An intelligent safety management method and system for IT equipment

Abstract

This invention discloses an intelligent security management method and system for IT equipment, relating to the field of IT equipment security management technology. It acquires real-time operational data of IT equipment and constructs a digital twin environment to simulate the operating status of the IT equipment. Based on a preset initial security policy, it generates policy instances within the digital twin environment and uses these policy instances to independently handle virtual security alarm tasks. Upon receiving a signal that a policy instance has completed processing a virtual security alarm task, it verifies the policy instance based on the processing result and optimizes and updates the initial security policy according to the verification result. The optimized and updated initial security policy is then deployed to the IT equipment for execution. This invention solves the problems of security policies being unable to simultaneously achieve rapid deployment and accurate identification, static rules lacking adaptive evolution, and the need for trial and error in a real environment to verify effectiveness.

Description

Technical Field

[0001] This invention relates to the field of IT equipment security management technology, specifically to an intelligent security management method and system for IT equipment. Background Technology

[0002] With the continuous evolution and diversification of cyberattack methods, the security management of IT equipment faces increasingly severe challenges. Enterprise IT environments deploy a large number of servers, network devices, storage devices, and security devices, which generate tens of thousands of security alerts daily. Accurately identifying truly threatening security events from such a massive volume of alerts and taking effective countermeasures has become a pressing technical challenge in the field of IT security management.

[0003] Existing IT equipment security management solutions typically rely on static rule bases or periodically updated policies for identifying and handling security alerts. When faced with new attack methods or abnormal behavior patterns, existing security policies often fail to respond promptly, leading to missed or false alarms. Some solutions attempt to validate and optimize security policies in digital twin environments; however, existing solutions usually require policies to be optimized to perfection in the twin environment before being deployed to the real environment. This process is time-consuming, and even optimized policies may deviate in actual implementation when there are differences between the twin and the real environment. Furthermore, existing solutions lack mechanisms for continuous tracking and iterative optimization of new problems arising from the actual implementation of deployed policies, resulting in long update cycles and difficulty in adapting to rapidly changing threat environments.

[0004] Therefore, in response to the above problems, there is an urgent need for an intelligent security management method and system for IT equipment. Summary of the Invention

[0005] To address the shortcomings of existing technologies, this invention provides an intelligent security management method and system for IT equipment, which solves the problems of security policies being unable to balance rapid deployment and accurate identification in a rapidly evolving network threat environment, and the inability of static rules to adapt and evolve.

[0006] To achieve the above objectives, the present invention provides the following technical solution: an intelligent security management method for IT equipment, comprising the following steps: acquiring real-time operating data of the IT equipment and constructing a digital twin environment for simulating the operating status of the IT equipment; generating a policy instance in the digital twin environment according to a preset initial security policy, and independently processing virtual security alarm tasks using the policy instance in the digital twin environment; upon receiving a signal that the policy instance has completed processing the virtual security alarm task, verifying the policy instance based on the processing result, and optimizing and updating the initial security policy based on the verification result; and distributing the optimized and updated initial security policy to the IT equipment for execution.

[0007] Furthermore, the step of generating a policy instance in the digital twin environment according to the preset initial security policy includes: performing a lightweight clone of the initial security policy to generate a policy instance with the same decision-making function as the initial security policy; the policy instance maintains logical isolation from the initial security policy while running independently in the digital twin environment, and is destroyed after completing the virtual security alarm task; the running state of the policy instance does not directly affect the initial security policy.

[0008] Furthermore, the step of independently processing virtual security alarm tasks in a digital twin environment using a policy instance includes: the policy instance receiving virtual security alarm tasks generated in the digital twin environment, processing the virtual security alarm tasks using the decision logic of the initial security policy when receiving security alarms, and obtaining processing results.

[0009] Furthermore, the verification of the policy instance based on the processing result includes: when the processing result is received, sending a signal carrying the processing result to the central control port of the digital twin environment; when the central control port receives the signal, activating the verification mechanism in the digital twin environment; the verification mechanism includes: comparing the processing result carried in the signal with a preset processing result benchmark, and judging whether there is an error in the task processing status of the policy instance based on the comparison result; when the error exceeds the preset error benchmark value, marking the corresponding policy instance and the virtual security alarm task processed by the policy instance.

[0010] Further, the optimization and update of the initial security policy based on the verification results includes: determining the decision logic flaw in the initial security policy that causes the error based on the error present in the task processing status of the policy instance; connecting to an external optimization method knowledge base using the external interface of the digital twin environment, sending a query signal carrying the decision logic flaw to the external optimization method knowledge base, and when the external optimization method knowledge base returns an optimization method that matches the decision logic flaw, applying the optimization method to the initial security policy for optimization and update; when the external optimization method knowledge base returns a blind zone signal, adjusting the decision parameters in the initial security policy corresponding to the decision logic flaw in the digital twin environment until the error generated by the policy instance regenerated based on the adjusted initial security policy in processing the marked virtual security alarm task is lower than a preset error benchmark value, wherein the blind zone signal indicates that there is no optimization method in the external optimization method knowledge base that matches the decision logic flaw; and issuing the optimized and updated or decision parameter-adjusted initial security policy as the first security policy to the IT equipment for execution.

[0011] Furthermore, the verification mechanism also includes: acquiring the performance evaluation data of the initial security policy after a preset number of consecutive optimization updates or decision parameter adjustments; when the performance evaluation data meets a preset steady-state condition, reducing the verification frequency of the policy instance to a preset low frequency, wherein the steady-state condition includes: the change in the performance index of the performance evaluation data is lower than a preset threshold.

[0012] Furthermore, the method for presetting the initial security policy includes: randomly selecting a preset first number of security policies from all security policies stored in the digital twin environment, and performing cross-learning on the selected security policies so that each security policy learns each other's decision logic; fusing the cross-learned security policies to generate a preset second number of candidate security policies; and using a decision filter in the digital twin environment to select a candidate security policy from the candidate security policies as the preset initial security policy.

[0013] Furthermore, the step of selecting a candidate security strategy from the candidate security strategies as the preset initial security strategy includes: obtaining the evaluation data of each candidate security strategy under the preset evaluation criteria through a decision filter, sorting each candidate security strategy based on the pecking order graph method, and selecting the candidate security strategy with the highest ranking from the candidate security strategies as the preset initial security strategy according to the ranking result.

[0014] Furthermore, after the first security policy is issued to the IT equipment for execution, the operating status of the IT equipment is monitored; when a new security alarm is detected by the IT equipment, the first security policy is used as the new initial security policy and returned to the digital twin environment for optimization and update.

[0015] An intelligent security management system for IT equipment, applying the aforementioned intelligent security management method for IT equipment, includes: a digital twin environment construction module for acquiring real-time operational data of the IT equipment and constructing a digital twin environment to simulate the operational status of the IT equipment; a policy simulation module for generating policy instances in the digital twin environment according to a preset initial security policy, and independently processing virtual security alarm tasks using the policy instances in the digital twin environment; a policy verification module for verifying the policy instances based on the processing results after receiving a signal that the policy instances have completed processing the virtual security alarm tasks, and optimizing and updating the initial security policy based on the verification results; and a policy distribution module for distributing the optimized and updated security policy to the IT equipment for execution.

