A computer network environment isolation system implemented with software

Abstract

This invention relates to the field of computer network security technology and discloses a software-implemented computer network environment isolation system for isolating workloads in a network. The system includes: an intent and baseline management module for parsing business intents and establishing a normal behavior baseline model; a real-time state awareness module for collecting real-time operational data of the workload and generating a multi-dimensional state vector; a trust assessment and prediction module for comparing the multi-dimensional state vector with the baseline model to calculate an instantaneous trust score and a predicted trust score; and an adaptive isolation execution module for deciding and placing the workload at the appropriate isolation level based on the instantaneous and predicted trust scores. This invention, through multi-dimensional state awareness and trust prediction, combined with adaptive isolation and policy self-evolution technology, achieves accurate and forward-looking closed-loop automated defense against unknown threats in dynamic environments.

Description

Technical Field

[0001] This invention relates to the field of computer network security technology, specifically to a software-implemented computer network environment isolation system. Background Technology

[0002] In modern information technology infrastructure, cloud computing environments characterized by containerization and microservices are becoming increasingly prevalent. These environments are characterized by high dynamism, distribution, and ephemeral nature; workloads may have extremely short lifecycles, and their network communication patterns change frequently. While these characteristics improve deployment efficiency and system resilience, they also pose significant challenges to traditional network security isolation technologies. In particular, effectively defending against unknown, lateral movement attacks launched through legitimate channels has become a pressing technical problem in the current cybersecurity field.

[0003] To achieve workload isolation and protection in the aforementioned environments, existing technologies typically employ a combination of methods. A common approach is network boundary-based access control, such as using network firewalls or access control lists (ACLs), which allow or block communication based on network layer attributes like IP address, port number, and protocol type using pre-configured static rules. Another approach is to use intrusion detection and prevention systems (IDS / IPS), which identify threats by comparing real-time network traffic with a signature database of known attack characteristics. Furthermore, for finer-grained control, micro-segmentation techniques are widely used in microservice architectures, aiming to create independent network security zones for individual or small groups of workloads. Simultaneously, deception-based defense techniques, such as honeypot systems, are deployed to lure attackers and study their attack methods in order to capture and analyze new types of attacks.

[0004] While existing technologies have improved network security to some extent, several shortcomings remain. First, existing defense mechanisms exhibit inherent lag and passivity when dealing with unknown threats and dynamic environments. This is fundamentally because both static rule-based access control and signature-based intrusion detection rely on the definition of "known" threats. In cloud-native environments where workloads and service dependencies frequently change, manually maintaining these rules becomes impractical and error-prone. Furthermore, such systems cannot effectively identify and protect against zero-day attacks without known signatures. Second, existing technologies lack in-depth correlation analysis of the internal operational state of workloads when making security decisions. This is because most isolation technologies focus primarily on observable data at the network layer, lacking effective perception of key behavioral indicators such as process activity, system call sequences, or resource consumption patterns within the workload. Therefore, when an attacker uses an authorized network channel to perform malicious operations within the workload, systems relying solely on network telemetry data cannot detect the anomaly, creating a critical monitoring blind spot and resulting in an incomplete assessment of the workload's true credibility. Furthermore, existing technologies struggle to effectively distinguish between legitimate business evolution and malicious behavioral deviations, leading to a high operational burden. This is because normal application updates, feature iterations, or configuration changes can all alter their behavioral patterns. For systems employing fixed baselines for anomaly detection, such legitimate "behavioral drift" can be incorrectly identified as anomalies, generating numerous false alarms and forcing operations personnel to invest significant effort in identification and policy adjustments. Finally, the application of security intelligence obtained through attack analysis in existing technologies suffers from significant delays. This is because deceptive defense systems such as honeypots are typically deployed separately from the actual policy enforcement system. From capturing and analyzing a new attack method from a honeypot to transforming its characteristics into a network-wide executable defense strategy, this process often requires manual intervention and involves a lengthy time window. During this period, other workloads within the system remain exposed to similar threats, hindering rapid and coordinated global defense. Summary of the Invention

[0005] To address the shortcomings of existing technologies, this invention provides a software-implemented computer network environment isolation system, which solves the problem that existing technologies rely on static rules and known signatures, making it difficult to effectively identify and defend against unknown threats and the evolution of legitimate behaviors in dynamically changing environments.

