0112] When any heterogeneous detection results in an abnormal binary judgment, the defense mode switch or self-healing operation is not executed directly based on a single heterogeneous detection result. Instead, a majority vote is executed after all three heterogeneous detection results are formed.

[0113] S43. Determine the confidence weight based on the historical accuracy of heterogeneous detection.

[0114] Historical detection records are established for signature detection, process anomaly detection, and traffic resource anomaly detection, respectively. The statistical scope of the historical detection records is the cumulative full cycle since the power isolation device was powered on; when calculating the historical accuracy of the j-th heterogeneous detection, all historical detection records of the j-th heterogeneous detection since its commissioning are included.

[0115] For the j-th type of heterogeneity detection, the cumulative number of correct judgments is denoted as . The total number of judgments is recorded as Historical accuracy is recorded as .when When the accuracy is greater than 0, the historical accuracy rate is determined by the ratio of the cumulative number of correct judgments to the cumulative total number of judgments, that is: in, This represents the historical accuracy of the j-th heterogeneous detection method. This represents the cumulative number of correct judgments for the j-th type of heterogeneity detection. This represents the cumulative total number of judgments for the j-th type of heterogeneous detection.

[0116] When the j-th heterogeneous detection has not yet formed a historical detection record, that is When the initial confidence level is 0, a pre-configured initial confidence weight is used, and historical accuracy is not calculated; after historical detection records are generated, the historical accuracy is used as the basis for calculation. Update the confidence weights for the corresponding heterogeneous detection. In one implementation, the confidence weights are directly adopted from the corresponding historical accuracy rates, i.e.: This round of heterogeneity detection uses the confidence weights determined before the start of this round. After the completion of this round of detection, the correctness or incorrectness of the heterogeneity detection judgment is determined by the final result, which has been voted on by a majority and has not been rejected by the confidence comparison. When the judgment result of the j-th heterogeneity detection is consistent with the final confirmed result, both the cumulative number of correct judgments and the cumulative total number of judgments increase; when they are inconsistent, only the cumulative total number of judgments increases. The confidence weights can be recalculated after each complete round of detection, or they can be recalculated based on the latest cumulative detection records according to a 24-hour update cycle.

[0117] S44. When heterogeneous detection results are inconsistent, determine the majority confidence weight and the minority confidence weight.

[0118] Specifically, the confidence weights of heterogeneous tests whose test results are consistent with the voting results are summed to form the majority confidence weight. The confidence weights of heterogeneous tests where the test results are inconsistent with the voting results are determined as minority confidence weights. .

[0119] For example, if one heterogeneous detection produces a normal result with a confidence weight of 0.5, and two other heterogeneous detections produce abnormal results with a combined confidence weight of 0.3, then the majority confidence weight... =0.3, minority confidence weight =0.5.

[0120] S45. Based on the heterogeneous detection results and the comparison results between the majority confidence weights and the minority confidence weights, a redundant arbitration result is formed.

[0121] When heterogeneous detection results are consistent, a redundant arbitration result is formed based on the voting results; when heterogeneous detection results are inconsistent and the majority confidence weights are not met, a redundant arbitration result is formed based on the voting results. Greater than or equal to the minority confidence weight In such cases, redundant arbitration results may be generated based on the voting outcome.

[0122] Furthermore, the redundant arbitration result is matched with the current candidate mode switching determination result. When the candidate mode switching determination result is a switch from the normal defense mode to the isolation defense mode, and the redundant arbitration result is abnormal, the candidate mode switching determination result is confirmed; when the candidate mode switching determination result is a switch from the isolation defense mode to the normal defense mode, and the redundant arbitration result is normal, the candidate mode switching determination result is confirmed.

[0123] If the candidate mode switching determination result is a switch from the normal defense mode to the isolation defense mode and the redundancy arbitration result is normal, the candidate mode switching determination result is not confirmed; if the candidate mode switching determination result is a switch from the isolation defense mode to the normal defense mode and the redundancy arbitration result is abnormal, the candidate mode switching determination result is not confirmed.