[0016] The present invention has the following beneficial effects:

[0017] This intelligent security management method and system for IT equipment generates policy instances that are functionally equivalent to but logically isolated from the initial security policy. Virtual security alerts are processed first in a digital twin environment, enabling verification of security policies without affecting the operation of real IT equipment. Any erroneous judgments generated by the policy instance are not written into the initial security policy, ensuring the stability of the main policy and avoiding the business interruption risk that might occur from directly deploying the policy. A verification mechanism is employed to check the processing results of the policy instance in the previous stage, accurately identifying errors and pinpointing the decision-making logic defects in the initial security policy that caused the errors. This provides a basis for optimization, significantly improving the targeting and effectiveness of policy optimization. Furthermore, a knowledge base of external optimization methods is used to address known defects. Rapid repair and autonomous optimization through iterative adjustment of decision parameters when no matching solution is available. The dual-path approach ensures that the strategy can be improved under various conditions, and a new strategy instance is generated for verification after each adjustment. The optimization process is quantifiable and verifiable, with the error falling below the baseline value as the stopping condition. The verification frequency is automatically reduced through steady-state judgment, saving system resources after the strategy tends to stabilize. The optimal initial strategy is generated by comprehensively analyzing historical strategies through multi-strategy cross-learning, fusion, and optima graph screening. The strategy can be deployed and executed before it reaches a completely error-free state, which greatly shortens the cycle from strategy verification to deployment. The progressive deployment strategy of strengthening verification in the early stage and gradually weakening it in the later stage balances security and efficiency, enabling security management to evolve from static rules to dynamic adaptive evolution.

[0018] Of course, any product implementing this invention does not necessarily need to achieve all of the advantages described above at the same time. Attached Figure Description

[0019] Figure 1 This is a flowchart of an intelligent security management method for IT equipment according to the present invention.

[0020] Figure 2 This is a logical flowchart of the construction of a digital twin environment in an intelligent security management method for IT equipment according to the present invention.

[0021] Figure 3 This is a logical flowchart of strategy simulation in an intelligent security management method for IT equipment according to the present invention.

[0022] Figure 4 This is a flowchart illustrating the policy verification process in an intelligent security management method for IT equipment according to the present invention.

[0023] Figure 5 This is a flowchart illustrating the policy issuance and feedback process in an intelligent security management method for IT equipment according to the present invention.

[0024] Figure 6 This is a module diagram of an intelligent security management system for IT equipment according to the present invention. Detailed Implementation

[0025] This application embodiment provides an intelligent security management method and system for IT equipment, which enables security policies to be implemented in a digital twin environment through policy instance verification, delayed verification feedback, and iterative closed-loop mechanism. This allows for online execution without waiting for complete error-free execution, and continuous evolution and increasing accuracy in actual operation, resulting in dynamic adaptive security management.

[0026] The problem addressed in this application's embodiments can be summarized as follows:

[0027] Construct a digital twin environment that is synchronized with physical IT devices in real time; generate functionally equivalent but logically isolated policy instances from the initial security policy, and process virtual security alarm tasks in the twin environment first; compare the processing results of the policy instances with the preset benchmark through a hysteresis verification mechanism to identify errors and locate the decision logic defects in the initial security policy accordingly; optimize the policy by retrieving matching solutions from the knowledge base through external optimization methods or by iteratively adjusting decision parameters within the twin environment; distribute the optimized policy to physical devices for execution, and continuously monitor new alarms to trigger a new round of optimization.

[0028] Example 1, please refer to Figure 1 This invention provides a technical solution: an intelligent security management method for IT equipment, comprising the following steps:

[0029] Please see Figure 2 Step S101: Obtain real-time operating data of IT equipment and build a digital twin environment to simulate the operating status of IT equipment.

[0030] In this embodiment, IT equipment refers to various electronic devices that require security management. Specifically, IT equipment includes servers, network devices, storage devices, and security devices. Servers refer to physical or virtual computers that provide computing services, including rack servers, blade servers, and tower servers. Network devices refer to devices used for data communication and network connectivity, including switches, routers, and firewalls. Storage devices refer to devices used for data storage, including disk arrays and network-attached storage devices. Security devices refer to devices specifically designed for network and information security protection, including intrusion detection systems, intrusion prevention systems, and bastion hosts.

[0031] In this embodiment, real-time operational data refers to various data continuously generated by IT equipment during operation, reflecting the current state of the equipment. Specifically, real-time operational data includes the following five categories:

[0032] The first category is performance metrics data. Performance metrics data includes CPU utilization, memory usage, disk read / write speeds, and network bandwidth utilization. CPU utilization reflects the device's current computing load, memory usage reflects the device's memory resource usage, disk read / write speeds reflect the device's storage access speed, and network bandwidth utilization reflects the device's network communication load. These performance metrics data are obtained through the IT equipment's built-in performance monitoring interface or read from the device's management information database via Simple Network Management Protocol (SMLP).

[0033] The second category is log data. Log data includes system logs, security logs, and access logs. System logs record system-level events such as device startup, shutdown, and errors; security logs record security-related events such as login attempts and permission changes; and access logs record user or program access operations on device resources. This log data is obtained from the log storage locations of various IT devices using log collection tools.

[0034] The third category is configuration data. Configuration data includes the configuration parameters and policy rules of IT devices. Examples include firewall access control lists, router routing tables, and server user permission configurations. Configuration data is obtained through a configuration management database or by directly reading the device's configuration files.

[0035] The fourth category is network traffic data. Network traffic data includes packet size, traffic direction, and protocol type. Network traffic data is obtained through network traffic acquisition tools at network switching nodes or gateways.

[0036] The fifth category is alarm data. Alarm data refers to alarm records generated by the existing security system, including the type of alarm, the time of occurrence of the alarm, and the devices involved. Alarm data is obtained through the alarm information interface of the security system.

[0037] In this embodiment, the role of real-time operational data in constructing the digital twin environment includes: performance index data and network traffic data provide dynamic operational status parameters for the digital twin environment, enabling the device models in the virtual environment to operate at the same load level as the physical devices; configuration data provides the digital twin environment with static structure and rule information of the devices, enabling the device models in the virtual environment to have the same functions and constraints as the physical devices; and log data and alarm data provide historical event samples for the digital twin environment, used to generate virtual security alarm tasks and set verification benchmarks.

[0038] In this embodiment, a digital twin environment refers to a digital mirror system built in virtual space that maps one-to-one with physical IT devices and is synchronized in real time. This digital twin environment is used to simulate the operating state of IT devices.