[0006] To achieve the above objectives, the present invention provides the following technical solution: a computer network environment isolation system implemented in software, which establishes a dynamic closed-loop control process with trust assessment as its core, and can adaptively adjust the isolation strategy according to the real-time behavior of the workload and business intent.

[0007] The system provided by this invention includes: an intent and baseline management module; a real-time state awareness module; a trust assessment and prediction module; an adaptive isolation execution module; a policy introspection and evolution module; and a threat intelligence feedback module.

[0008] The intent and baseline management module is used to formalize preset business intents describing the legitimate behavior of a workload into machine-parseable structured data, and based on these business intents, to establish a multi-dimensional normal behavior baseline model for the workload using unsupervised learning methods. The business intents... It can be formalized as a set of tuples:

[0009] ;

[0010] In the formula, For a specified workload A set of business intentions; The source workload for communication; Workload for communication purposes; For the set of allowed communication protocols and ports; This is a set of performance-related constraints.

[0011] The normal behavior baseline model is specifically a deep autoencoder, which calculates the reconstruction error between the input state vector and the reconstructed state vector. This is used to quantify the degree of deviation from the expected behavior. This reconstruction error... Calculated using the following formula:

[0012] ;

[0013] In the formula, The reconstruction error is referred to as "the reconstruction error". For the workload at time point The state vector; This refers to the encoder portion of the self-encoder; This refers to the decoder portion of the autoencoder; This represents calculating the square of the Euclidean distance between two vectors.

[0014] The real-time state awareness module collects operational data of the workload in four dimensions—network, process, system call, and resource consumption—in real time through probes deployed at the operating system kernel level, and integrates them into the multi-dimensional state vector. .

[0015] ;

[0016] In the formula, This refers to the multidimensional state vector; This represents the network behavior vector; For process activity vectors; For system call vectors; This is the resource consumption vector.

[0017] The trust assessment and prediction module receives a normal behavior baseline model established by the intent and baseline management module and a multi-dimensional state vector generated by the real-time state awareness module. This module first bases its assessment on the reconstruction error. Calculate the instantaneous trust score that characterizes the current trust level of the workload. :

[0018] ;

[0019] In the formula, This represents the reconstruction error; This is a preset scaling factor used to adjust the sensitivity of the instantaneous trust score to the reconstruction error; The instantaneous trust score; It is an exponential function.

[0020] Subsequently, the module employs a time-series prediction model, receiving time-series data consisting of multiple historical multidimensional state vectors and instantaneous trust scores as input, and outputting a predicted trust score that predicts its future risk trend. .

[0021] The adaptive isolation execution module receives the instantaneous trust score. and the predicted trust score This module first calculates an effective trust metric using a weighted minimization function. :

[0022] ;

[0023] In the formula, For the aforementioned effective trust metric; A preset weight, between 0 and 1, is used to adjust the influence of the predicted trust score; The function is for finding the minimum value; The instantaneous trust score is calculated by the trust assessment and prediction module. The predicted trust score is output by the trust assessment and prediction module. A preset weight, between 0 and 1, is used to adjust the influence of the predicted trust score.

[0024] Then, the module uses the effective trust metric. The value is mapped to a preset isolation level using a piecewise function. The system will then perform the isolation operations corresponding to that level. The isolation levels include: observation level, functional degradation level, deceptive isolation level, and complete isolation level.

[0025] The strategy introspection and evolution module is used to perform long-term trend analysis on the instantaneous trust score output by the trust assessment and prediction module. This module calculates the long-term moving average of the instantaneous trust score. and standard deviation And determine whether it meets the preset conditions. To identify intent drift caused by legitimate business evolution, where μT is the long-term moving average of the instantaneous trust score; The long-term moving standard deviation of the instantaneous trust score; and A preset trust score threshold used to define a slightly off-range interval; This is a preset standard deviation threshold used to determine whether a behavioral pattern is stable.

