An artificial intelligence-based network security quality automatic evaluation method and system

Abstract

The application discloses a kind of network security quality automation evaluation method and system based on artificial intelligence, it is related to network security technical field, the present application includes step one, logic diagram construction, step two, logic detection and step three, evaluation adjustment.Performs logic completeness detection, identifies logic blind area path and logic conflict node, improves the accuracy of capturing logic blind area path that cannot reach security target, detects logic defects from global causal link level, is automatically executed throughout, avoids the problems of subjective bias, low efficiency, easy to miss short board of artificial audit.According to network security logic completeness, the logic dimension of path integrity and rule consistency is used to quantify and evaluate security quality based on logic blind area path and logic conflict node, and the network security quality evaluation adjustment is carried out, the objectivity is improved, the artificial investment is reduced, the security risks such as intrusion, unauthorized access and data leakage caused by protection deficiency and rule contradiction are eliminated in advance, and the network security protection integrity and consistency are improved.

Description

Technical Field

[0001] This invention relates to the field of network security technology, and specifically to an automated network security quality assessment method and system based on artificial intelligence. Background Technology

[0002] With the rapid development of network technology and the increasing complexity of network architecture, the number of various network devices and security strategies has surged dramatically. Network security threats are becoming more diversified, covert, and complex. Network security quality assessment has become a core and crucial link in ensuring network operational security and mitigating network risks. Therefore, it is necessary to analyze an automated network security quality assessment method and system based on artificial intelligence.

[0003] Existing technology, such as the invention application patent with announcement number CN121509043A, discloses a network security threat detection system and method based on a domain-adaptive security big model. The detection method includes: constructing a domain-adaptive security big model for power system threats; systematic collection and governance of power security domain corpora; injection of domain knowledge based on the power corpus; fine-tuning of instructions for power security analysis tasks; constructing a high-quality instruction dataset, which is designed for typical power system threat scenarios, employing an efficient parameter fine-tuning method; using this instruction dataset for supervised fine-tuning of the model; model verification and evaluation; collection and context preprocessing of multi-source security data of the power system; multi-dimensional analysis and reasoning of power threats based on the security big model; generation of interpretable threat reports and automated response; continuous model optimization based on feedback; and construction of a domain-adaptive security big model for power system threats. This invention features high accuracy, low latency, and enhanced interpretability.

[0004] While existing technologies can meet basic requirements for automated network security quality assessment methods and systems based on artificial intelligence, they also present some potential shortcomings and challenges, specifically in the following aspects: First, existing technologies do not adequately focus on acquiring the target network's security policy logic rule set, increasing the workload of manually compiling the entire network's security logic. Second, existing technologies do not pay sufficient attention to logical completeness detection, identification of logical blind spots and logical conflict nodes, thus reducing the accuracy of capturing logical blind spots that cannot reach security targets. This affects the analysis of logical defects detected at the global causal link level, easily leading to subjective biases in manual review, low efficiency, and the tendency to overlook weaknesses. Third, existing technologies lack analysis based on logical blind spots and logical conflict nodes, affecting the adjustment of network security quality assessments based on network security logical completeness, reducing objectivity, increasing manual input, and leading to security risks such as intrusion, unauthorized access, and data leakage caused by incomplete protection and rule contradictions, ultimately reducing the integrity and consistency of overall network security protection. Summary of the Invention

[0005] In view of the above-mentioned technical shortcomings, the purpose of this invention is to provide an automated network security quality assessment method and system based on artificial intelligence.

[0006] To solve the above-mentioned technical problems, the present invention adopts the following technical solution: The present invention provides an automated network security quality assessment method based on artificial intelligence, including: step one, logic graph construction, step two, logic detection, and step three, assessment and adjustment.

[0007] Step 1: Construct the logic graph. Obtain the security policy logic rule set of the target network. Based on the security policy logic rule set, construct a security causal logic graph with security threat types as starting nodes, key security objectives as ending nodes, and security policy rules as intermediate nodes, according to the causal logical relationship between security threats, security policy rules, and key security objectives.

[0008] Step 2: Logic Detection. Based on the obtained security causal logic graph, perform logic completeness detection to identify logical blind spots and logical conflict nodes. Logical blind spots are causal paths that cannot be fully reached from the starting node to the ending node, and logical conflict nodes are security policy rule nodes that have logical contradictions.

[0009] Step 3: Assessment and Adjustment. Based on logical blind spots and logical conflict nodes, calculate the network security logic completeness as an assessment indicator of network security quality, and make network security quality assessment and adjustments based on the network security logic completeness.

[0010] Furthermore, the specific analysis method for obtaining the security policy logic rule set of the target network is as follows: obtain the security policy configuration data of multiple security devices in the target network, extract firewall access control rules, identity authentication rules, permission management rules, encrypted communication rules and security audit rules from the security policy configuration data according to the rule type, and associate and merge the extracted security policy logic rules according to the dependency and constraint relationships between the rules to form a security policy logic rule set.

[0011] Furthermore, the specific analysis method for constructing a security causal logic graph according to the causal logical relationship between security threats, security policy rules, and key security objectives is as follows: extract security threat types as the starting node set, key security objectives as the ending node set, and each security policy rule as the intermediate node set from the set of security policy logical rules.

[0012] Traverse each security policy rule in the set of intermediate nodes, analyze the type of security threat that each rule defends against, establish the first directed edge from the starting node of the security threat type to the rule node, analyze the key security target protected by each rule, and establish the second directed edge from the rule node to the terminal node of the key security target.

[0013] Based on the starting node, intermediate nodes, terminal node, first directed edge, and second directed edge, generate a secure causal logic graph consisting of multiple causal logic paths from the starting node through intermediate nodes to the terminal node.

[0014] Furthermore, the specific analysis method for identifying the logical blind zone path is as follows: Select a starting node of a security threat type from the security causal logic graph as the traversal starting point, and perform a depth traversal along the directed edges layer by layer towards the terminal node, starting from the traversal starting point, and record the node sequence traversed by the current traversal path. In the current traversal path, determine whether the current node has a directed edge pointing to the next node. If it does, continue to traverse the lower-level nodes along the directed edge. If it does not, determine whether the current node is the terminal node of the security causal logic graph.