[0039] The construction of a digital twin environment includes the following steps:

[0040] S11. Obtain static information for each IT device. Static information includes the device model, specifications, software version, network topology connections, and initial configuration parameters. Specifically, the device model and specifications are obtained from the device purchase ledger or asset management system; the software version is obtained using the device version query command; the network topology connections are obtained using network scanning tools or manually compiled network topology diagrams; and the initial configuration parameters are obtained from the configuration management database. Based on the above static information, a basic digital model of each IT device is created in virtual space. This basic digital model contains various static attributes of the device, but at this point, real-time operational data has not yet been integrated, therefore it is in a static state.

[0041] S12 continuously inputs real-time operational data into the basic digital models corresponding to each IT device. Specifically, according to a preset synchronization cycle, such as every five seconds, performance indicator data, log data, configuration data, network traffic data, and alarm data collected from the physical devices are input into the corresponding digital models, ensuring that the state parameters of the digital models are consistent with the state parameters of the physical devices. For example, when the CPU utilization rate of the physical server is 70%, the corresponding CPU utilization rate parameter in the digital model is also updated to 70%. Through this continuous data input, the digital model transforms from a static state to a dynamic state, reflecting the real-time operating status of the physical devices.

[0042] S13, Configure the behavioral rules for the digital twin environment. Behavioral rules refer to the rules by which virtual devices in the digital twin environment operate according to the same logical rules as physical devices. When a virtual security alert task is input into a virtual device in the digital twin environment, the virtual device's processing and results for that task are consistent with its behavior when executing the same security policy on the physical device. The behavioral rules are configured by replicating the decision logic of the operating system, applications, and security policies running on the physical device into the digital twin environment as a set of rules. For example, if the physical firewall's access control rule is: prohibit all access requests from IP address range A, then the corresponding virtual firewall in the digital twin environment will also have the same rule configured.

[0043] Through the steps described above, a digital twin environment is constructed as a virtual mirror system that is highly consistent with the physical IT environment, synchronized in real time, and interactive. This digital twin environment provides a testing platform consistent with the real environment for subsequent verification of security policies.

[0044] Please see Figure 3Step S102: Generate a policy instance in the digital twin environment according to the preset initial security policy, and use the policy instance to independently process virtual security alarm tasks in the digital twin environment.

[0045] In this embodiment, the initial security policy refers to a pre-defined set of rules for identifying and handling security alarms. This initial security policy is obtained by selecting one from multiple security policies stored in the digital twin environment.

[0046] In this embodiment, a policy instance refers to an independently running copy of a policy generated by the initial security policy in a digital twin environment.

[0047] The policy instance is generated by performing a lightweight clone of the initial security policy. Lightweight cloning means copying only the decision logic of the initial security policy, without copying auxiliary information such as state data, cached data, and log records generated during the policy's historical operation.

[0048] Specifically, lightweight cloning includes the following steps:

[0049] S21. Extract all decision rules from the initial security policy. Each decision rule includes three elements: trigger condition, judgment basis, and action. The trigger condition refers to the prerequisites that must be met to activate the rule, such as: when an IP address initiates more than one hundred connection requests within ten seconds. The judgment basis refers to the data source and comparison standard on which the judgment is based, such as: comparing the IP address's historical access records with a known malicious IP address database. The action refers to the operation performed after the judgment is completed, such as: blocking all subsequent requests from the IP address and generating an alarm record.

[0050] S22 encapsulates all extracted decision rules into an independent, runnable policy copy. This policy copy contains the exact same set of decision rules as the initial security policy, but does not include the historical execution records, temporary cached data, and runtime logs of the initial security policy.

[0051] S23, allocate a separate runtime space for this policy copy in the digital twin environment. This runtime space includes a separate process or container, a separate memory region, and a separate storage space.

[0052] By following the steps above, a policy instance with the same decision-making function as the initial security policy is generated.

[0053] In this embodiment, having the same decision-making function as the initial security policy means that for any given virtual security alarm task, the policy instance processes it according to the exact same judgment logic as the initial security policy, and the final processing conclusion is consistent with the conclusion given by the initial security policy. The same judgment logic includes: the same condition judgment order, the same threshold standard, and the same action selection rules.

[0054] In this embodiment, the policy instance remains logically isolated from the initial security policy while running independently in the digital twin environment.

[0055] Logical isolation means that any state changes that occur during the execution of a policy instance will not be written to the storage space of the initial security policy, nor will they change the decision rules of the initial security policy.

[0056] The logical isolation is implemented as follows: policy instances use independent storage space, which is separate from the storage space of the initial security policy and there is no data sharing channel; temporary data, intermediate calculation results and processing records generated by the policy instance during operation are stored only in the policy instance's own storage space; the policy instance's processing operations on virtual security alarm tasks will not trigger any changes to the initial security policy.

[0057] The fact that the running state of a policy instance does not directly affect the initial security policy means that while a policy instance may make incorrect judgments or deviations during the processing of virtual security alert tasks, these errors and deviations will not be written into the initial security policy. Therefore, the decision-making logic of the initial security policy remains unchanged. This design allows policy instances to freely undergo various tests and verifications without causing any damage to the initial security policy, thus ensuring the stability and reliability of the initial security policy.

[0058] In this embodiment, the virtual security alert task refers to a security alert event simulated in a digital twin environment, used to test the processing capability of the policy instance.

[0059] The generation of virtual security alert tasks can be achieved in several ways: First, by selecting and replaying historical alert records. Specifically, representative alert records are selected from stored historical alert data of IT devices, such as alerts of different types of attacks or different severity levels. These alert records are then regenerated in a digital twin environment and used as input to the policy instance as a virtual security alert task. Second, by constructing simulated alerts based on known attack patterns. Specifically, based on publicly available threat intelligence and attack signature databases, simulated alert events conforming to specific attack patterns are constructed and used as virtual security alert tasks, such as distributed denial-of-service attacks, malware propagation, and port scanning. Third, test cases can be manually entered by operations and maintenance personnel. Specifically, operations and maintenance personnel can customize and input specific test scenarios and alert data according to actual security management needs, which are then used as virtual security alert tasks.

[0060] In this embodiment, the specific method by which the policy instance independently processes virtual security alarm tasks in the digital twin environment is as follows: The policy instance receives virtual security alarm tasks generated in the digital twin environment. These virtual security alarm tasks are sent to the policy instance's runtime space in a standardized data format, which includes the alarm type, occurrence time, involved devices, and key characteristic parameters. The policy instance processes the virtual security alarm tasks according to the decision logic of the initial security policy. Specifically, the policy instance compares the characteristic parameters of the virtual security alarm tasks with its own decision rules one by one: First, it determines whether the task meets the triggering condition of a certain rule; if it does, it analyzes the task according to the judgment criteria of that rule; finally, it executes the corresponding handling action based on the analysis result, such as determining it as normal, determining it as abnormal and generating an alarm, determining it as an attack and suggesting blocking, etc. The policy instance generates a processing result, which includes: the identification information of the virtual security alarm task, the policy instance's judgment conclusion on the task, and a record of the executed handling action.

[0061] In this embodiment, the policy instance is destroyed after it has finished processing the virtual security alarm task.