[0124] S46. When the majority confidence weight is less than the minority confidence weight, re-execute heterogeneous detection.

[0125] When the majority confidence weight Less than the minority confidence weight If the current candidate mode switching decision is not confirmed based on the voting results of this round, the current candidate mode switching decision will become invalid during this round of defense. The process running data, external interface monitoring data, and network traffic will be reacquired, and steps S1 to S3 will be re-executed. After a new candidate mode switching decision is formed, steps S41 to S45 will be re-executed, and the number of consecutive re-detections will be counted.

[0126] A maximum number of re-detection attempts is set as the exit condition for re-detection. In one implementation, the maximum number of re-detection attempts can be 3. If, after re-detection, the same conflict occurs again where the majority confidence weight is less than the minority confidence weight, and the maximum number of consecutive re-detection attempts has not been reached, the re-detection process is executed again.

[0127] When the maximum number of consecutive re-detections is reached, re-detection stops. The voting result formed by the majority vote in the current round is used as the arbitration result for the current round, and then processing is carried out according to the candidate mode switching direction matching relationship in step S45. At the same time, the confidence conflict events in this round and the heterogeneous detection status of the participants in the conflict are recorded to form an alarm log and notify the operation and maintenance personnel to carry out maintenance.

[0128] In step S4, the heterogeneous detection results from three different data sources and detection logics first form a majority vote result, and then the confidence weight formed by the historical accuracy rate performs a second verification on the majority vote result. When the confidence of the majority side is insufficient, the current candidate mode switching judgment result can be invalidated and the security situation calculation and heterogeneous detection can be re-performed. At the same time, the maximum number of re-detection times is used to limit the repeated detection process, thereby reducing the possibility that a single detection path or low-accuracy detection results directly dominate the defense action.

[0129] S5. When the redundant arbitration result confirms the candidate mode switching determination result, a mode switching instruction is generated, and the defense mode of the power isolation device is switched according to the mode switching instruction.

[0130] Understandably, the candidate mode switching determination result indicates that the corresponding defense mode switching condition has been met, and the mode switching instruction is used to determine the actual direction of the defense mode conversion. Only when the redundant arbitration result confirms the candidate mode switching determination result will the corresponding mode switching instruction be generated.

[0131] In the embodiments of this application, when the redundant arbitration result confirms the candidate mode switching determination result for switching to the isolation defense mode, the self-healing level is determined based on the difference between the composite security posture value and the first mode switching threshold, the attack type is determined based on the effective attack type label in the heterogeneous detection result, and the self-healing operation is determined based on the attack type and the self-healing level.

[0132] In some embodiments, step S5 includes steps S51 to S55, wherein: S51. Generate a mode switching instruction based on the redundant arbitration results.

[0133] When the redundant arbitration result confirms the candidate mode switching decision result for switching from the normal defense mode to the isolation defense mode, a mode switching instruction for switching from the normal defense mode to the isolation defense mode is generated; when the redundant arbitration result confirms the candidate mode switching decision result for switching from the isolation defense mode to the normal defense mode, a mode switching instruction for switching from the isolation defense mode to the normal defense mode is generated.

[0134] S52. Switch the defense mode of the power isolation device according to the mode switching command.

[0135] When the mode switching command is to switch from the normal defense mode to the isolation defense mode, non-core service ports are shut down, the backup communication link is maintained, the power isolation device is switched to the isolation defense mode, and the self-test frequency of the power isolation device is increased while the first duration is shortened. In one implementation, the self-test cycle in the normal defense mode can be 60 seconds, and after switching to the isolation defense mode, the self-test cycle can be adjusted to 1 second, and the first duration participates in the corresponding continuous status determination according to the shortened determination window.

[0136] When the mode switching command is to switch from isolation defense mode to normal defense mode, the power isolation device will be switched to normal defense mode.