[0015] If the current node is not the terminal node and there is no directed edge pointing to the next node, the current traversal path is determined to be a logical blind zone path. The node sequence of the path is recorded and repeated until all starting nodes and their reachable paths in the safe causal logic graph have been traversed, and a list of logical blind zone paths is obtained.

[0016] Furthermore, the specific analysis method for identifying logically conflicting nodes is as follows: select an intermediate node of a security policy rule from the security causal logic graph as the node to be detected, analyze the logical meaning of all incoming edges and all outgoing edges of the node to be detected, and obtain the incoming edge logical semantic dataset and the outgoing edge logical semantic dataset of the node to be detected, respectively.

[0017] Compare each logical semantic in the outgoing edge logical semantic dataset pairwise to determine if there are two or more outgoing edges with contradictory logical semantics. Similarly, compare each logical semantic in the incoming edge logical semantic dataset pairwise to determine if there are two or more incoming edges with contradictory logical semantics.

[0018] If there are two or more contradictory outgoing edges in the outgoing edge logical semantic dataset, or two or more contradictory incoming edges in the incoming edge logical semantic dataset, the node to be detected is identified as a logical conflict node. The identification information and contradiction type of the node are recorded, and the process is repeated until all intermediate nodes in the safe causal logic graph have been detected, resulting in a list of logical conflict nodes.

[0019] Furthermore, the specific analysis method for calculating the network security logic completeness based on logical blind zone paths and logical conflict nodes is as follows: obtain the number of logical blind zone paths as the number of logical blind zone paths, and obtain the total number of causal paths from the starting node to the ending node in the security causal logic graph as the total number of causal paths.

[0020] The number of logically conflicting nodes is obtained as the logical conflict node count, and the total number of security policy rule nodes in the full causal logic graph is obtained as the security policy rule node count.

[0021] Divide the number of logical blind zone paths by the total number of causal paths to obtain the percentage of logical blind zone paths; divide the number of logical conflict nodes by the total number of security policy rule nodes to obtain the percentage of logical conflict nodes.

[0022] The network security logic completeness is calculated based on the proportion of logical blind spots and the proportion of logical conflict nodes.

[0023] Furthermore, the specific analysis method for the network security quality assessment indicator is as follows: compare the network security logical completeness with a preset completeness threshold range to determine the completeness level range to which the network security logical completeness belongs; generate the corresponding network security quality level evaluation result based on the completeness level range; and integrate the network security quality level evaluation result, the list of logical blind spots and the list of logical conflict nodes to generate a network security quality assessment report.

[0024] Furthermore, the network security quality assessment and adjustment based on the completeness of network security logic is specifically analyzed as follows: obtaining a list of logical blind spots and a list of logical conflict nodes; analyzing the node type and missing causal logic direction at the interruption point of each logical blind spot path based on the list of logical blind spots; and generating corresponding rule supplementation suggestions based on the node type and missing causal logic direction at the interruption point. The rule supplementation suggestions include the type of security policy rule to be supplemented, the insertion position of the rule in the security causal logic graph, and the causal connection relationship to be established by the rule.

[0025] For each logical conflict node in the list of logical conflict nodes, the conflict type and the related conflict logic semantics of the node are analyzed. Based on the conflict type and conflict logic semantics, corresponding rule correction suggestions are generated. The rule correction suggestions include the security policy rule identifier that should be corrected, the direction of deletion or modification of the conflict rule, and the logical relationship that should be established by the corrected rule.

[0026] The suggestions for supplementing and revising the rules are summarized, and combined with the completeness of the network security logic, a network security quality adjustment plan is generated, and the extracted rules are adjusted.

[0027] Furthermore, the specific analysis method for extracting and adjusting rules is as follows: extract rule supplementation suggestions and rule correction suggestions from the network security quality adjustment scheme; according to the type of security policy rule to be supplemented, the insertion position and the causal connection relationship in the rule supplementation suggestions, add rule nodes at the corresponding interruption position of the security causal logic graph, and establish directed edges between the new rule nodes and their preceding and following nodes, so that the original logical blind zone path is extended to the terminal node, forming a complete causal logic path.

[0028] Based on the conflict rule identifier and correction direction in the rule correction suggestion, delete or modify the outgoing or incoming edges of logically conflicting nodes in the secure causal logic graph to eliminate the logical semantic contradiction of the node.

[0029] Based on the adjusted security causal logic graph, the process is re-executed to calculate the completeness of the adjusted network security logic and verify the adjustment effect.

[0030] A second aspect of the present invention provides a system for executing the AI-based automated network security quality assessment method, comprising: a logic graph construction module, which acquires a set of security policy logic rules for a target network, and constructs a security causal logic graph based on the set of security policy logic rules, with security threat types as starting nodes, key security targets as ending nodes, and security policy rules as intermediate nodes, according to the causal logical relationship between security threats, security policy rules, and key security targets.

[0031] The logic detection module performs logic completeness detection based on the obtained security causal logic graph, and identifies logic blind zone paths and logic conflict nodes. The logic blind zone path is a causal path that cannot be completely reached from the starting node to the ending node, and the logic conflict node is a security policy rule node with logical contradictions.

[0032] The assessment and adjustment module calculates the network security logic completeness based on logical blind spot paths and logical conflict nodes, using it as an assessment indicator for network security quality, and adjusts the network security quality assessment based on the network security logic completeness.

[0033] The beneficial effects of this invention are as follows: First, in step one, the logic diagram construction, the security policy logic rule set of the target network is obtained, and a security causal logic diagram is constructed according to the causal logical relationship between security threats, security policy rules and key security objectives. This lays the foundation for subsequent complete reasoning from the logical structure level and reduces the workload of manually sorting out the security logic of the entire network.

[0034] Second, in step two, logic detection, logic completeness detection is performed to identify logical blind spots and logical conflict nodes, which improves the accuracy of capturing logical blind spots that cannot reach the security target. Logic defects are detected from the global causal link level and the whole process is automated, avoiding the problems of subjective bias, low efficiency and easy omission of shortcomings in manual review.