[0062] The strategy instance is destroyed by shutting down the process or container corresponding to the strategy instance and reclaiming the memory and storage space it occupies. The significance of destroying strategy instances is to release computing and storage resources in the digital twin environment and prevent a large number of strategy instances that have completed their tasks from continuously occupying system resources.

[0063] Please see Figure 4 Step S103: After receiving the signal that the policy instance has finished processing the virtual security alarm task, the policy instance is verified based on the processing result, and the initial security policy is optimized and updated according to the verification result.

[0064] In this embodiment, after the policy instance completes the processing of the virtual security alarm task, the policy instance sends a signal carrying the processing result to the central control port of the digital twin environment.

[0065] The central control port is the interface module in a digital twin environment responsible for receiving and distributing various signals. Its functions include: receiving processing completion signals sent by policy instances, routing the signals to the verification module, receiving the verification results from the verification module, and passing them to the optimization module.

[0066] The signal carrying the processing result specifically includes the following: the identification information of the policy instance, the identification information of the virtual security alarm task being processed, the policy instance's judgment conclusion on the task, and the key data used in the processing. The identification information of the policy instance is specifically used to identify which policy instance completed the processing, the identification information of the virtual security alarm task being processed is specifically used to identify which task was processed, the policy instance's judgment conclusion on the task such as positive, abnormal, attack, etc., and the key data used in the processing such as the compared feature values ​​and the referenced rule numbers.

[0067] The signal is sent as follows: the policy instance encapsulates the above information into a data packet through the message channel inside the digital twin environment and sends it to the receiving address of the central control port.

[0068] In this embodiment, when the central control port receives a signal sent by the policy instance, it initiates the verification mechanism in the digital twin environment.

[0069] The verification mechanism refers to a set of rules and procedures that compare the processing result of a policy instance with a preset processing result benchmark to determine whether the two are consistent.

[0070] The specific execution method of the verification mechanism is as follows:

[0071] S311, the central control port forwards the received signal to the verification module. The verification module is a functional unit specifically responsible for performing verification functions in a digital twin environment.

[0072] S312, the verification module extracts the processing results of the strategy instance from the signal, including the judgment conclusion and processing record.

[0073] S313, the verification module obtains the preset processing result benchmark corresponding to the virtual security alarm task. The processing result benchmark is a pre-determined correct handling method for each virtual security alarm task.

[0074] The default method for setting the processing result benchmark is as follows: For each virtual security alarm task, the correct handling method is predetermined by the operations and maintenance personnel or the system when the task is generated, and this correct handling method is associated with and stored with the task. Specifically, for tasks selected from historical alarm records, the correct handling method can be obtained from the actual handling results in the historical records; for tasks constructed based on attack patterns, the correct handling method is determined by the attack pattern used during construction; for tasks manually entered by operations and maintenance personnel, the correct handling method is set by the operations and maintenance personnel at the time of input.

[0075] For example, for a virtual alarm task that reports an IP address making a large number of connection requests outside of working hours, the default processing benchmark is: it is determined to be abnormal scanning behavior, and it is recommended to block all requests from that IP address.

[0076] S314, the verification module compares the processing conclusion of the strategy instance with the correct conclusion in the processing result benchmark. The specific comparison method is: compare the judgment conclusion of the strategy instance with the correct conclusion in the benchmark item by item to see if they are consistent.

[0077] If the two are consistent, it is determined that the strategy instance has no error in processing the task.

[0078] If the two are inconsistent, for example, the policy instance is judged as normal, while the baseline is judged as abnormal, then it is determined that the policy instance has an error in processing the task.

[0079] In this embodiment, error refers to the inconsistency between the processing conclusion of a policy instance for a virtual security alert task and the preset correct conclusion. The error is quantified by counting the number of inconsistencies generated by a policy instance in processing all virtual security alert tasks.

[0080] When the number of errors exceeds the preset error baseline value, the policy instance and the virtual security alarm task it processes are marked.

[0081] The error baseline value refers to the upper limit of the allowable number of errors. The error baseline value is preset by the operations and maintenance personnel during system initialization based on the actual business requirements for the accuracy of security policies. For example, if the accuracy of the security policy is required to be no less than 95%, then for every 100 tasks processed, the allowable number of errors is no more than five; that is, the error baseline value is set to five.

[0082] The specific method of marking is as follows: an error marker is added to the record of the policy instance that is determined to have an error, and an error-handled marker is added to the record of each virtual security alert task processed by that policy instance. The significance of marking is that subsequent optimization steps can quickly locate the problematic policy instance and the corresponding task, thereby enabling targeted optimization.

[0083] In this embodiment, the specific method for optimizing and updating the initial security policy based on the verification results is as follows:

[0084] S321, Obtain the processing error marked by the verification mechanism. Specifically, extract all policy instances marked as having errors and their corresponding virtual security alarm tasks from the marking records.

[0085] S322, Based on the error present in the task processing status of the policy instance, determine the decision logic defect in the initial security policy that caused the error.

[0086] A decision logic flaw refers to a specific rule or parameter in the initial security policy that causes the policy instance to make an incorrect judgment. The specific steps to identify a decision logic flaw are as follows: For each marked error, identify which decision rule and at which stage the policy instance made the incorrect judgment when processing the corresponding virtual security alarm task. Specifically, check the policy instance's processing records to determine whether the trigger condition judgment was incorrect, the judgment basis referenced incorrectly, or the action selection incorrectly. The specific rule or parameter in the initial security policy corresponding to the erroneous stage is identified as the decision logic flaw. For example, if the policy instance judges a task that should be considered abnormal as normal, and it is found that the failure to trigger was due to a rule's threshold being set too high, then that threshold setting is the decision logic flaw.

[0087] S323 utilizes the external interface of the digital twin environment to connect to an external optimization method knowledge base and sends a query signal carrying decision logic defects to the external optimization method knowledge base.

[0088] The external interface serves as the communication channel between the digital twin environment and external systems. Its functions include sending query requests carrying information about decision logic flaws to an external optimization technique knowledge base, and receiving response data from that knowledge base. Logically, the external interface is a standardized data exchange channel that uses a pre-defined communication protocol for sending and receiving data.

[0089] The external optimization techniques knowledge base is an external storage system independent of the digital twin environment, storing verified security policy optimization schemes. The knowledge base stores the following information for each optimization scheme: a description of the defect type, the applicable policy type, specific modification suggestions, and historical verification records. The defect type description explains what type of decision logic defect the scheme is suitable for addressing; the applicable policy type explains what type of security policy the scheme is applicable to; the specific modification suggestions explain how to modify the policy to address the defect; and the historical verification records demonstrate the effectiveness of the scheme in previous applications.

[0090] The external optimization method knowledge base is constructed as follows: operations and maintenance personnel input and store optimization solutions that have successfully resolved similar decision logic defects in the past. For example, if a defect of a certain type of DDoS attack going undetected has occurred in the past, and operations and maintenance personnel resolved the defect by adding a detection rule for this type of attack to the policy with a threshold of one hundred requests per second, then the defect type and the corresponding solution are stored as an optimization solution in the external optimization method knowledge base.