[0137] S53. When the redundant arbitration result confirms the candidate mode switching judgment result for switching to the isolation defense mode, determine the difference between the composite security situation value and the first mode switching threshold.

[0138] Specifically, the difference between the composite security situation value and the first mode switching threshold is denoted as... Determined according to the following formula: in, This represents the difference between the composite security posture value and the first mode switching threshold. This represents the composite security situation value. This indicates the threshold for switching to the first mode.

[0139] S54. Determine the self-healing level based on the comparison result between the difference and the self-healing grading threshold, and determine the attack type based on the heterogeneous detection result.

[0140] Let the self-healing grading threshold be denoted as . In one implementation, the self-healing grading threshold... It can be set to 0.05 and can be fine-tuned based on on-site operating conditions. When the self-healing difference... Greater than 0 and less than the self-healing grading threshold When the self-healing difference is reached, the first self-healing level is determined; when the self-healing difference is reached... Greater than the self-healing grading threshold At that time, the second self-healing level is determined.

[0141] Further, the valid attack type labels in the heterogeneous detection results formed in step S41 are read, and the attack type is determined based on the valid attack type labels. The attack types include network layer anomalies, system resource anomalies, persistent external attacks, and internal process anomalies.

[0142] S55. Determine the self-healing operation based on the attack type and self-healing level, and execute the self-healing operation.

[0143] Specifically, at the first self-healing level, the self-healing operations include refreshing the access control list, resetting the TCP session connection, and clearing the temporary cache. When the attack type is a network layer anomaly, refreshing the access control list and resetting the TCP session connection are selected; when the attack type is a system resource anomaly, clearing the temporary cache is selected.

[0144] At the second self-healing level, the self-healing operations include disconnecting the physical network port relay, rolling back the power isolation device firmware version to the previous stable version, and initiating a hardware watchdog reset.

[0145] When the attack type is a persistent external attack and the firmware is not corrupted, the physical network port relay is disconnected; when the attack type is an internal process abnormality and the firmware is abnormal, the power isolation device firmware version is rolled back to the previous stable version and the hardware watchdog is reset.

[0146] When the same self-healing level includes different self-healing operations, one or more self-healing operations are determined based on the effective attack type label and corresponding selection conditions. It is not required to execute all self-healing operations under the corresponding self-healing level in a fixed order.

[0147] After performing a self-healing operation, the operation changes the session connection, access control rules, physical link, or firmware operating status of the power isolation device. The power isolation device reacquires process running data, external interface monitoring data, and network traffic, and executes a new detection cycle based on the reacquired data.

[0148] Step S5 changes the defense mode of the power isolation device only after the candidate mode switching determination result is confirmed by the redundant arbitration result. When switching to the isolation defense mode, the self-healing level is determined according to the degree to which the composite security situation value exceeds the first mode switching threshold. Then, the effective attack type label is used to select the self-healing operation that matches the anomaly type, so that the defense mode switching and the intensity of the self-healing action are constrained by the security situation level and the attack type, respectively, to avoid treating different security anomalies as the same recovery action.

[0149] This embodiment forms a continuous intrinsic security defense process through steps S1 to S5: The internal operating status and external interface alarm range are characterized by the proportion of abnormal critical processes and the proportion of interface alarm areas. The weight allocation of the two proportions is changed according to the traffic deviation. A candidate mode switching determination result is formed based on the composite security posture value and duration. Heterogeneous detection and redundant arbitration are then used to confirm the candidate mode switching determination result. When the confidence comparison rejects the majority vote, the current candidate mode switching determination result is invalidated and the detection is re-executed. When the redundant arbitration result confirms the candidate mode switching determination result, the defense mode of the power isolation device is changed according to the mode switching command, and corresponding self-healing operations are performed according to the self-healing level and attack type.