[0026] When intent drift is detected, the module suggests updating the normal behavior baseline model to the intent and baseline management module.

[0027] The threat intelligence feedback module is activated when the adaptive isolation execution module performs a deceptive isolation level operation. This module first bases its actions on the original business intent of the workload. The module generates a high-fidelity, dynamic, simulated environment and redirects suspicious network communications to it. Subsequently, it extracts attack signatures from attack behaviors captured within this simulated environment. And add it to a global attack signature set. Finally, this module strengthens global defense capabilities by modifying the trust assessment calculation method, resulting in a revised trust score. Given by the following formula:

[0028] ;

[0029] In the formula, The corrected trust score; As a penalty function, when the multidimensional state vector Matched to the global attack signature set When any of the attack signatures in the code is encountered, the function outputs a preset penalty value. Otherwise, output 0; This item is the original instantaneous trust score; Let it be a penalty function; This is a preset positive scaling factor used to adjust the sensitivity of the instantaneous trust score to the reconstruction error; The reconstruction error is calculated by the intent and baseline management module.

[0030] This invention provides a software-implemented computer network environment isolation system. It has the following advantages:

[0031] 1. This invention introduces the prediction of future risk trends into the trust assessment and prediction module. This module not only calculates the instantaneous trust score representing the current state but also outputs a predicted trust score using a time-series prediction model. The adaptive isolation execution module incorporates this predicted value into the decision-making process, enabling the system to take intervention measures in advance before the workload's trust score drops to a dangerous threshold. This changes the traditional passive response mode that relies on ex-post alerts, thereby shortening the delay from risk identification to policy execution.

[0032] 2. This invention sets multiple isolation levels, from observation and functional degradation to complete isolation, through the adaptive isolation execution module, and maps continuous trust scores to these specific, tiered isolation operations. This design can apply appropriate control based on the actual severity of the risk, avoiding the problem of complete business interruption due to minor anomalies or false alarms, thereby improving the overall availability and business continuity of the system while ensuring security.

[0033] 3. This invention endows the system with adaptive optimization capabilities by setting up a strategy introspection and evolution module and a threat intelligence feedback module. The former can identify and adapt to legitimate business evolution, automatically suggesting updates to the behavioral baseline, reducing the strategy maintenance costs caused by business changes; the latter extracts threat intelligence from actual attacks and applies it to global defense in real time, achieving rapid immunity to new types of attacks. The collaborative work of these two modules enables the system's isolation strategy to be continuously and automatically adjusted and strengthened, reducing reliance on manual intervention. Attached Figure Description

[0034] Figure 1 This is a schematic diagram of the system structure of the present invention;

[0035] Figure 2 This is a schematic diagram of the method flow of the present invention;

[0036] Figure 3 This is a functional block diagram illustrating the intent of the invention and the baseline management module;

[0037] Figure 4 This is a functional block diagram of the real-time status sensing module of the present invention;

[0038] Figure 5 This is a functional block diagram of the trust assessment and prediction module of the present invention;

[0039] Figure 6 This is a functional block diagram of the adaptive isolation execution module of the present invention;

[0040] Figure 7 This is a functional block diagram of the strategy self-reflection and evolution module of the present invention;

[0041] Figure 8 This is a functional block diagram of the threat intelligence feedback module of the present invention. Detailed Implementation

[0042] The technical solutions in the embodiments of the present invention will be clearly and completely described below with reference to the accompanying drawings. Obviously, the described embodiments are only some embodiments of the present invention, and not all embodiments. Based on the embodiments of the present invention, all other embodiments obtained by those skilled in the art without creative effort are within the scope of protection of the present invention.