[0091] The query signal is sent as follows: the external interface encapsulates the characteristic information of the decision logic defect into a query request data packet, and sends it to the receiving address of the external optimization method knowledge base through the communication network. The characteristic information of the decision logic defect includes the type of defect, the type of attack involved, and the specific manifestation of the error.

[0092] S324, When there is an optimization method in the external optimization method knowledge base that matches the decision logic defect, the external optimization method knowledge base will send the matching optimization method back to the digital twin environment.

[0093] The specific matching steps are as follows: After receiving the query request, the external optimization method knowledge base compares the decision logic defect features in the query request with the defect type descriptions of each optimization scheme in the knowledge base one by one. If the defect type description of an optimization scheme is the same as or highly similar to the features of the current defect, then the optimization scheme is determined as the matching optimization method.

[0094] Optimization measures refer to specific modification schemes for addressing defects in particular decision-making logic. For example, for the defect of missed detection of a certain type of attack, the optimization measure is to add a detection rule for the characteristics of this type of attack to the strategy, with a threshold of X; for the defect of excessively high false positive rate, the optimization measure is to adjust the trigger threshold of a certain rule from Y to Z.

[0095] Once the matching optimization method is determined, the external optimization method knowledge base transmits the detailed content of the optimization method back to the external interface of the digital twin environment through the communication network. The detailed content includes specific modification suggestions, modification locations, and expected effects after modification.

[0096] S325: Apply the optimization techniques returned to the initial security policy for optimization and update. Specifically, modify the corresponding locations in the initial security policy according to the modification suggestions in the optimization techniques. After modification, save the modified policy as the optimized and updated initial security policy.

[0097] S326, When there is no optimization method in the external optimization method knowledge base that matches the decision logic defect, the external optimization method knowledge base transmits the blind zone signal back to the digital twin environment.

[0098] A blind zone signal is a specific signal indicating that there is no optimization method in the external optimization method knowledge base that matches the current decision logic defect. The blind zone signal is generated as follows: after traversing all stored optimization solutions, if the external optimization method knowledge base does not find any solution that matches the current defect feature, it automatically generates a signal indicating that no matching solution was found and sends it back.

[0099] S327, When the digital twin environment receives a blind zone signal, the decision parameters corresponding to the decision logic defects in the initial security policy are adjusted in the digital twin environment.

[0100] Decision parameters refer to numerical or logical parameters in the initial security policy that can be adjusted to change the policy's behavior. Decision parameters include, but are not limited to: trigger thresholds for various detection rules, such as 100 times in the context of more than 100 connection requests per second; the length of the time window in the judgment condition, such as 10 seconds in the context of 10 seconds; and the intensity level of the action, such as the level of blocking or alarm.

[0101] The steps for adjusting decision parameters are as follows: First, determine the specific parameter that needs adjustment. Based on the type of decision logic defect, determine which parameter caused the incorrect judgment. For example, if the defect is that the threshold is too high, leading to missed detections, then the parameter that needs adjustment is the trigger threshold of this rule. Second, adjust the parameter according to the preset adjustment direction, which is determined by the type of defect: if the defect is that the threshold is too high, the adjustment direction is to lower the threshold; if the defect is that the threshold is too low, the adjustment direction is to raise the threshold. The adjustment increment is the preset step size, for example, five units each time.

[0102] The policy instance is regenerated based on the adjusted initial security policy. The regeneration method is the same as that used in step S2: the adjusted initial security policy is lightly cloned to generate a new policy instance in the digital twin environment.

[0103] The newly generated policy instance is used to reprocess the virtual security alarm tasks marked as having errors, and the newly generated error is determined to be lower than the preset error benchmark value according to the verification method described in step S3.

[0104] If the newly generated error is lower than the error baseline, the adjustment is stopped, and the current adjusted initial security policy is taken as the optimization result.

[0105] If the newly generated error is still not lower than the error benchmark value, continue to adjust the parameters again according to the above steps, and repeat the process of adjustment, generating a new strategy instance, reprocessing, and verification until the error is lower than the error benchmark value.

[0106] In this embodiment, the reason for regenerating the policy instance after each adjustment, instead of using a previously generated policy instance, is that the previous policy instance was destroyed after completing the task. Destroying the policy instance after task completion releases the computing and storage resources of the digital twin environment. When testing the adjusted policy, a new policy instance must be generated based on the adjusted policy for testing, ensuring that there are never too many invalid policy instances consuming resources in the digital twin environment.

[0107] S328, the initial security policy after optimization and update or adjustment of decision parameters shall be used as the first security policy.

[0108] Please see Figure 5 Step S104: The optimized and updated initial security policy is sent to the IT device for execution.

[0109] In this embodiment, "deployment" refers to the process of transmitting the optimized and updated security policy from the digital twin environment to the physical IT device.

[0110] The specific steps for issuing the document are as follows:

[0111] S41 converts the set of decision rules for the primary security policy into a format executable by physical IT devices. Different IT devices may require different formats; for example, firewalls require access control lists, and servers require configuration files.

[0112] S42 transmits the transformed policy data to the target IT device through a secure management channel. The management channel is a dedicated network channel for device management, isolated from the business data channel to ensure the security of the transmission process.

[0113] S43, load and activate the received policy data on the target IT device, so that the policy begins to process security alerts generated on the IT device.

[0114] In this embodiment, the first security policy is executed on the IT device in the following way: when the IT device detects a security event that meets the triggering conditions of a certain rule in the policy, it analyzes the event according to the judgment criteria of the rule and executes the corresponding handling action based on the analysis results.

[0115] Thus, the method provided in this embodiment completes the entire process from policy verification and optimization in the digital twin environment to policy distribution and execution in the physical environment.

[0116] Example 2: Based on Example 1 above, this example further illustrates the steady-state judgment and verification frequency adjustment of the verification mechanism.

[0117] In this embodiment, the verification mechanism in the digital twin environment also performs the following operations:

[0118] Obtain performance evaluation data of the initial security policy after a preset number of consecutive optimization updates or adjustments to decision parameters.

[0119] The preset number of consecutive monitoring cycles refers to the number of times optimizations need to be monitored continuously, set in advance. For example, setting the preset number of consecutive monitoring cycles to five means that the system needs to monitor the performance data after five consecutive optimization updates. This number is preset by the operations and maintenance personnel during system initialization and can be adjusted according to actual needs.

[0120] Performance evaluation data refers to various quantitative metrics used to evaluate the performance of security policies. Performance evaluation data includes the following three items:

[0121] The first item is the detection rate. The detection rate refers to the proportion of attacks correctly identified by the policy instance out of the total number of actual attacks. The detection rate is obtained by processing a batch of test tasks known to contain attack events using the optimized security policy, counting the number of events correctly identified as attacks, and dividing that number by the total number of attack events actually contained in the test tasks.

[0122] The second item is the false positive rate. The false positive rate refers to the proportion of normal events that are incorrectly identified as attacks by the policy instance to the total number of normal events. The false positive rate is obtained by processing a batch of test tasks known as normal events using the optimized security policy, counting the number of events incorrectly identified as attacks, and dividing that number by the total number of normal events in the test tasks.