[0150] Example 2, refer to Figure 3 As one embodiment of the present invention, this embodiment provides an intrinsic security defense system for power isolation devices in extreme environments, comprising: The processing module is used to determine the proportion of critical process anomalies based on process running data, determine the proportion of interface alarm areas based on external interface monitoring data, determine the traffic deviation based on network traffic and historical traffic baseline, determine the weight allocation of the proportion of critical process anomalies and the proportion of interface alarm areas based on the traffic deviation, weight the proportion of critical process anomalies and the proportion of interface alarm areas based on the weight allocation to determine a composite security posture value, determine a mode switching threshold with a duration constraint on the composite security posture value to form a candidate mode switching determination result, perform heterogeneous detection based on the candidate mode switching determination result to form a heterogeneous detection result, and perform redundancy arbitration based on the heterogeneous detection result to form a redundant arbitration result. The execution module is used to generate a mode switching instruction when the redundant arbitration result confirms the candidate mode switching determination result, and to switch the defense mode of the power isolation device according to the mode switching instruction.

[0151] In the embodiments of this application, the processing module is connected to a data acquisition probe disposed inside a power isolation device. The data acquisition probe is used to acquire process running data, external interface monitoring data, network traffic, and system resource data. The system resource data includes system CPU utilization, system memory utilization, and board temperature. The acquired data is appended with a timestamp and written to a cache queue. The processing module reads the corresponding data from the cache queue according to the data's timestamp, so that data belonging to the corresponding detection period can participate in the calculation of composite security posture value, mode switching threshold determination, and heterogeneous detection.

[0152] Furthermore, the processing module includes threshold registers corresponding to the first mode switching threshold, the second mode switching threshold, and the intermediate control threshold, and a timer for determining the duration. The threshold registers store the corresponding mode switching thresholds. When the composite security posture value meets the mode switching threshold condition corresponding to the current defense mode, the timer accumulates the duration of the corresponding condition. When the mode switching threshold condition is interrupted before reaching the corresponding duration, the timer clears the corresponding accumulated duration and restarts the accumulation when the corresponding mode switching threshold condition is met again.

[0153] In the embodiments of this application, when the processing module performs heterogeneous detection, it performs signature detection, process anomaly detection, and traffic resource anomaly detection through independent processing threads. These processing threads can run on the same processor core or on different processor cores. After the signature detection, process anomaly detection, and traffic resource anomaly detection each generate heterogeneous detection results, the processing module performs a majority vote based on these results and combines this with the confidence weight of the heterogeneous detection for redundant arbitration, resulting in a redundant arbitration result.

[0154] The execution module is connected to the network interface, hardware watchdog, and network port relay of the power isolation device. When the mode switching command indicates a switch from the normal defense mode to the isolation defense mode, the execution module controls the non-core service ports to close while retaining the backup communication link; when the determined self-healing operation includes disconnecting the physical network link, the execution module controls the network port relay to disconnect the corresponding physical network link; when the determined self-healing operation includes resetting the hardware watchdog, the execution module controls the hardware watchdog to perform the reset; when the determined self-healing operation includes firmware version rollback, the execution module rolls back the firmware version of the power isolation device to the previous stable version.

[0155] This embodiment also provides a computer device applicable to an intrinsic security defense method for power isolation devices in extreme environments, comprising: a memory and a processor; the memory is used to store computer-executable instructions, and the processor is used to execute the computer-executable instructions to implement the intrinsic security defense method for power isolation devices in extreme environments as proposed in the above embodiment.

[0156] This embodiment also provides a storage medium storing a computer program that, when executed by a processor, implements an intrinsic security defense method for power isolation devices in extreme environments as proposed in the above embodiments.

[0157] The storage medium proposed in this embodiment and the method for implementing an intrinsic security defense of a power isolation device for extreme environments proposed in the above embodiments belong to the same inventive concept. Technical details not described in detail in this embodiment can be found in the above embodiments, and this embodiment has the same beneficial effects as the above embodiments.