[0043] Please see the appendix Figure 1 , Figure 1 This is a schematic diagram of a system structure according to an embodiment of the present invention. The present invention provides a computer network environment isolation system implemented in software, which may include: an intent and baseline management module 100; a real-time state awareness module 200; a trust assessment and prediction module 300; an adaptive isolation execution module 400; a policy introspection and evolution module 500; and a threat intelligence feedback module 600;

[0044] The Intent and Baseline Management Module 100 is responsible for parsing the preset business intents used to describe the legitimate behavior of the workload, and based on these business intents, using an unsupervised learning method to establish a normal behavior baseline model that represents the normal operation mode of the workload.

[0045] The real-time state awareness module 200 is designed to continuously collect real-time operational data of the workload in terms of network, processes, system calls, and resource consumption through probes deployed at the operating system kernel level, and integrate this data into a structured multidimensional state vector.

[0046] The trust assessment and prediction module 300 receives the multi-dimensional state vector generated by the real-time state perception module 200, compares it with the normal behavior baseline model established by the intent and baseline management module 100, calculates the instantaneous trust score representing the current credibility of the workload based on the comparison result, and simultaneously outputs a predicted trust score based on historical data to predict future risk trends.

[0047] The adaptive isolation execution module 400 receives the instantaneous trust score and predicted trust score output by the trust assessment and prediction module 300, determines a specific, progressively stronger isolation level based on the values ​​of these two scores, and executes the corresponding isolation strategy for the workload.

[0048] The strategy self-reflection and evolution module 500 performs long-term trend analysis on the instantaneous trust score output by the trust assessment and prediction module 300 to identify stable behavioral pattern drifts caused by legitimate business evolution, and after identification, issues a suggestion to the intent and baseline management module 100 to update the normal behavior baseline model.

[0049] The threat intelligence feedback module 600 extracts attack signatures from isolated attack behaviors when the workload is placed at a specific deceptive isolation level, and uses these attack signatures to update the evaluation logic of the trust assessment and prediction module 300, so as to achieve a rapid response to similar attacks.

[0050] Please see the appendix Figure 2 , Figure 2 This is a schematic diagram of a method flow according to an embodiment of the present invention. The present invention provides a method for a computer network environment isolation system implemented in software, which may include the following steps: S101, establishing a normal behavior baseline model; S102, generating a multi-dimensional state vector; S103, calculating and predicting trust scores; S104, executing an adaptive isolation strategy.

[0051] The overall workflow of this invention embodiment is a dynamic closed-loop control process. During system initialization or workload deployment, the intent and baseline management module 100 executes step S101. This module is used to parse preset business intents that describe the legitimate communication and behavior of the workload, and based on these intents, uses an unsupervised learning method to establish a normal behavior baseline model representing the normal operation mode of the workload.

[0052] During system operation, the real-time state awareness module 200 executes step S102. This module continuously collects real-time operational data of the workload in dimensions such as network, processes, system calls, and resource consumption through probes deployed at the operating system kernel level, and integrates this data into a structured multi-dimensional state vector for subsequent modules to analyze.

[0053] Next, the trust assessment and prediction module 300 executes step S103. This module receives a multi-dimensional state vector generated by the real-time state awareness module 200 and compares it with a normal behavior baseline model established by the intent and baseline management module 100 to quantify the degree of deviation of the current behavior. Based on this degree of deviation, the module calculates an instantaneous trust score characterizing the current credibility of the workload. Simultaneously, the module also employs a time-series prediction model, based on historical state vectors and trust score sequences, to output a predicted trust score that predicts future risk trends.

[0054] Then, the adaptive isolation execution module 400 executes step S104. This module receives the instantaneous trust score and predicted trust score output by the trust assessment and prediction module 300. Based on the values ​​of these two scores, the module determines a specific isolation level and calls the underlying network control interface to execute the corresponding isolation policy for the workload. The strength of these policies is progressively distributed, ranging from enhanced logging to complete network disconnection.