[0035] Third, in the third step of evaluation and adjustment, based on logical blind spots and logical conflict nodes, security quality is quantitatively evaluated using two logical dimensions: path integrity and rule consistency. The network security quality evaluation is adjusted according to the completeness of network security logic. The evaluation results do not depend on external benchmarks or historical data, but only on the quality of the security policy's logical structure itself. This improves objectivity, reduces manual input, and eliminates security risks such as intrusion, unauthorized access, and data leakage caused by protection deficiencies and rule contradictions in advance, thereby improving the integrity and consistency of network-wide security protection. Attached Figure Description

[0036] To more clearly illustrate the technical solutions in the embodiments of the present invention or the prior art, the drawings used in the description of the embodiments or the prior art will be briefly introduced below. Obviously, the drawings described below are only some embodiments of the present invention. For those skilled in the art, other drawings can be obtained based on these drawings without creative effort.

[0037] Figure 1 This is a schematic diagram of the implementation steps of the method of the present invention.

[0038] Figure 2 This is a schematic diagram of the system structure connection of the present invention. Detailed Implementation

[0039] The technical solutions of the embodiments of the present invention will be clearly and completely described below with reference to the accompanying drawings. Obviously, the described embodiments are only some embodiments of the present invention, and not all embodiments. Based on the embodiments of the present invention, all other embodiments obtained by those skilled in the art without creative effort are within the scope of protection of the present invention.

[0040] Reference Figure 1 As shown, the present invention provides an automated network security quality assessment method based on artificial intelligence, including: step one, logic graph construction, step two, logic detection, and step three, assessment and adjustment.

[0041] Step 1: Construct the logic graph. Obtain the security policy logic rule set of the target network. Based on the security policy logic rule set, construct a security causal logic graph with security threat types as starting nodes, key security objectives as ending nodes, and security policy rules as intermediate nodes, according to the causal logical relationship between security threats, security policy rules, and key security objectives.

[0042] Step 2: Logic Detection. Based on the obtained security causal logic graph, perform logic completeness detection to identify logical blind spots and logical conflict nodes. Logical blind spots are causal paths that cannot be fully reached from the starting node to the ending node, and logical conflict nodes are security policy rule nodes that have logical contradictions.

[0043] Step 3: Assessment and Adjustment. Based on logical blind spots and logical conflict nodes, calculate the network security logic completeness as an assessment indicator of network security quality, and make network security quality assessment and adjustments based on the network security logic completeness.

[0044] In the above embodiments, the specific analysis method for obtaining the security policy logic rule set of the target network is as follows: obtain the security policy configuration data of multiple security devices in the target network, extract firewall access control rules, identity authentication rules, permission management rules, encrypted communication rules and security audit rules from the security policy configuration data according to the rule type, and associate and merge the extracted security policy logic rules according to the dependency and constraint relationships between the rules to form a security policy logic rule set.

[0045] It should be noted that security devices include various security protection devices deployed in the target network, such as firewalls, intrusion detection systems, identity authentication servers, access control servers, VPN gateways, and security auditing systems. Security policy configuration data refers to the rule parameters configured in the aforementioned security devices to define security protection behaviors, including access control lists, authentication policy configuration files, permission allocation tables, encryption protocol parameters, and audit rule templates.

[0046] It should be noted that firewall access control rules are rules used to define the conditions for network traffic to pass through, including source IP address, destination IP address, port number, transport layer protocol, and corresponding allow or deny actions; authentication rules are rules used to define user authentication methods, including authentication protocol type, authentication strength requirements, multi-factor authentication configuration, and session timeout policies; permission management rules are rules used to define user or role access permissions to resources, including role definitions, permission allocation relationships, least privilege constraints, and permission inheritance relationships; encrypted communication rules are rules used to define network communication encryption methods, including encryption protocol version, encryption algorithm type, key length requirements, and certificate verification policies; and security audit rules are rules used to define security event logging and review methods, including log logging scope, audit event type filtering conditions, log storage period, and alarm triggering conditions.

[0047] It's important to note that dependencies between rules refer to the preconditions between different rules. For example, the execution result of an authentication rule serves as an input condition for an access control rule; that is, a user must first pass authentication before resource access permissions can be allocated according to the access control rules. Constraints between rules refer to the logical constraints between different rules. For instance, if a firewall access control rule has already rejected a certain type of traffic from entering the internal network, subsequent authentication and access control rules do not need to process that type of traffic again. By associating and merging rules with dependencies and constraints, a structured set of security policy logic rules is formed, providing complete and clearly defined input data for subsequently constructing a security causal logic graph.

[0048] In the above embodiments, the specific analysis method for constructing a security causal logic graph according to the causal logical relationship between security threats, security policy rules and key security objectives is as follows: extract security threat types as the starting node set, key security objectives as the ending node set and each security policy rule as the intermediate node set from the set of security policy logical rules.

[0049] Traverse each security policy rule in the set of intermediate nodes, analyze the type of security threat that each rule defends against, establish the first directed edge from the starting node of the security threat type to the rule node, analyze the key security target protected by each rule, and establish the second directed edge from the rule node to the terminal node of the key security target.

[0050] Based on the starting node, intermediate nodes, terminal node, first directed edge, and second directed edge, generate a secure causal logic graph consisting of multiple causal logic paths from the starting node through intermediate nodes to the terminal node.

[0051] It should be noted that security threat types refer to different categories of cybersecurity threats faced by the target network, such as DDoS attack threats, SQL injection threats, unauthorized access threats, data breach threats, and malware propagation threats. Critical security objectives refer to the core security attributes that cybersecurity protection aims to safeguard, such as data confidentiality objectives, system integrity objectives, service availability objectives, and operational auditability objectives. Security policy rules are the five extracted rule categories, with each rule serving as an independent intermediate node.

[0052] It's important to note that analyzing the type of security threat each rule defends against refers to determining, based on the rule configuration purpose field or rule semantics within the security policy rule, what type of security threat the rule is designed to defend against. For example, a source IP address filtering rule configured to block access requests from a specific IP range defends against unauthorized access threats; a rule restricting traffic to a specific port configured to prevent excessive invalid traffic from exhausting service resources defends against DDoS attack threats. Analyzing the key security objective protected by each rule refers to determining, based on the protective effect of the security policy rule, which security objective the rule's execution ultimately safeguards. For example, an authentication rule safeguards operational auditability and data confidentiality by verifying the authenticity of the user's identity; an encrypted communication rule safeguards data confidentiality by encrypting transmitted data.

