Network security detection method and network-side device

Abstract

The present application belongs to the field of communications. Disclosed are a network security detection method and a network-side device. The method is performed by a first network device, and comprises: on the basis of a received security request of a user, querying a first security configuration of a second network device and a first security policy, wherein the security request of the user comprises an information list of the second network device and a first reinforcement item, which is set by the user; and according to the queried first security policy and the queried first security configuration of the second network device, determining a network security detection result for the second network device, so as to enable a security configuration adjustment to be performed on the second network device on the basis of the network security detection result.

Description

Network security detection method and network side equipment

[0001] CROSS-REFERENCE TO RELATED APPLICATIONS

[0002] This application claims priority to a Chinese patent application filed with the Patent Office of China on September 13, 2023, with application number 202311178509.0 and invention name “Network Security Detection Method and Network Side Device”. The entire contents of the Chinese patent application are incorporated herein by reference. Technical Field

[0003] The present application belongs to the field of communication technology, and specifically relates to a network security detection method and network-side equipment. Background Art

[0004] With the development of communications technology, network security is receiving increasing attention. In related technologies, network management devices manage network security through fixed network security reinforcement items within network management applications (Applications, Apps). When security issues arise that these fixed network security reinforcement items cannot address, the network faces security risks and low network security.

[0005] Summary of the Invention

[0006] The embodiments of the present application provide a network security detection method and network-side equipment, which can solve the problem of network security risks and low network security when there are security issues that cannot be solved by fixed network security reinforcement items.

[0007] In a first aspect, a method for network security detection is provided, which is executed by a first network device, including: based on a received user security request, querying a first security configuration and a first security policy of a second network device, wherein the user security request includes an information list of the second network device and a first reinforcement item set by the user; based on the queried first security policy and the first security configuration of the second network device, determining a network security detection result of the second network device, so as to adjust the security configuration of the second network device based on the network security detection result.

[0008] In a second aspect, a network side device is provided, which includes a processor and a memory, wherein the memory stores programs or instructions that can be run on the processor, and when the program or instructions are executed by the processor, the steps of the method described in the first aspect are implemented.

[0009] In a third aspect, a readable storage medium is provided, on which a program or instruction is stored. When the program or instruction is executed by a processor, the steps of the method described in the first aspect are implemented.

[0010] In a fourth aspect, a chip is provided, comprising a processor and a communication interface, wherein the communication interface is coupled to the processor, and the processor is configured to run a program or instruction to implement the steps of the method described in the first aspect.

[0011] In a fifth aspect, a computer program / program product is provided, wherein the computer program / program product is stored in a storage medium and is executed by at least one processor to implement the steps of the method described in the first aspect. BRIEF DESCRIPTION OF THE DRAWINGS

[0012] FIG1 is a block diagram of a wireless communication system applicable to an embodiment of the present application.

[0013] FIG2 is a flow chart of a method for network security detection provided in an embodiment of the present application.

[0014] FIG3 is a flow chart of another network security detection method provided in an embodiment of the present application.

[0015] FIG4 is a schematic structural diagram of a network security detection device provided in an embodiment of the present application.

[0016] FIG5 is a schematic diagram of the structure of a network device provided in an embodiment of the present application. DETAILED DESCRIPTION

[0017] The following will be combined with the accompanying drawings in the embodiments of this application to clearly describe the technical solutions in the embodiments of this application. Obviously, the embodiments described are part of the embodiments of this application, not all of the embodiments. Based on the embodiments in this application, all other embodiments obtained by ordinary technicians in this field are within the scope of protection of this application.

[0018] The terms "first," "second," and the like in the specification and claims of this application are used to distinguish similar objects, and are not used to describe a specific order or precedence. It should be understood that the terms used in this manner are interchangeable where appropriate, so that the embodiments of this application can be implemented in an order other than that illustrated or described herein, and that the objects distinguished by "first" and "second" are generally of the same type, and do not limit the number of objects. For example, the first object can be one or more. In addition, the term "and / or" in the specification and claims refers to at least one of the connected objects, and the character " / " generally indicates that the objects connected are in an "or" relationship.

[0019] It is worth noting that the technology described in the embodiments of the present application is not limited to the Long Term Evolution (LTE) / LTE-Advanced (LTE-A) system, but can also be used in other wireless communication systems, such as Code Division Multiple Access (CDMA), Time Division Multiple Access (TDMA), Frequency Division Multiple Access (FDMA), Orthogonal Frequency Division Multiple Access (OFDMA), Single-carrier Frequency Division Multiple Access (SC-FDMA) and other systems. The terms "system" and "network" in the embodiments of the present application are often used interchangeably, and the technology described can be used for the systems and radio technologies mentioned above, as well as for other systems and radio technologies. The following description describes a New Radio (NR) system for illustrative purposes, and the NR terminology is used in most of the following description, but these technologies can also be applied to applications other than NR system applications, such as 6th generation (6G) systems. th Generation, 6G) communication system.