[0055] Furthermore, the strategy introspection and evolution module 500 performs long-term analysis on the instantaneous trust score output by the trust assessment and prediction module 300. When a stable and slight deviation in the trust score is detected, the module identifies it as a legitimate evolution of the business, i.e., intent drift, and issues a suggestion to the intent and baseline management module 100 to update the normal behavior baseline model, thereby forming a long-term strategy optimization loop.

[0056] The threat intelligence feedback module 600 operates when the adaptive isolation execution module 400 places the workload at a specific deceptive isolation level. This module extracts attack signatures from isolated attack behaviors and provides these signatures to the trust assessment and prediction module 300. This allows the trust assessment and prediction module 300 to adjust its computational logic to penalize behaviors carrying the same attack signature, thus forming a fast-response security hardening loop.

[0057] Please see the appendix Figure 3 , Figure 3 This is a functional block diagram of an intent and baseline management module 100 according to an embodiment of the present invention. The specific function of the intent and baseline management module 100 is to receive business intents describing legitimate workload behaviors and convert them into a normal behavior baseline model that can be executed by a machine. This model is used to quantify the degree of deviation from subsequent real-time behaviors.

[0058] In one embodiment, the business intent is first formalized as a set of one or more tuples. Its structure is as follows:

[0059] ;

[0060] In the formula, For a specified workload A set of business intentions; The source workload for communication; Workload for communication purposes; For the set of allowed communication protocols and ports; This is a set of performance-related constraints.

[0061] After formalizing the business intent, the intent and baseline management module 100 employs a deep autoencoder to build a normal behavior baseline model. This process is completed in a training phase. During the training phase, the system collects and inputs a large amount of data related to the business intent into the autoencoder. The training process aims to enable the autoencoder to learn the intrinsic structure and data distribution of normal workload state vectors, thereby allowing for low-error reconstruction of normal input vectors. This is consistent with historical multidimensional state vectors generated by the real-time state awareness module 200.

[0062] During normal system operation, the intent and baseline management module 100 receives the current multidimensional state vector generated in real time by the real-time state awareness module 200. The input vector is then fed into a pre-trained deep autoencoder. This autoencoder encodes and decodes the input vector, outputting a reconstructed state vector. This module computes the current multidimensional state vector... The difference between the current behavior and the reconstructed state vector is used to quantify the degree of deviation of the current behavior from the baseline model of normal behavior.

[0063] The degree of deviation is specifically calculated by assessing the reconstruction error. To represent, its calculation formula is:

[0064] ;

[0065] In the formula, This represents the reconstruction error; For workload at point in time The state vector; This refers to the encoder portion of a self-encoder; This is the decoder part of the autoencoder; This represents calculating the square of the Euclidean distance between two vectors.

[0066] Calculated reconstruction error It is then transmitted to the trust assessment and prediction module 300 as the basic input for calculating the instantaneous trust score.

[0067] Please see the appendix Figure 4 , Figure 4This is a functional block diagram of a real-time state awareness module 200 according to an embodiment of the present invention. The specific function of the real-time state awareness module 200 is to collect low-level runtime data of the workload through probes at the operating system kernel level, and convert this heterogeneous data into a standardized multi-dimensional state vector for analysis by subsequent modules.

[0068] In one embodiment, this module utilizes probe technology provided by the operating system kernel, such as the Extended Berkeley Packet Filter (eBPF), to efficiently intercept and collect data at the kernel level without intruding on the workload's user space. The collected data covers multiple dimensions, specifically including: network behavior data, such as source and destination IP addresses, port numbers, protocol types, connection states, and packet sizes; process activity data, such as process ID, parent process ID, executed command-line arguments, and user ID; system call data, such as system call numbers, parameters, and return values; and resource consumption data, such as CPU utilization, memory usage, disk I / O, and network bandwidth usage.

[0069] The collected raw data comes in various formats, including both numerical and categorical data. To form a unified mathematical representation, the module processes and quantifies the data. For example, numerical data (such as CPU utilization and network traffic) is normalized and scaled to a preset numerical range (such as [0,1]). Categorical data (such as network protocol types) is processed using one-hot encoding or entity embedding to convert it into numerical vectors.