[0053] It should be noted that the first directed edge represents the causal relationship between a security threat type and a security policy rule, with the direction from the security threat type to the security policy rule; the second directed edge represents the causal relationship between a security policy rule and a critical security target, with the direction from the security policy rule to the critical security target.

[0054] It should be noted that a causal logic path refers to the complete path starting from the initiating node of a certain security threat type, passing through one or more intermediate nodes of security policy rules, and finally reaching the terminal node of a certain critical security target. A security threat type may correspond to multiple causal logic paths because the threat may be defended against by multiple security policy rules at different levels; a critical security target may also be protected by multiple causal logic paths because the target may be jointly protected by multiple security policy rules.

[0055] In the above embodiments, the specific analysis method for identifying the logical blind zone path is as follows: select a security threat type starting node from the security causal logic graph as the traversal starting point, and perform a depth traversal along the directed edges layer by layer towards the terminal node, record the node sequence traversed by the current traversal path, and determine whether the current node has a directed edge pointing to the next node in the current traversal path. If it does, continue to traverse the downward nodes along the directed edge. If it does not, determine whether the current node is the terminal node of the security causal logic graph.

[0056] If the current node is not the terminal node and there is no directed edge pointing to the next node, the current traversal path is determined to be a logical blind zone path. The node sequence of the path is recorded and repeated until all starting nodes and their reachable paths in the safe causal logic graph have been traversed, and a list of logical blind zone paths is obtained.

[0057] It should be noted that selecting a starting node for a security threat type as the traversal starting point means selecting one untraversed starting node from the set of starting nodes as the starting point for the current round of traversal. The set of starting nodes includes, for example, DDoS attack threat nodes, SQL injection threat nodes, unauthorized access threat nodes, data leakage threat nodes, and malware propagation threat nodes. Each time, one of these nodes is selected to begin the traversal.

[0058] It's important to note that depth-first traversal towards the final node, in a security causal logic graph, refers to starting from the starting node, following the direction of the directed edges, sequentially passing through intermediate nodes, and gradually progressing towards the final node until the final node is reached or further progress is impossible. The current traversal path refers to the sequence of all nodes traversed from the current starting point to the currently reached node, including the starting node, intermediate nodes along the way, and the current node. For example, a complete traversal path might be: Unauthorized Access Threat Node to Identity Authentication Rule Node to Access Control Rule Node to Data Confidentiality Target Node.

[0059] It should be noted that determining whether the current node has a directed edge pointing to the next node involves checking whether the current node's outgoing edge set is empty. If the outgoing edge set is not empty, meaning the node has at least one directed edge pointing to another node, then the current node has a successor node, and the traversal can continue downwards along that directed edge. If the outgoing edge set is empty, meaning the node has no directed edges pointing to other nodes, then the current node is the end of the path, and it is necessary to further determine whether this end is the final node.

[0060] It's important to clarify that determining whether the current node is a terminal node refers to checking if its node type belongs to the terminal node set. If the current node belongs to the terminal node set—that is, one of the following: data confidentiality objectives, system integrity objectives, service availability objectives, or operational auditability objectives—then the traversal path has fully reached the critical security objective, the path is complete, and it does not belong to a logical blind spot. If the current node does not belong to the terminal node set, then the traversal path was interrupted before reaching the critical security objective, the path is incomplete, and it is determined to be a logical blind spot path. A logical blind spot path indicates that a security threat lacks a complete defense chain, and there is a security gap not covered by policy rules.

[0061] It should be noted that the logical blind spot path list is a list compiled from all node sequences identified as logical blind spots. Each path in this list corresponds to a specific logical blind spot. For example, an SQL injection threat node-Web application firewall rule node indicates that the path is interrupted at this intermediate node and does not reach any critical security target, suggesting a break in the defense link from the SQL injection threat to the critical security target.

[0062] In the above embodiments, the specific analysis method for identifying logically conflicting nodes is as follows: select an intermediate node of a security policy rule from the security causal logic graph as the node to be detected, analyze the logical meaning of all incoming edges and all outgoing edges of the node to be detected, and obtain the incoming edge logical semantic dataset and the outgoing edge logical semantic dataset of the node to be detected, respectively.

[0063] Compare each logical semantic in the outgoing edge logical semantic dataset pairwise to determine if there are two or more outgoing edges with contradictory logical semantics. Similarly, compare each logical semantic in the incoming edge logical semantic dataset pairwise to determine if there are two or more incoming edges with contradictory logical semantics.

[0064] If there are two or more contradictory outgoing edges in the outgoing edge logical semantic dataset, or two or more contradictory incoming edges in the incoming edge logical semantic dataset, the node to be detected is identified as a logical conflict node. The identification information and contradiction type of the node are recorded, and the process is repeated until all intermediate nodes in the safe causal logic graph have been detected, resulting in a list of logical conflict nodes.

[0065] It should be noted that selecting an intermediate node of a security policy rule as the node to be detected means selecting, one by one, nodes that have not yet been detected from the set of intermediate nodes in the constructed security causal logic graph as the detection objects for the current round. Each node in the set of intermediate nodes represents a specific security policy rule, including firewall access control rule nodes, identity authentication rule nodes, permission management rule nodes, encrypted communication rule nodes, and security audit rule nodes.

[0066] It should be noted that an incoming edge is a directed edge pointing to the node to be detected, indicating that a certain security threat type is pointed to the rule node through this incoming edge, meaning that the rule is used to defend against this threat. An outgoing edge is a directed edge from the node to be detected to other nodes, indicating that the rule node is pointed to a critical security target through this outgoing edge, meaning that the rule protects that target. The logical meaning refers to the causal relationship semantics represented by the directed edge. For an incoming edge, its logical semantics is that it is used to defend against a certain threat; for an outgoing edge, its logical semantics is that it is used to protect a certain target. The incoming edge logical semantic dataset refers to the set of logical semantics of all incoming edges of the node to be detected, and the outgoing edge logical semantic dataset refers to the set of logical semantics of all outgoing edges of the node to be detected.