[0158] Based on the above description of the implementation methods, those skilled in the art can clearly understand that the present invention can be implemented using software and necessary general-purpose hardware, and of course, it can also be implemented using hardware, but in many cases the former is a better implementation method. Based on this understanding, the technical solution of the present invention, or the part that contributes to the prior art, can be embodied in the form of a software product. This computer software product can be stored in a computer-readable storage medium, such as a computer floppy disk, read-only memory (ROM), random access memory (RAM), flash memory, hard disk, or optical disk, etc., including several instructions to cause a computer device (which may be a personal computer, server, or network device, etc.) to execute the methods of the various embodiments of the present invention.

[0159] It should be noted that the above embodiments are only used to illustrate the technical solutions of the present invention and are not intended to limit it. Although the present invention has been described in detail with reference to preferred embodiments, those skilled in the art should understand that modifications or equivalent substitutions can be made to the technical solutions of the present invention without departing from the spirit and scope of the technical solutions of the present invention.

Claims

1. An intrinsic security defense method for power isolation devices in extreme environments, characterized in that, include: Determine the proportion of critical process anomalies based on process execution data, and determine the proportion of interface alarm areas based on external interface monitoring data; The traffic deviation is determined based on the network traffic and the historical traffic baseline. The weight allocation of the critical process anomaly ratio and the interface alarm area ratio is determined based on the traffic deviation. The critical process anomaly ratio and the interface alarm area ratio are weighted according to the weight allocation to determine the composite security posture value. The composite security situation value is subjected to a mode switching threshold determination with a duration constraint to form a candidate mode switching determination result; Heterogeneous detection is performed based on the candidate mode switching determination result to form a heterogeneous detection result. Redundancy arbitration is then performed based on the heterogeneous detection result to form a redundant arbitration result. When the redundant arbitration result confirms the candidate mode switching determination result, a mode switching instruction is generated, and the defense mode of the power isolation device is switched according to the mode switching instruction.

2. The intrinsic security defense method for power isolation devices in extreme environments as described in claim 1, characterized in that: The process of determining the proportion of critical process anomalies based on process execution data and determining the proportion of interface alarm areas based on external interface monitoring data includes: The number of abnormal critical processes is determined based on the process execution data, and the abnormality ratio of critical processes is determined based on the ratio of the number of abnormal critical processes to the total number of critical processes. The monitoring area that triggers the alarm rule is determined based on the external interface monitoring data; The number of monitoring areas that trigger alarm rules is determined by deduplicating the count. The interface alarm area ratio is determined based on the ratio of the number of monitored areas that trigger the alarm rule to the total number of monitored areas.

3. The intrinsic security defense method for power isolation devices in extreme environments as described in claim 2, characterized in that: The determination of the traffic deviation and the weight allocation includes: The traffic deviation is determined based on the ratio of the network traffic to the historical traffic baseline; When the traffic deviation is greater than the traffic determination threshold and the critical process abnormality ratio is less than the critical process abnormality ratio threshold, the weight of the critical process abnormality ratio and the weight of the interface alarm area ratio are determined according to the traffic deviation to form the weight allocation. Once the weight allocation is formed, if the duration during which the traffic deviation is continuously greater than the traffic determination threshold reaches the confirmation duration, the weight allocation is maintained. When the traffic deviation is less than the weight recovery threshold, the weight allocation for the next cycle is determined cycle by cycle according to the preset recovery step size until the weight allocation is restored to the initial weight allocation.

4. The intrinsic security defense method for power isolation devices in extreme environments as described in claim 3, characterized in that: The determination of the composite security situation value includes: The abnormal proportion of the critical process and the alarm area of ​​the interface are weighted according to the weight allocation to form the original composite security posture value. The magnitude of the situation change is determined by the absolute value of the difference between adjacent composite security situation values ​​in the historical composite security situation value sequence; When two consecutive changes in the situation are both greater than the change amplitude threshold, a valid fluctuation is determined, and the fluctuation frequency is determined based on the number of valid fluctuations within the statistical period. The damping parameters are determined based on the comparison between the fluctuation frequency and the fluctuation frequency threshold. The composite safety situation value is determined by weighting the previous cycle composite safety situation value with the original composite safety situation value based on the damping parameters.