[0070] After the above processing, the quantized data from all dimensions are concatenated to form a multidimensional state vector. The structure of this vector can be represented as:

[0071] ;

[0072] In the formula, It is a multidimensional state vector; This represents the network behavior vector; For process activity vectors; For system call vectors; This is the resource consumption vector.

[0073] The final generated multidimensional state vector The data is transmitted to the intent and baseline management module 100 and the trust assessment and prediction module 300 as input data for their calculations and analyses.

[0074] Please see the appendix Figure 5 , Figure 5This is a functional block diagram of a trust assessment and prediction module 300 according to an embodiment of the present invention. The specific function of the trust assessment and prediction module 300 is to receive quantified behavioral deviation data and historical state data, calculate an instantaneous trust score characterizing the current trustworthiness of the workload, and predict its future risk trend.

[0075] In one embodiment, the module receives the reconstruction error calculated by the intent and baseline management module 100. This module uses a nonlinear function to convert the reconstruction error... Convert to a standardized instantaneous trust score The instantaneous trust score The calculation formula is:

[0076] ;

[0077] In the formula, Represents reconstruction error; This is a preset scaling factor used to adjust the sensitivity of the instantaneous trust score to reconstruction error; Instantaneous trust score; It is an exponential function.

[0078] In addition, the trust assessment and prediction module 300 also includes a time-series prediction model, such as a Long Short-Term Memory (LSTM) network model.

[0079] The model receives a multidimensional state vector from multiple past time points. and the corresponding instantaneous trust score The model takes time-series data as input and outputs a predicted confidence score. This score characterizes the system's response to workload at future points in time. Credibility prediction.

[0080] Calculated instantaneous trust score and predicted trust score All data are transmitted to the adaptive isolation execution module 400 as the basis for its decision on the isolation level.

[0081] Please see the appendix Figure 6 , Figure 6 This is a functional block diagram of an adaptive isolation execution module 400 according to an embodiment of the present invention. The specific function of the adaptive isolation execution module 400 is to receive a trust score characterizing the current and future trustworthiness of a workload, determine a precise isolation level based on the score, and execute the specific isolation operation corresponding to that level.

[0082] In one embodiment, the module receives an instantaneous trust score output by the trust assessment and prediction module 300. and predicted trust score To comprehensively consider both the current state and future trends, this module first calculates an effective trust metric using a weighted minimization function. This effective trust metric The calculation formula is:

[0083] ;

[0084] In the formula, For effective trust measurement; A preset weight between 0 and 1 is used to adjust the influence of the predicted trust score; The function is for finding the minimum value; The instantaneous trust score is calculated by the trust assessment and prediction module; The predicted trust score is output by the trust assessment and prediction module. A preset weight between 0 and 1 is used to adjust the influence of the predicted trust score.

[0085] Calculate an effective trust metric Then, the module maps it to a preset isolation level using a piecewise function. This mapping is defined by a set of preset trust thresholds. For example, this module will measure effective trust. It is compared with multiple thresholds to determine the interval to which it belongs, and each interval corresponds to an isolation level.

[0086] Isolation level The specific execution operations and their corresponding implementations include:

[0087] Observation level: When an effective trust metric is used When the workload is within a higher, pre-defined normal range, no restrictive operations are performed, but logging of the workload is enhanced, such as logging all network connections and system call details.

[0088] Functional degradation level: When an effective trust metric is available When the workload drops to a preset warning range, the module imposes partial restrictions on the workload by modifying network policies (such as flow tables in software-defined networking, SDN) or injecting kernel-level filtering rules (such as eBPF programs). For example, it may block network communication with non-essential services or restrict file write permissions, but retain the operation of its core functions.

[0089] Deceptive isolation level: When an effective trust metric is used When the traffic drops to a preset danger zone, the module redirects suspicious network traffic from the workload to a dynamically generated simulated environment. Simultaneously, the module sends a notification to the threat intelligence feedback module 600 to initiate the attack behavior capture process.