[0067] It should be noted that contradictory logical semantics refer to situations where the logical meanings expressed by two or more directed edges are contradictory in direction or nature. Typical cases of contradictory outgoing edge logical semantics include: one outgoing edge of the same rule node points to a terminal node in the allowed access direction, while another outgoing edge points to a terminal node in the denied access direction. In other words, the rule node simultaneously expresses two contradictory operations—allowing and prohibiting—making the execution effect of the rule uncertain. Typical cases of contradictory incoming edge logical semantics include: one incoming edge of the same rule node comes from the allowed threat direction, while another incoming edge comes from the prohibited threat direction. In other words, the rule node is used to handle two logically contradictory threats simultaneously, resulting in an unclear defense objective.

[0068] It should be noted that recording the node's identification information and conflict type refers to recording the unique identifier of the node determined to be in logical conflict, such as the rule name or rule number, and the conflict type of the node. Conflict types include outward-edge conflict (outward edges have contradictory logical semantics), inward-edge conflict (inward edges have contradictory logical semantics), and bidirectional conflict (both inward and outward edges have contradictory logical semantics). For example, if a firewall access control rule node has outward edges pointing to two contradictory terminal nodes—one allowing traffic and the other denying traffic—then this node is determined to be an outward-edge conflict logical node.

[0069] It should be noted that the list of logically conflicting nodes refers to a list that summarizes the node identification information and contradiction types of all nodes identified as logically conflicting nodes. Each entry in this list corresponds to a logically conflicting node. For example, a rule node named "Firewall Rule_ACL_1024" with the contradiction type "Outbound Contradiction" indicates that this rule node has an outbound logical semantic contradiction, and the rule needs to be modified to eliminate the conflict.

[0070] In the above embodiments, the specific analysis method for calculating the network security logic completeness based on logical blind zone paths and logical conflict nodes is as follows: obtain the number of logical blind zone paths as the number of logical blind zone paths, and obtain the total number of all causal paths from the starting node to the ending node in the security causal logic graph as the total number of causal paths.

[0071] The number of logically conflicting nodes is obtained as the logical conflict node count, and the total number of security policy rule nodes in the full causal logic graph is obtained as the security policy rule node count.

[0072] Divide the number of logical blind zone paths by the total number of causal paths to obtain the percentage of logical blind zone paths; divide the number of logical conflict nodes by the total number of security policy rule nodes to obtain the percentage of logical conflict nodes.

[0073] The network security logic completeness is calculated based on the proportion of logical blind spots and the proportion of logical conflict nodes.

[0074] It should be noted that the number of logical blind path numbers refers to the total number of paths recorded in the obtained list of logical blind path numbers. The total number of causal paths refers to the total number of complete paths in the security causal logic graph that can start from the starting node, pass through several intermediate nodes, and finally reach the terminal node, including complete paths and logical blind path numbers. Each path corresponds to a causal logical relationship from a security threat to a security policy rule to a critical security objective. The total number of causal paths reflects the total number of all logical relationships in the security causal logic graph.

[0075] It should be noted that the number of logically conflicting nodes refers to the total number of nodes recorded in the obtained list of logically conflicting nodes. The total number of security policy rule nodes refers to the total number of all intermediate nodes in the security causal logic graph, that is, the number of all security policy rules included in the logic graph, reflecting the overall scale of the policy rules configured in the target network.

[0076] It should be noted that the percentage of logical blind spots refers to the proportion of paths with logical breakpoints among all causal paths. A higher percentage indicates a more severe deficiency in the security policy's logical coverage and integrity. The percentage of logically conflicting nodes refers to the proportion of rule nodes with logical contradictions among all rule nodes. A higher percentage indicates a more severe deficiency in the security policy's logical consistency. Both percentages range from 0 to 1.

[0077] It should be noted that the calculation process for network security logical completeness is as follows: The difference between 1 and the percentage of logical blind spots is used to obtain the path completeness score, which reflects the completeness of the causal logical paths. The difference between 1 and the percentage of logically conflicting nodes is used to obtain the rule consistency score, which reflects the consistency between security policy rules. The path completeness score and the rule consistency score are then multiplied to obtain the network security logical completeness. The meaning of this multiplication is that both path completeness and rule consistency are indispensable; a deficiency in either dimension will cause the logical completeness to decrease proportionally. The logical completeness reaches its maximum value of 1 only when all causal paths are complete without breaks and all rule nodes have no logical contradictions. For example, if the percentage of logical blind spots is 0.2 and the percentage of logically conflicting nodes is 0.1, then the logical completeness is (1-0.2)×(1-0.1)=0.8×0.9=0.72.

[0078] In the above embodiments, the specific analysis method for the network security quality assessment indicator is as follows: the network security logical completeness is compared with a preset completeness threshold range to determine the completeness level range to which the network security logical completeness belongs; based on the completeness level range, the corresponding network security quality level evaluation result is generated; and the network security quality level evaluation result, the list of logical blind spots and the list of logical conflict nodes are integrated to generate a network security quality assessment report.

[0079] It should be noted that the preset completeness threshold range refers to a pre-defined numerical range used to classify network security quality levels. Completeness level ranges include, for example: The first completeness level range corresponds to a network security logical completeness greater than or equal to 0.9 and less than or equal to 1.0, indicating excellent network security logical structure, complete security policy coverage, and consistent rules; the second completeness level range corresponds to a network security logical completeness greater than or equal to 0.7 and less than 0.9, indicating a good network security logical structure with a few logical blind spots or conflicts, but overall controllable; the third completeness level range corresponds to a network security logical completeness greater than or equal to 0.4 and less than 0.7, indicating a general network security logical structure with many logical blind spots or conflicts, requiring improvement; and the fourth completeness level range corresponds to a network security logical completeness less than 0.4, indicating a poor network security logical structure with numerous logical blind spots or conflicts, posing a serious security risk.

[0080] It should be noted that generating corresponding cybersecurity quality level evaluation results based on completeness level intervals means outputting the quality level labels corresponding to the determined intervals as the evaluation results. The quality level labels for each interval are as follows: the first completeness level interval corresponds to an excellent level; the second completeness level interval corresponds to a good level; the third completeness level interval corresponds to a level that needs improvement; and the fourth completeness level interval corresponds to a dangerous level.