[0123] The third item is accuracy. Accuracy refers to the proportion of events correctly identified by the policy instance out of the total number of events. Accuracy is obtained by processing a batch of mixed test tasks containing both attack and normal events using the optimized security policy, counting the number of correct identifications, and dividing by the total number of test tasks.

[0124] When the performance evaluation data meets the preset steady-state conditions, the verification frequency of policy instances is reduced to the preset low frequency.

[0125] Preset steady-state conditions refer to a set of judgment rules for determining whether a security strategy has reached a stable level and whether there is limited room for further optimization. Specifically, steady-state conditions require that, after multiple consecutive optimization updates, such as five consecutive updates, the changes in all performance indicators of the security strategy remain below a preset threshold.

[0126] The change in performance metrics is calculated as follows: the difference between the optimized performance metric value and the previously optimized performance metric value. For example, if the detection rate after optimization is 97% and the previous optimization detection rate was 96.5%, then the change in detection rate is 0.5%.

[0127] A preset threshold is a pre-defined upper limit for the amount of change in a performance indicator used to determine whether it has stabilized. The preset threshold is set by operations personnel during system initialization based on the required accuracy of the strategy. For example, the threshold for the change in detection rate can be set to 1%, and the threshold for the change in false alarm rate can be set to 1%. When, after multiple consecutive optimizations, the changes in each indicator are all below the corresponding threshold, the strategy is considered to have stabilized.

[0128] When the steady-state condition is met, reduce the frequency of checking policy instances.

[0129] Verification frequency refers to the frequency at which a policy instance verifies virtual security alert tasks. In full verification mode, every virtual security alert task processed by the policy instance is verified. When the verification frequency is reduced, it switches from full verification to sampling verification.

[0130] The specific method for sampling verification is as follows: From the virtual security alarm tasks processed by the policy instance, a portion of the tasks are selected for verification according to a preset sampling ratio. Tasks not selected are not verified again. For example, the preset sampling ratio is: for every ten tasks processed, one task is selected for verification.

[0131] The default low frequency setting method is: it is set by the operation and maintenance personnel during system initialization, and can be adjusted according to actual needs. For example, the default low frequency can be set to: one check every ten tasks processed.

[0132] Through the above steady-state judgment and verification frequency adjustment, this embodiment effectively reduces the computing resource consumption of the digital twin environment while ensuring the quality of the security strategy.

[0133] Example 3: Based on Example 1 above, this example further illustrates the method for presetting the initial security policy.

[0134] In this embodiment, multiple security policies are stored in the digital twin environment. These security policies originate from: initial policies entered by operations and maintenance personnel during system initial configuration, policies historically deployed to IT devices and executed, and new policies generated after each optimization update. All policies are stored in a unified format in the policy storage area of ​​the digital twin environment, and each policy is accompanied by identification information, including the policy's creation time, applicable scenarios, and historical performance records.

[0135] The default method for initial security policy includes the following steps:

[0136] Step S301: Randomly select a preset first number of security policies from all security policies stored in the digital twin environment.

[0137] The random selection method is as follows: a random number generation algorithm is used to randomly select a specified number of policies from all policies in the policy storage area. The preset first quantity refers to the number of policies to be selected during the random selection phase. The preset first quantity is set by the operations and maintenance personnel during system initialization. For example, setting the preset first quantity to five means randomly selecting five policies from all stored policies.

[0138] Step S302: Perform cross-learning on the selected security policies.

[0139] Cross-learning means enabling different security strategies to learn from each other's decision-making logic, especially their successful experiences in handling specific types of alarm tasks.

[0140] The specific steps of cross-learning are as follows: Pair the selected strategies together; for example, if five strategies are selected, divide them into several pairs. For each pair of strategies, analyze the task types in which they perform well in historical processing records. For example, strategy A performs well in handling distributed denial-of-service attack alerts (i.e., high detection rate and low false alarm rate), while strategy B performs well in handling malware propagation alerts. Share the decision rules that each strategy performs well with the other. Specifically, extract the rules used by strategy A in handling distributed denial-of-service attack alerts, including triggering conditions, judgment criteria, and handling actions, and provide these rules to strategy B. Similarly, extract the rules used by strategy B in handling malware propagation alerts and provide them to strategy A.

[0141] Step S303: The security policies learned through cross-learning are fused to generate a preset second number of candidate security policies.

[0142] The specific steps of the fusion are as follows: the decision rules of multiple strategies after cross-learning are merged. For rules that handle the same type of alarm task, the rule that performs best in this type of task among multiple strategies is retained. For example, if strategy A and strategy B both contain rules for handling port scan alarms, but strategy A has a higher accuracy in this type of task, then the rule of strategy A is retained. For rules that handle different types of alarm tasks, the best rules of each strategy are combined together.

[0143] Through the above merging and combination, a new policy containing all optimal rules is generated as a candidate security policy. Multiple candidate security policies can be generated in the same way. The preset second quantity refers to the number of candidate security policies to be generated. The preset second quantity is set by the operations and maintenance personnel during system initialization. For example, setting the preset second quantity to three means generating three candidate security policies.

[0144] Step S304: Use the decision filter in the digital twin environment to select a candidate security policy from the candidate security policies as the preset initial security policy.

[0145] The decision filter is a functional module in a digital twin environment responsible for selecting the optimal strategy from multiple candidate strategies. Its function is to acquire evaluation data for each candidate strategy under multiple evaluation criteria, compare the overall performance of each candidate strategy, and output the strategy with the best performance.

[0146] Example 4: Based on Example 3 above, this example further illustrates the specific method by which the decision filter selects the initial security policy from candidate security policies based on the pecking order graph method.

[0147] In this embodiment, after generating multiple candidate security policies, the decision filter obtains the evaluation data of each candidate security policy under preset evaluation criteria.

[0148] Preset evaluation criteria refer to multiple dimensions used to evaluate the quality of security policies. These criteria are set by operations and maintenance personnel during system initialization based on actual security management needs.

[0149] Let's take four evaluation criteria as an example. The four evaluation criteria are:

[0150] First, the accuracy of identifying various security alerts. This criterion measures whether policy instances can correctly identify whether various security alerts are genuinely malicious or legitimate.

[0151] Second, resource consumption during policy execution. This criterion measures the computing and storage resources used by a policy instance when processing alarm tasks. Computing resources include processor time and memory usage.

[0152] Third, the range of attack types covered by the strategy. This criterion measures the number of attack types that a strategy instance can identify and handle. The wider the coverage, the more applicable the strategy.

[0153] Fourth, the policy's response speed. This criterion measures the time required for a policy instance to go from receiving an alarm task to issuing a processing conclusion. The faster the response speed, the better the policy's real-time performance.

[0154] Evaluation data refers to the specific performance values ​​of each candidate security policy under the aforementioned evaluation criteria. The evaluation data is obtained by using each candidate security policy to process the same set of test tasks in a digital twin environment, and recording the performance of each policy under each evaluation criterion.