[0020] FIG1 shows a block diagram of a wireless communication system applicable to an embodiment of the present application. The wireless communication system includes a network management system and network-side equipment. Among them, the network management system of the base station is responsible for defining and issuing network element reinforcement strategies. The network management system of the base station can be a software system or a hardware system. When the network management system of the base station is a software system, the software management system can be installed or run on the terminal used by the operation and maintenance personnel or on the base station equipment. The terminal can be a mobile phone, a tablet computer (Tablet Personal Computer), a laptop computer (Laptop Computer) or a notebook computer, a personal digital assistant (PDA), a handheld computer, a netbook, an ultra-mobile personal computer (UMPC), a mobile Internet device (MID), an augmented reality (AR) / virtual reality (VR) device, a robot, a wearable device (Wearable Device), a vehicle-mounted device (VUE), a pedestrian terminal (PUE), a smart home (home appliance with wireless communication function, such as a refrigerator, a TV, a washing machine or furniture, etc.), a game console, a personal computer (personal Terminal side devices include: smart computers, personal computers, ATMs or self-service machines, and wearable devices include: smart watches, smart bracelets, smart headphones, smart glasses, smart jewelry (smart bracelets, smart bracelets, smart rings, smart necklaces, smart anklets, smart anklets, etc.), smart wristbands, smart clothing, etc. It should be noted that the type of terminal is not limited in the embodiments of the present application. Network side devices may include access network devices or core network devices, wherein the access network device may also be referred to as wireless access network equipment, wireless access network (RAN), wireless access network function or wireless access network unit.The access network equipment may include a base station, a WLAN access point or a WiFi node, etc. The base station may be referred to as a node B, an evolved node B (eNB), an access point, a base transceiver station (BTS), a radio base station, a radio transceiver, a basic service set (BSS), an extended service set (ESS), a home B node, a home evolved B node, a transmitting and receiving point (TRP) or other appropriate terms in the field. As long as the same technical effect is achieved, the base station is not limited to a specific technical vocabulary. It should be noted that in the embodiment of the present application, only the base station in the NR system is used as an example for introduction, and the type of base station is not limited. In a wireless network, a network management system of the base station may also be included, and the wireless base station provides a reinforced query and downlink interface.

[0021] Figure 2 is a network security detection method provided in an embodiment of the present application, which is executed by a first network device. The first network device can be a device or system that provides management functions for the second network device, which can be a software or hardware device. The second network device can be a base station. The method includes the following steps.

[0022] S202: Based on the received user security request, query the first security configuration and the first security policy of the second network device.

[0023] The user security request includes an information list of the second network device and the first reinforcement item set by the user.

[0024] S204: Determine a network security detection result of the second network device according to the queried first security policy and the first security configuration of the second network device.

[0025] This step enables the second network device to adjust its security configuration based on the network security detection result. In one example, a query command for the security reinforcement item can be sent to the second network device in the information list; and the first security configuration and the first security policy of the second network device can be received. The first reinforcement item and the first security policy of the second network device are compared to obtain a comparison result; and the difference value in the comparison result is determined as the network security detection result of the second network device. The comparison result includes whether the security configuration of the second network device is the same as the content of the reinforcement item, and the case where the security configuration of the second network device is different from the content of the reinforcement item, and can include the content where there is a difference, that is, when there is a difference between the policy value defined by the security configuration and the reinforcement item, the difference value is output, and the difference value is determined as the network security detection result of the second network device. In this way, the user can quickly view the comparison result between the security configuration of the second network device and the reinforcement item, and make security configuration adjustments.

[0026] In an embodiment of the present application, based on a received user security request, the first security configuration and the first security policy of the second network device are queried, wherein the user security request includes an information list of the second network device and the first reinforcement item set by the user; based on the queried first security policy and the first security configuration of the second network device, the network security detection result of the second network device is determined, so that the security configuration of the second network device is adjusted based on the network security detection result, and the security reinforcement settings made by the user for specific scenarios and needs can be received, and the security configuration of the second network device can be automatically checked and compared, so that the security configuration of the second network device is adjusted based on the network security detection result, thereby improving the overall security of the network.

[0027] In one implementation, security-related configurations of the base station may also be performed in this step, including opening or closing specific ports, setting firewall rules, managing user permissions, etc.

[0028] In one implementation, after this step, based on the received security policy delivery request, a second security policy may be sent to the second network device, the security policy delivery request including a list of information about the second network device and the second hardening item set by the user; and feedback from the second network device on the effectiveness of the second security policy may be received. This step may be implemented by the security policy delivery module shown in Figure 1 , the functionality of which may be implemented by hardware or software in the network management system.