[0081] It should be noted that integrating these three elements to generate a cybersecurity quality assessment report means using the obtained cybersecurity quality level evaluation results as the core conclusion of the report, using the obtained list of logical blind spots as the problem details section of the report (i.e., indicating which threat paths have logical breakpoints), and using the obtained list of logical conflict nodes as another problem details section of the report (i.e., indicating which rules have logical contradictions). The final result is a cybersecurity quality assessment report with a complete structure, clear conclusions, and traceable problems.

[0082] In the above embodiments, the specific analysis method for adjusting the network security quality assessment based on the network security logic completeness is as follows: obtain a list of logical blind spots and a list of logical conflict nodes; based on each logical blind spot path in the list of logical blind spots, analyze the node type and missing causal logic direction at the interruption point of the path; and generate corresponding rule supplementation suggestions based on the node type and missing causal logic direction at the interruption point. The rule supplementation suggestions include the type of security policy rule to be supplemented, the insertion position of the rule in the security causal logic graph, and the causal connection relationship that the rule should establish.

[0083] For each logical conflict node in the list of logical conflict nodes, the conflict type and the related conflict logic semantics of the node are analyzed. Based on the conflict type and conflict logic semantics, corresponding rule correction suggestions are generated. The rule correction suggestions include the security policy rule identifier that should be corrected, the direction of deletion or modification of the conflict rule, and the logical relationship that should be established by the corrected rule.

[0084] The suggestions for supplementing and revising the rules are summarized, and combined with the completeness of the network security logic, a network security quality adjustment plan is generated, and the extracted rules are adjusted.

[0085] It should be noted that, based on the obtained list of logical blind spots, all causal paths that cannot be fully reached from the starting node to the ending node are recorded; based on the obtained list of logical conflict nodes, all rule nodes with logical semantic contradictions are recorded. These two lists are the basis for generating adjustment schemes, and contain specific path interruption locations and node contradiction information.

[0086] It's important to note that analyzing the node type at the point of path interruption refers to determining the type of node where the logical blind spot path is interrupted. Node types include starting node type (security threat type node), intermediate node type (security policy rule node), and ending node type (critical security target node). If the path is interrupted at an intermediate node, it indicates a rule gap in the defense link, requiring one or more rules to be added after that intermediate node to extend the path to the ending node. If the path is interrupted at the starting node, it indicates that the security threat is completely uncovered by any defense rules, requiring a complete defense link to be established starting from that threat node. The missing causal logical direction refers to the direction from the interruption node to reach the ending node, i.e., which type of critical security target rule should be added.

[0087] It should be noted that the specific method for generating rule supplement suggestions is as follows: If the logical blind zone path is interrupted at an intermediate node, and the node type of that intermediate node is a firewall access control rule node, and the missing causal logical direction points to the service availability target, then the generated rule supplement suggestion would be, for example: a DDoS attack defense type firewall access control rule should be added, inserted after the interrupted intermediate node, and a causal connection relationship should be established from that intermediate node through the new rule to the service availability target. The insertion position of the rule and the connection relationship are determined by the missing outward direction of the node at the interruption point.

[0088] It should be noted that analyzing the contradiction type of a node refers to determining the contradiction type of the record, including outgoing edge contradiction, incoming edge contradiction, or bidirectional contradiction. Conflict logic semantics refers to the specific logical meaning represented by contradictory outgoing or incoming edges. For example, if a rule node is determined to be outgoing edge contradictory, its outgoing edge logical semantics simultaneously include allowing traffic and denying traffic; therefore, the conflict logic semantics represent the opposition between allow and deny operations. Based on the contradiction type and conflict logic semantics, the direction of correction can be determined: for outgoing edge contradiction, one outgoing edge needs to be deleted or modified to unify the outgoing edge logical semantics of the rule node; for incoming edge contradiction, the rule's defensive positioning needs to be re-examined, and the incoming edge direction adjusted to ensure logical semantic consistency.

[0089] It should be noted that the specific method for generating rule correction suggestions is as follows: If the conflict logic semantics of a rule node are the opposite of allow and deny operations, and the configuration purpose field of the rule is explicitly marked as denying unauthorized access, then the generated rule correction suggestion is, for example: the outgoing edges pointing to the allow access direction in the rule node should be deleted, while the outgoing edges pointing to the deny access direction should be retained, to ensure that the outgoing edge logic semantics of the rule node are consistent with the rule configuration purpose.

[0090] It should be noted that summarizing rule supplementation and modification suggestions refers to categorizing and consolidating all generated rule supplementation and modification suggestions according to security policy rule types to form a structured suggestion list. Specifically, incorporating network security logical completeness means that when generating a network security quality adjustment plan, the calculated network security logical completeness is used as a preliminary summary of the plan, indicating the overall logical health status of the current network security. Following this, specific rule supplementation and modification suggestions are listed, forming a complete security quality adjustment plan.

[0091] In the above embodiments, the specific analysis method for adjusting the extraction rules is as follows: extract rule supplementation suggestions and rule correction suggestions from the network security quality adjustment scheme; according to the type of security policy rule to be supplemented, the insertion position and the causal connection relationship in the rule supplementation suggestions, add a rule node at the corresponding interruption position of the security causal logic graph, and establish a directed edge between the new rule node and its preceding and following nodes, so that the original logical blind zone path is extended to the terminal node, forming a complete causal logic path.

[0092] Based on the conflict rule identifier and correction direction in the rule correction suggestion, delete or modify the outgoing or incoming edges of logically conflicting nodes in the secure causal logic graph to eliminate the logical semantic contradiction of the node.

[0093] Based on the adjusted security causal logic graph, the process is re-executed to calculate the completeness of the adjusted network security logic and verify the adjustment effect.

[0094] It should be noted that extracting rule supplement suggestions and rule correction suggestions refers to reading the lists of rule supplement suggestions and rule correction suggestions respectively from the generated network security quality adjustment plan, which will serve as the specific operational basis for subsequent adjustments. Each rule supplement suggestion includes three elements: the type of security policy rule to be supplemented, the insertion position of the rule in the security causal logic graph, and the causal connection relationship that the rule should establish. Each rule correction suggestion includes three elements: the identifier of the security policy rule to be corrected, the direction of deletion or modification of conflicting rules, and the logical relationship that the corrected rule should establish.