[0155] For example, candidate strategy A performed as follows in the test: 96% accuracy, moderate resource consumption, coverage of 20 attack types, and an average response time of 0.5 seconds. Candidate strategy B performed as follows: 94% accuracy, low resource consumption, coverage of 25 attack types, and an average response time of 0.3 seconds. Candidate strategy C performed as follows: 97% accuracy, high resource consumption, coverage of 18 attack types, and an average response time of 0.8 seconds.

[0156] The decision filter ranks each candidate security policy based on the pecking order graph method.

[0157] In this embodiment, the pecking order graph method refers to a multi-criteria decision-making method that determines the relative merits of each strategy by comparing each candidate strategy pairwise.

[0158] Taking three candidate strategies A, B, and C, and four evaluation criteria as an example, the specific steps of the pecking order graph method are as follows:

[0159] Step S401: Determine the number of candidate strategies to be compared and the number of evaluation criteria. In this example, there are three candidate strategies and four evaluation criteria.

[0160] Step S402: For each pair of candidate strategies, perform pairwise comparisons under each evaluation criterion to determine which strategy performs better under that criterion. For example, under the accuracy criterion, compare strategy A and strategy B: strategy A has an accuracy of 96%, and strategy B has an accuracy of 94%, therefore strategy A is better than strategy B under the accuracy criterion. Compare all strategy pairs in the same way under each of the four criteria.

[0161] Step S403: Count the number of times each candidate strategy wins in all pairwise comparisons. In each pairwise comparison, the strategy that performs better under a certain criterion receives a winning record. The winning counts under all criteria are summed to obtain the total number of wins for each strategy.

[0162] Step S404: Rank the candidate strategies according to the total number of wins. The strategy with the most total wins is the strategy with the best overall performance.

[0163] For example, after the above comparison and statistics, Strategy A has a total of five wins, Strategy B has a total of seven wins, and Strategy C has a total of three wins. Therefore, the ranking is: Strategy B is the best, followed by Strategy A, and then Strategy C.

[0164] The decision filter selects the candidate security strategy with the highest ranking based on the ranking results, that is, the strategy with the most total wins, which is strategy B in this example, as the preset initial security strategy.

[0165] By using the pecking order graph method described above, the decision filter can objectively compare the overall performance of each candidate strategy under multiple evaluation criteria, avoiding bias caused by relying on a single criterion or subjective judgment.

[0166] Example 5: Based on Example 1 above, this example further illustrates the iterative closed-loop process after the optimized and updated security policy is issued.

[0167] In this embodiment, after the first security policy is sent to the IT device for execution, the operating status of the IT device is continuously monitored.

[0168] Operational status refers to the various observable parameters and events of IT equipment during operation. Operational status includes: equipment performance indicators, such as CPU utilization and memory usage, security alarms generated by the equipment, equipment log records, and network connectivity status of the equipment.

[0169] The monitoring method for operational status is as follows: continuously obtain various operating parameters and event records of IT equipment through performance monitoring interfaces, log collection tools, and alarm information interfaces.

[0170] When a new security alert is detected by an IT device, the currently issued first security policy is used as the new initial security policy, and the optimization and update are performed in the digital twin environment.

[0171] A new security alert refers to an alert event generated by an IT device that is not effectively handled by the currently running security policy. Specifically, a new security alert is considered triggered when the following conditions are detected: the IT device generates a new alert record that does not match the alert type covered by existing rules in the current security policy, or the current security policy's handling of the alert is subsequently verified as incorrect.

[0172] When a new security alert is triggered, the first security policy is recalled to the digital twin environment. The recall method is as follows: the first security policy is uninstalled from the IT equipment or marked as pending update, and the complete set of decision rules of the policy is transferred back to the digital twin environment as the initial security policy for the new round of optimization.

[0173] During the policy recall and optimization period, newly generated security alerts on IT devices will continue to be processed by the previous version of the currently running security policy. Specifically, when the first security policy is recalled, the digital twin environment will automatically switch the policy currently being executed on the IT devices back to the previous version of the first security policy, i.e., the version before optimization, and this version will continue to process newly generated alerts until the first security policy completes a new round of optimization and is reissued.

[0174] After returning to the digital twin environment, the optimization and update steps are the same as those described in Example 1: generate a policy instance based on the newly triggered security alarm, perform verification, identify decision logic defects, retrieve optimization methods from an external knowledge base or adjust decision parameters, and generate the updated policy.

[0175] After optimization, the updated policy will be redeployed to the IT equipment for execution.

[0176] Through a continuous cycle of monitoring, recalling, optimizing, issuing, and re-monitoring, this embodiment achieves adaptive iterative evolution of security policies. Each new alarm trigger becomes an opportunity for policy optimization, enabling security policies to continuously accumulate experience and improve in actual operation.

[0177] Example 6, please refer to Figure 6 This embodiment provides an intelligent security management system for IT equipment, including:

[0178] The twin environment building module is used to acquire real-time operating data of IT equipment and build a digital twin environment to simulate the operating status of IT equipment.

[0179] The policy simulation module is used to generate policy instances in the digital twin environment according to the preset initial security policy, and to independently process virtual security alarm tasks in the digital twin environment using the policy instances.

[0180] The policy verification module is used to verify the policy instance based on the processing result after receiving a signal that the policy instance has finished processing the virtual security alarm task, and to optimize and update the initial security policy based on the verification result.

[0181] The policy distribution module is used to distribute the optimized and updated security policies to the IT devices for execution.

[0182] In summary, this application has at least the following effects:

[0183] By generating policy instances and processing virtual security alerts in a digital twin environment, security policies can be verified without affecting the operation of real IT equipment, avoiding the risks associated with direct policy deployment. Verifying the processing results of policy instances and optimizing the initial security policy based on these results enables policy improvement based on actual processing feedback, providing a solid basis for optimization. Logical isolation between policy instances and the initial security policy ensures that any errors in the policy instance verification process do not affect the stability of the initial security policy. The introduction of an external optimization knowledge base enables rapid repair of known decision-making logic flaws. Autonomous optimization through decision parameter adjustments when no matching solution is available ensures policy improvement under various conditions. Steady-state judgment and verification frequency adjustment automatically reduce verification intensity after the policy stabilizes, saving system resources. Multi-policy cross-learning, fusion, and optima graph selection enable an automated process for generating the optimal initial policy from multiple historical policies. An iterative closed loop of monitoring, recall, optimization, deployment, and re-monitoring allows security policies to continuously evolve in actual operation, adapting to a rapidly changing threat environment.

[0184] Those skilled in the art will understand that embodiments of the present invention can be provided as methods, systems, or computer program products. Therefore, the present invention can take the form of a completely hardware embodiment, a completely software embodiment, or an embodiment combining software and hardware aspects. Furthermore, the present invention can take the form of a computer program product embodied on one or more computer-usable storage media (including, but not limited to, disk storage, CD-ROM, optical storage, etc.) containing computer-usable program code.