5. The intrinsic security defense method for power isolation devices in extreme environments as described in claim 4, characterized in that: The determination of the mode switching threshold with duration constraints for the composite security situation value includes: The mode switching threshold includes a first mode switching threshold and a second mode switching threshold, wherein the first mode switching threshold is greater than the second mode switching threshold; When the power isolation device is in the normal defense mode, and the composite security situation value is greater than the first mode switching threshold for a duration of a first duration, a candidate mode switching determination result for switching to the isolation defense mode is formed. When the power isolation device is in the isolation defense mode, and the duration for which the composite security status value is continuously less than the second mode switching threshold reaches the second duration, a candidate mode switching determination result for switching to the conventional defense mode is formed.

6. The intrinsic security defense method for power isolation devices in extreme environments as described in claim 5, characterized in that: The heterogeneous detection includes signature detection, process anomaly detection, and traffic resource anomaly detection. A majority vote is conducted based on the heterogeneous detection results to form a voting result, and the confidence weight is determined based on the historical accuracy. When the heterogeneous detection results are consistent, the redundant arbitration result is formed based on the voting result; When the heterogeneous detection results are inconsistent, a majority confidence weight is formed by summing the confidence weights of the heterogeneous detections that are consistent with the voting results, and a minority confidence weight is formed by summing the confidence weights of the heterogeneous detections that are inconsistent with the voting results. When the majority confidence weight is greater than or equal to the minority confidence weight, the redundant arbitration result is formed based on the voting result; When the majority confidence weight is less than the minority confidence weight, the heterogeneous detection is re-executed.

7. The intrinsic security defense method for power isolation devices in extreme environments as described in claim 6, characterized in that: Also includes: When the redundant arbitration result confirms the candidate mode switching determination result for switching to the isolation defense mode, the difference between the composite security situation value and the first mode switching threshold is determined, and the self-healing level is determined based on the comparison result between the difference and the self-healing grading threshold. The attack type is determined based on the heterogeneous detection results, the self-healing operation is determined based on the attack type and the self-healing level, and the self-healing operation is executed.

8. An intrinsic security defense system for power isolation devices in extreme environments, employing the intrinsic security defense method for power isolation devices in extreme environments as described in any one of claims 1 to 7, characterized in that, include: The processing module is used to determine the proportion of critical process anomalies based on process running data, determine the proportion of interface alarm areas based on external interface monitoring data, determine the traffic deviation based on network traffic and historical traffic baseline, determine the weight allocation of the proportion of critical process anomalies and the proportion of interface alarm areas based on the traffic deviation, weight the proportion of critical process anomalies and the proportion of interface alarm areas based on the weight allocation to determine a composite security posture value, determine a mode switching threshold with a duration constraint on the composite security posture value to form a candidate mode switching determination result, perform heterogeneous detection based on the candidate mode switching determination result to form a heterogeneous detection result, and perform redundancy arbitration based on the heterogeneous detection result to form a redundant arbitration result. The execution module is used to generate a mode switching instruction when the redundant arbitration result confirms the candidate mode switching determination result, and to switch the defense mode of the power isolation device according to the mode switching instruction.

9. A computer device comprising a memory and a processor, wherein the memory stores a computer program, characterized in that, When the processor executes the computer program, it implements the steps of the intrinsic security defense method for a power isolation device for extreme environments as described in any one of claims 1 to 7.

10. A computer-readable storage medium having a computer program stored thereon, characterized in that, When the computer program is executed by the processor, it implements the steps of the intrinsic security defense method for a power isolation device for extreme environments as described in any one of claims 1 to 7.

Images