[0095] It should be noted that adding a rule node at the corresponding interruption point in the security causal logic graph means, according to the insertion position in the rule supplement suggestion, establishing directed edges between the node before the interruption point in the logical blind zone path and the new node, and establishing directed edges between the new node and subsequent nodes, so that the originally interrupted path is reconnected to the final node. For example, if a logical blind zone path is an SQL injection threat node - Web Application Firewall rule node and is interrupted here, and the rule supplement suggestion is to supplement a database access filtering rule, with the insertion position after the Web Application Firewall rule node, connecting to the data confidentiality target node, then the specific operation is as follows: add a database access filtering rule node after the Web Application Firewall rule node, establish a directed edge from the Web Application Firewall rule node to the database access filtering rule node, and a directed edge from the database access filtering rule node to the data confidentiality target node, thus forming a complete causal logic path of SQL injection threat node - Web Application Firewall rule node - database access filtering rule node - data confidentiality target node.

[0096] It should be noted that deleting or modifying outgoing or incoming edges of logically conflicting nodes refers to specifically modifying the edges according to the correction direction in the rule correction suggestion. If the rule correction suggestion is to delete outgoing edges pointing to the allowed access direction and keep outgoing edges pointing to the denied access direction, the specific operation is as follows: find the directed edge in the rule node that points to the terminal node of the allowed access direction and remove it from the security causal logic graph; keep the directed edge pointing to the terminal node of the denied access direction unchanged. If the rule correction suggestion is to modify the direction of incoming edges, changing incoming edges from allowed threats to those pointing to denied threats, the specific operation is as follows: find the incoming edge in the rule node that originates from the allowed threat direction and modify its starting point to the corresponding denied threat direction, so that the logical semantics of the incoming edge are consistent with the protection purpose of the rule.

[0097] It should be noted that recalculating the adjusted network security logical completeness refers to re-performing the logical completeness test after the rule supplementation and correction operations are completed, using the adjusted security causal logic graph as the new detection object. This results in a new number of logical blind path numbers and logical conflict node numbers. Based on the total number of causal paths and rule nodes in the adjusted security causal logic graph, the network security logical completeness is recalculated. By comparing the network security logical completeness before and after the adjustment, it can be verified whether the adjustment operation effectively improved network security quality.

[0098] Reference Figure 2As shown, the present invention provides a system for executing the AI-based automated network security quality assessment method, comprising: a logic graph construction module, which acquires a set of security policy logic rules for the target network, and constructs a security causal logic graph based on the set of security policy logic rules, with security threat types as starting nodes, key security targets as ending nodes, and security policy rules as intermediate nodes, according to the causal logical relationship between security threats, security policy rules, and key security targets.

[0099] The logic detection module performs logic completeness detection based on the obtained security causal logic graph, and identifies logic blind zone paths and logic conflict nodes. The logic blind zone path is a causal path that cannot be completely reached from the starting node to the ending node, and the logic conflict node is a security policy rule node with logical contradictions.

[0100] The assessment and adjustment module calculates the network security logic completeness based on logical blind spot paths and logical conflict nodes, using it as an assessment indicator for network security quality, and adjusts the network security quality assessment based on the network security logic completeness.

[0101] The above embodiments can be implemented, in whole or in part, by software, hardware, firmware, or any other combination thereof. When implemented in software, the above embodiments can be implemented, in whole or in part, as a computer program product. Those skilled in the art will recognize that the algorithm steps of the various examples described in conjunction with the embodiments disclosed herein can be implemented in electronic hardware, or a combination of computer software and electronic hardware. Whether these functions are implemented in hardware or software depends on the specific application and design constraints of the technical solution. Those skilled in the art can use different methods to implement the described functions for each specific application, but such implementation should not be considered beyond the scope of this application.

[0102] In addition, the functional modules in the various embodiments of this application can be integrated into one processing module, or each module can exist physically separately, or two or more modules can be integrated into one module.

[0103] The above content is merely an example and illustration of the concept of the present invention. Those skilled in the art can make various modifications or additions to the specific embodiments described, or use similar methods to replace them, as long as they do not deviate from the concept of the invention or exceed the scope defined by the present invention, and all such modifications and additions should fall within the protection scope of the present invention.

Claims

1. An automated network security quality assessment method based on artificial intelligence, characterized in that, include: Step 1: Logic Graph Construction. Obtain the security policy logic rule set of the target network. Based on the security policy logic rule set, construct a security causal logic graph according to the causal logical relationship between security threats, security policy rules and key security targets, with security threat types as starting nodes, key security targets as ending nodes and security policy rules as intermediate nodes. Step 2: Logical Detection. Based on the obtained security causal logic graph, perform logical completeness detection to identify logical blind spots and logical conflict nodes. Logical blind spots are causal paths that cannot be fully reached from the starting node to the ending node, and logical conflict nodes are security policy rule nodes that have logical contradictions. Step 3: Assessment and Adjustment. Based on logical blind spots and logical conflict nodes, calculate the network security logic completeness as an assessment indicator of network security quality, and make network security quality assessment and adjustments based on the network security logic completeness.

2. The automated network security quality assessment method based on artificial intelligence according to claim 1, characterized in that, The specific analysis method for obtaining the security policy logic rule set of the target network is as follows: Obtain security policy configuration data from multiple security devices in the target network. Extract firewall access control rules, authentication rules, permission management rules, encrypted communication rules, and security audit rules from the security policy configuration data according to rule type. Associate and merge the extracted security policy logic rules according to the dependencies and constraints between the rules to form a security policy logic rule set.

3. The automated network security quality assessment method based on artificial intelligence according to claim 2, characterized in that, The specific analysis method for constructing a security causal logic diagram based on the causal logical relationship between security threats, security policy rules, and key security objectives is as follows: From the set of security policy logic rules, we extract security threat types as the starting node set, key security objectives as the ending node set, and each security policy rule as the intermediate node set. Traverse each security policy rule in the set of intermediate nodes, analyze the type of security threat that each rule defends against, establish the first directed edge from the starting node of the security threat type to the rule node, analyze the key security target protected by each rule, and establish the second directed edge from the rule node to the terminal node of the key security target. Based on the starting node, intermediate nodes, terminal node, first directed edge, and second directed edge, generate a secure causal logic graph consisting of multiple causal logic paths from the starting node through intermediate nodes to the terminal node.