[0185] This invention is described with reference to flowchart illustrations and / or block diagrams of systems, apparatus (systems), and computer program products according to embodiments of the invention. It will be understood that each block of the flowchart illustrations and / or block diagrams, and combinations of blocks in the flowchart illustrations and / or block diagrams, can be implemented by computer program instructions. These computer program instructions can be provided to a processor of a general-purpose computer, special-purpose computer, embedded processor, or other programmable data processing apparatus to produce a machine, such that the instructions, which execute via the processor of the computer or other programmable data processing apparatus, generate instructions for implementing the flowchart illustrations and / or block diagrams. Figure 1 One or more processes and / or boxes Figure 1 A device that provides the functions specified in one or more boxes.

[0186] These computer program instructions may also be stored in a computer-readable storage medium that can direct a computer or other programmable data processing device to function in a particular manner, such that the instructions stored in the computer-readable storage medium produce an article of manufacture including instruction means, which are implemented in a process Figure 1One or more processes and / or boxes Figure 1 The function specified in one or more boxes.

[0187] These computer program instructions may also be loaded onto a computer or other programmable data processing equipment to cause a series of operational steps to be performed on the computer or other programmable equipment to produce a computer-implemented process, thereby providing instructions that execute on the computer or other programmable equipment for implementing the process. Figure 1 One or more processes and / or boxes Figure 1 The steps of the function specified in one or more boxes.

[0188] Although preferred embodiments of the invention have been described, those skilled in the art, upon learning the basic inventive concept, can make other changes and modifications to these embodiments. Therefore, the appended claims are intended to be interpreted as including both the preferred embodiments and all changes and modifications falling within the scope of the invention.

[0189] Obviously, those skilled in the art can make various modifications and variations to this invention without departing from its spirit and scope. Therefore, if these modifications and variations fall within the scope of the claims of this invention and their equivalents, this invention also intends to include these modifications and variations.

Claims

1. A method for intelligent security management of IT equipment, characterized in that, Includes the following steps: Acquire real-time operational data of IT equipment and build a digital twin environment to simulate the operating status of IT equipment; Based on the preset initial security policy, a policy instance is generated in the digital twin environment, and the policy instance is used to independently process virtual security alarm tasks in the digital twin environment. After receiving a signal that the policy instance has finished processing the virtual security alarm task, the policy instance is verified based on the processing result, and the initial security policy is optimized and updated based on the verification result. The optimized and updated initial security policy will be distributed to the IT equipment for execution.

2. The intelligent security management method for IT equipment according to claim 1, characterized in that, The process of generating policy instances in the digital twin environment according to a preset initial security policy includes: The initial security policy is cloned in a lightweight manner to generate a policy instance with the same decision-making function as the initial security policy. The policy instance is logically isolated from the initial security policy while running independently in the digital twin environment, and is destroyed after completing the virtual security alert task. The running state of the policy instance does not directly affect the initial security policy.

3. The intelligent security management method for IT equipment according to claim 1, characterized in that, The method of independently processing virtual security alert tasks in a digital twin environment using policy instances includes: The policy instance receives virtual security alarm tasks generated in the digital twin environment, processes the virtual security alarm tasks using the decision logic of the initial security policy when receiving security alarms, and obtains the processing results.

4. The intelligent security management method for IT equipment according to claim 1, characterized in that, The validation of the policy instance based on the processing result includes: When the processing result is received, a signal carrying the processing result is sent to the central control port of the digital twin environment. When the central control port receives the signal, the verification mechanism in the digital twin environment is activated. The verification mechanism includes: comparing the processing result carried in the signal with a preset processing result benchmark, and judging whether there is an error in the task processing status of the strategy instance based on the comparison result; When the error exceeds the preset error baseline value, the corresponding policy instance and the virtual security alarm task processed by that policy instance are marked.

5. The intelligent security management method for IT equipment according to claim 4, characterized in that, The optimization and update of the initial security policy based on the verification results includes: Based on the errors present in the task processing status of the policy instance, determine the decision logic defects in the initial security policy that cause the errors; The external interface of the digital twin environment is used to connect to an external optimization method knowledge base. A query signal carrying the decision logic defect is sent to the external optimization method knowledge base. When the external optimization method knowledge base returns an optimization method that matches the decision logic defect, the optimization method is applied to the initial security policy for optimization and update. When the external optimization method knowledge base sends back the blind zone signal, the decision parameters corresponding to the decision logic defect in the initial security policy are adjusted in the digital twin environment until the error generated by the policy instance regenerated based on the adjusted initial security policy in processing the marked virtual security alarm task is lower than the preset error benchmark value. The blind zone signal indicates that there is no optimization method matching the decision logic defect in the external optimization method knowledge base. The optimized, updated, or decision-parameter-adjusted initial security policy is issued as the primary security policy and executed on the IT equipment.

6. The intelligent security management method for IT equipment according to claim 4, characterized in that, The verification mechanism also includes: Obtain performance evaluation data of the initial security policy after a preset number of consecutive optimization updates or adjustments to decision parameters; When the performance evaluation data meets the preset steady-state conditions, the verification frequency of the strategy instance is reduced to a preset low frequency. The steady-state conditions include: the change in the performance index of the performance evaluation data is lower than a preset threshold.

7. The intelligent security management method for IT equipment according to claim 1, characterized in that, The preset method for the initial security policy includes: A preset number of security policies are randomly selected from all security policies stored in the digital twin environment, and cross-learning is performed on the selected security policies so that each security policy learns each other's decision logic. The security policies learned through cross-learning are fused to generate a second set of candidate security policies. The decision filter in the digital twin environment is used to select a candidate security policy from the candidate security policies as the preset initial security policy.

8. The intelligent security management method for IT equipment according to claim 7, characterized in that, The step of selecting a candidate security policy from the candidate security policies as the preset initial security policy includes: The evaluation data of each candidate security policy under the preset evaluation criteria is obtained by the decision filter. Then, the candidate security policies are ranked according to the priority graph method. Based on the ranking results, the candidate security policy with the highest ranking is selected as the preset initial security policy.

9. The intelligent security management method for IT equipment according to claim 5, characterized in that, Also includes: After the first security policy is issued to the IT equipment for execution, the operating status of the IT equipment is monitored. When a new security alarm is detected on the IT device, the first security policy is used as the new initial security policy, and the optimization and update are performed in the digital twin environment.

10. An intelligent security management system for IT equipment, employing the intelligent security management method for IT equipment as described in any one of claims 1-9, characterized in that, include: The twin environment construction module is used to acquire real-time operating data of IT equipment and build a digital twin environment to simulate the operating status of IT equipment. The policy simulation module is used to generate policy instances in the digital twin environment according to the preset initial security policy, and to independently process virtual security alarm tasks in the digital twin environment using the policy instances. The policy verification module is used to verify the policy instance based on the processing result after receiving the signal that the policy instance has finished processing the virtual security alarm task, and to optimize and update the initial security policy based on the verification result. The policy distribution module is used to distribute the optimized and updated security policies to the IT devices for execution.

Images