[0090] Complete isolation level: when an effective trust metric is used. When the load falls below a preset minimum threshold, the module performs the strictest isolation operation, completely blocking all inbound and outbound network connections for the workload by configuring network firewall rules.

[0091] Please see the appendix Figure 7 , Figure 7 This is a functional block diagram of a policy introspection and evolution module 500 according to an embodiment of the present invention. The specific function of the policy introspection and evolution module 500 is to perform long-term trend analysis on the trust score of the workload to identify behavioral pattern drift caused by legitimate business evolution, and accordingly issue recommendations to update the normal behavior baseline model.

[0092] In one embodiment, the module receives and stores the instantaneous trust score continuously output by the trust assessment and prediction module 300. This module performs statistical calculations on the time series of the instantaneous trust score within a preset, relatively long time window, specifically calculating its long-term moving average μT and long-term moving standard deviation. .

[0093] This module uses a conditional expression to determine the presence of intent drift. Intent drift is defined as a non-malicious, stable change in behavior that causes the workload's instantaneous trust score to stabilize at a level slightly below the initial baseline model, but with very low volatility. The conditional expression used to identify intent drift is: In the formula, μT is the long-term moving average of the instantaneous trust score; The long-term sliding standard deviation of the instantaneous confidence score; and A preset trust score threshold used to define a slightly off-range interval; A preset standard deviation threshold is used to determine whether the volatility of instantaneous trust scores is low enough to confirm that a new stable behavioral pattern has been formed.

[0094] When the result of the above conditional expression is true, the policy introspection and evolution module 500 issues a suggestion to the intent and baseline management module 100 to update the baseline model. This suggestion is used to initiate a retraining process for the normal behavior baseline model, thereby enabling the system to adapt to the evolution of legitimate behaviors under the workload and avoiding persistent false low trust assessments due to intent drift.

[0095] Please see the appendix Figure 8 , Figure 8 This is a functional block diagram of a threat intelligence feedback module 600 according to an embodiment of the present invention. The specific function of the threat intelligence feedback module 600 is to extract attack signatures from isolated attack behaviors when the workload is placed at a specific deceptive isolation level, and to use these signatures to update the global trust assessment logic.

[0096] In one embodiment, when the adaptive isolation execution module 400 places a workload at a deceptive isolation level, the threat intelligence feedback module 600 is invoked. This module first considers the original business intent of the workload. This generates a high-fidelity, dynamic, simulated environment. Subsequently, suspicious network communications identified by the adaptive isolation execution module 400 are redirected to this simulated environment. Within this environment, the module records and analyzes a series of behaviors triggered by the suspicious communications, such as network probing, exploit attempts, or malicious code execution.

[0097] The threat intelligence feedback module 600 extracts one or more attack signatures from recorded attack behaviors to characterize the attack pattern. The attack signature can be a specific network packet characteristic, a sequence of system calls, or a pattern of process activity. The extracted attack signature... It was then added to a global attack signature set. In this context, the collection is shared by all protected workloads within the system.

[0098] Most importantly, this module strengthens global defense capabilities by modifying the trust score calculation method of the trust assessment and prediction module 300. Upon receiving a new attack signature, the trust score calculation will use a revised formula. The revised trust score... Given by the following formula:

[0099] ;

[0100] In the formula, The corrected trust score; For a penalty function, when the multidimensional state vector Matched the global attack signature set When any of the attack signatures in the code is encountered, the function outputs a preset penalty value. Otherwise, output 0; This item is the original instantaneous trust score; Let it be a penalty function; This is a preset positive scaling factor used to adjust the sensitivity of the instantaneous trust score to reconstruction error; This is the reconstruction error calculated by the intent and baseline management module.

[0101] In this way, once a new attack signature is learned from an attack, any workload in the system that exhibits behavior matching that signature will have its trust score reduced immediately and significantly, thereby triggering a rapid isolation response.

[0102] Although embodiments of the invention have been shown and described, it will be understood by those skilled in the art that various changes, modifications, substitutions and alterations can be made to these embodiments without departing from the principles and spirit of the invention, the scope of which is defined by the appended claims and their equivalents.