4. The automated network security quality assessment method based on artificial intelligence according to claim 3, characterized in that, The specific analysis method for the identification logic blind zone path is as follows: Select a security threat type starting node from the security causal logic graph as the traversal starting point, and perform a depth traversal along the directed edges layer by layer towards the terminal node. Record the node sequence passed through the current traversal path. In the current traversal path, determine whether the current node has a directed edge pointing to the next node. If it does, continue to traverse the downward nodes along the directed edge. If it does not, determine whether the current node is the terminal node of the security causal logic graph. If the current node is not the terminal node and there is no directed edge pointing to the next node, the current traversal path is determined to be a logical blind zone path. The node sequence of the path is recorded and repeated until all starting nodes and their reachable paths in the safe causal logic graph have been traversed, and a list of logical blind zone paths is obtained.

5. The automated network security quality assessment method based on artificial intelligence according to claim 3, characterized in that, The specific analysis method for identifying logically conflicting nodes is as follows: Select an intermediate node of a security policy rule from the security causal logic graph as the node to be detected, analyze the logical meaning of all incoming edges and all outgoing edges of the node to be detected, and obtain the incoming edge logical semantic dataset and outgoing edge logical semantic dataset of the node to be detected respectively. Compare each logical semantic in the outgoing edge logical semantic dataset pairwise to determine if there are two or more outgoing edges with contradictory logical semantics. Similarly, compare each logical semantic in the incoming edge logical semantic dataset pairwise to determine if there are two or more incoming edges with contradictory logical semantics. If there are two or more contradictory outgoing edges in the outgoing edge logical semantic dataset, or two or more contradictory incoming edges in the incoming edge logical semantic dataset, the node to be detected is identified as a logical conflict node. The identification information and contradiction type of the node are recorded, and the process is repeated until all intermediate nodes in the safe causal logic graph have been detected, resulting in a list of logical conflict nodes.

6. The automated network security quality assessment method based on artificial intelligence according to claim 3, characterized in that, The specific analysis method for calculating the network security logic completeness based on logical blind zone paths and logical conflict nodes is as follows: The number of logical blind zone paths is obtained as the logical blind zone path count, and the total number of all causal paths from the start node to the end node in the secure causal logic graph is obtained as the total number of causal paths. The number of logically conflicting nodes is obtained as the number of logically conflicting nodes, and the total number of security policy rule nodes in the full causal logic graph is obtained as the total number of security policy rule nodes. Divide the number of logical blind zone paths by the total number of causal paths to obtain the percentage of logical blind zone paths; divide the number of logical conflict nodes by the total number of security policy rule nodes to obtain the percentage of logical conflict nodes. The network security logic completeness is calculated based on the proportion of logical blind spots and the proportion of logical conflict nodes.

7. The automated network security quality assessment method based on artificial intelligence according to claim 6, characterized in that, The specific analysis method for this indicator, used as an assessment indicator of network security quality, is as follows: The network security logic completeness is compared with the preset completeness threshold range to determine the completeness level range to which the network security logic completeness belongs. Based on the completeness level range, the corresponding network security quality level evaluation result is generated. The network security quality level evaluation result, the list of logical blind spots and the list of logical conflict nodes are integrated to generate a network security quality assessment report.

8. The automated network security quality assessment method based on artificial intelligence according to claim 6, characterized in that, The method for adjusting network security quality assessment based on network security logical completeness is as follows: Obtain a list of logical blind zone paths and a list of logical conflict nodes. Based on each logical blind zone path in the list, analyze the node type and missing causal logic direction at the break point of the path. Based on the node type and missing causal logic direction at the break point, generate corresponding rule supplement suggestions. The rule supplement suggestions include the type of security policy rule to be supplemented, the insertion position of the rule in the security causal logic graph, and the causal connection relationship that the rule should establish. Based on each logical conflict node in the list of logical conflict nodes, the contradiction type and the related conflict logic semantics of the node are analyzed. According to the contradiction type and conflict logic semantics, corresponding rule correction suggestions are generated. The rule correction suggestions include the security policy rule identifier that should be corrected, the direction of deletion or modification of the conflict rule, and the logical relationship that should be established by the corrected rule. The suggestions for supplementing and revising the rules are summarized, and combined with the completeness of the network security logic, a network security quality adjustment plan is generated, and the extracted rules are adjusted.

9. The automated network security quality assessment method based on artificial intelligence according to claim 1, characterized in that, The specific analysis method for adjusting the extraction rules is as follows: Extract rule supplementation suggestions and rule correction suggestions from the network security quality adjustment plan. Based on the type of security policy rule to be supplemented, the insertion position and causal connection relationship in the rule supplementation suggestions, add rule nodes at the corresponding interruption position of the security causal logic graph, and establish directed edges between the new rule nodes and the nodes before and after them, so that the original logical blind zone path is extended to the terminal node and a complete causal logic path is formed. Based on the conflict rule identifier and correction direction in the rule correction suggestion, delete or modify the outgoing or incoming edges of logically conflicting nodes in the security causal logic graph to eliminate the logical semantic contradiction of the node. Based on the adjusted security causal logic graph, the process is re-executed to calculate the completeness of the adjusted network security logic and verify the adjustment effect.

10. A system utilizing the automated network security quality assessment method based on artificial intelligence as described in any one of claims 1-9, characterized in that, include: The logic graph construction module obtains the security policy logic rule set of the target network. Based on the security policy logic rule set, it constructs a security causal logic graph according to the causal logical relationship between security threats, security policy rules and key security targets, with security threat types as starting nodes, key security targets as ending nodes and security policy rules as intermediate nodes. The logic detection module performs logic completeness detection based on the obtained security causal logic graph, and identifies logic blind path and logic conflict node. The logic blind path is a causal path that cannot be completely reached from the starting node to the ending node, and the logic conflict node is a security policy rule node with logical contradiction. The assessment and adjustment module calculates the network security logic completeness based on logical blind spot paths and logical conflict nodes, using it as an assessment indicator for network security quality, and adjusts the network security quality assessment based on the network security logic completeness.

Images