Claims

1. A software-implemented computer network environment isolation system for isolating workloads in a network, characterized in that, The system includes: The intent and baseline management module is used to parse preset business intents that describe the legitimate behavior of the workload, and to establish a normal behavior baseline model for the workload based on the business intents. The real-time state awareness module is used to collect the operating data of the workload in real time to generate a multi-dimensional state vector representing its current operating state. The trust assessment and prediction module receives the normal behavior baseline model and the multidimensional state vector, and calculates the instantaneous trust score characterizing the current trustworthiness of the workload and the predicted trust score predicting its future risk trend based on the comparison results of the two. The adaptive isolation execution module receives the instantaneous trust score and the predicted trust score, and places the workload at a preset isolation level based on their values.

2. The computer network environment isolation system implemented in software according to claim 1, characterized in that, The intent and baseline management module is specifically used for: A pre-trained autoencoder is used as the baseline model for the normal behavior; The autoencoder receives the multidimensional state vector generated by the real-time state perception module as input and outputs a reconstructed state vector. The intent and baseline management module quantifies the degree of deviation between the workload behavior and the normal behavior baseline model by calculating the reconstruction error between the multidimensional state vector and the reconstructed state vector.

3. A computer network environment isolation system implemented in software according to claim 1, characterized in that, The multidimensional state vector generated by the real-time state awareness module includes at least two types of data: network behavior vector, process activity vector, system call vector, or resource consumption vector.

4. A computer network environment isolation system implemented in software according to claim 2, characterized in that, The trust assessment and prediction module specifically uses the following formula, based on the reconstruction error, to perform the following calculation: Calculate the instantaneous trust score : ； In the formula, This represents the reconstruction error; This is a preset scaling factor used to adjust the sensitivity of the instantaneous trust score to the reconstruction error; The instantaneous trust score; It is an exponential function.

5. A computer network environment isolation system implemented in software according to claim 1, characterized in that, The trust assessment and prediction module is further specifically used to: adopt a time series prediction model, receive time series data consisting of multiple historical multidimensional state vectors and instantaneous trust scores as input, and output the predicted trust score.

6. A computer network environment isolation system implemented in software according to claim 1, characterized in that, The isolation levels preset by the adaptive isolation execution module include: An observation level for enhanced logging of all network communications for the said workload; A functional degradation level is used to allow only the network communication necessary for the workload to perform its core business intent; A deceptive isolation level is used to redirect network communications of the workload that deviate from its business intent to a controlled, mimicry environment; A complete isolation level, used to disconnect all network connections for the said workload.

7. A computer network environment isolation system implemented in software according to claim 6, characterized in that, The system also includes a threat intelligence feedback module. When the workload is placed in the deceptive isolation level, the threat intelligence feedback module is used to extract attack signatures from the attack behaviors captured in the simulated environment and use the attack signatures to update the global trust assessment policy.

8. A computer network environment isolation system implemented in software according to claim 7, characterized in that, The threat intelligence feedback module introduces a penalty item determined by the attack signature. To update the trust assessment strategy to obtain the revised trust score. : ； In the formula, The original instantaneous trust score; This is a preset penalty value that takes effect when the multidimensional state vector matches the attack signature; The corrected trust score is denoted as .

9. A computer network environment isolation system implemented in software according to claim 1, characterized in that, The system also includes a strategy introspection and evolution module, which analyzes the long-term trend of the instantaneous trust score to identify stable behavioral pattern drift caused by the legitimate evolution of business, i.e., intent drift. Based on the results of identifying the intent drift, a suggestion to update the normal behavior baseline model is issued to the intent and baseline management module.

10. A computer network environment isolation system implemented in software according to claim 9, characterized in that, The strategy introspection and evolution module specifically identifies the intent drift in the following ways: Determine whether the long-term moving average of the instantaneous trust score falls within a preset deviation range, and whether its long-term moving standard deviation is less than a preset stability threshold.

Images