[0029] In one implementation, when the reinforcement item includes a policy value for the reinforcement item, in this step, after receiving the reinforcement item set by the user, the policy value for the reinforcement item can be sent to the second network device. The policy value for the reinforcement item is used to enable the second network device to perform security configuration, and the second network device receives feedback on the effectiveness of the policy value for the reinforcement item. The user can specify the second network device, such as a list of base stations selected by the user. In this step, the policy value for the reinforcement item is sent to the base station specified by the user. Thus, some or all reinforcement items can be selectively sent to the base station and take effect, thereby improving network security.

[0030] In one implementation, after receiving the effectiveness result of the second security policy fed back by the second network device, the third security policy of the second network device can also be queried based on the received security policy check request, wherein the security policy effectiveness check request includes an information list of the second network device; and the security policy check result is received, and the security policy check result is a comparison result of the third security policy and the second security policy. The first network device receives the inspection result fed back by the second network device, and the inspection result is used to indicate whether the policy value of the second network device is consistent with that of the reinforcement item. Therefore, through this step, it is possible to effectively verify whether the reinforcement item is effective after being sent to the base station, further improving network security, reducing errors that may occur in manual operations, and greatly reducing the workload and complexity of security management.

[0031] Figure 3 is a flow chart of a network security detection method provided in an embodiment of the present application, which is executed by a first network device. The first network device can be a device or system that provides management functions for the second network device, that is, the network management system of the above-mentioned base station, which can be a software or hardware device. The second network device can be a base station. The method includes the following steps.

[0032] S302: Receive reinforcement items set by the user.

[0033] Users can customize security hardening items in the base station's network management system and define atomic items for base station security hardening. This step satisfies the user's customized security hardening requirements.

[0034] In one implementation, the reinforcement item set by the user includes at least one of the following: an identifier of the reinforcement item, a name of the reinforcement item, content of the reinforcement item, a description of the comparison result corresponding to the reinforcement item, a policy value of the reinforcement item, and a script of the reinforcement item.

[0035] Table 1 lists the security enhancement items.

[0036] Table 1

[0037] The content of the reinforcement item is used to describe the business meaning and application scenarios corresponding to the security reinforcement item. Different security policy configurations have different policy values ​​for the reinforcement item, such as a policy value of 0 (representing closed) for closing the debug port. The script of the reinforcement item is used to convert the reinforcement item into a command that can be recognized by the second network device.

[0038] In one implementation, this step may include: creating a reinforcement item template, and the user may define different security reinforcement templates according to different scenarios. Each security reinforcement template may contain different security reinforcement items to meet the security reinforcement requirements in different scenarios. And through the reinforcement item template, the reinforcement items set by the user are received, wherein the reinforcement item template includes at least one of the following: the reinforcement item template identifier, the reinforcement item template name, the reinforcement item template description, and the reinforcement item list included in the reinforcement item template. The reinforcement item template description includes a description of the application scenario. Thus, based on the security reinforcement items, the user can quickly and flexibly assemble a security reinforcement template that meets the personalized scenario. It can support the creation, modification and deletion of security reinforcement templates, as well as the query of specific security reinforcement templates.

[0039] Table 2 shows the contents of the security hardening template.

[0040] Table 2

[0041] In one implementation, a correspondence between a scene and the reinforcement item template can be established; based on the target scene associated with the user and the correspondence, the reinforcement item template corresponding to the target scene is determined, and the reinforcement items set by the user are received through the reinforcement item template. For example, the pre-set correspondence includes: the correspondence between scene A and reinforcement template 1, the correspondence between scene B and reinforcement template 2, and so on. When the target scene is scene A, the reinforcement template 1 corresponding to scene A can be determined based on the correspondence. The reinforcement items set by the user are received through the reinforcement item template 1. For example, through the reinforcement item operation interface, the multiple reinforcement items contained in the reinforcement item template 1 are displayed to the user to receive user input.

[0042] The user can set a target scenario, for example, by inputting the current operating scenario of the second network device. Alternatively, the operating scenario of the second network device can be automatically identified as the target scenario. In one implementation, the user-set reinforcement items are received through a reinforcement item operation interface provided by the first network device, thereby facilitating user input of the reinforcement items.

[0043] In one implementation, support for adding, modifying, and deleting security hardening items, as well as querying specific security hardening items, can be implemented using the security hardening item and security hardening template management module shown in Figure 1. The functions of the security hardening item and security hardening template management module can be implemented by hardware or software in the network management system.

[0044] S304: Compare the security configuration of the second network device with the content of the reinforcement item.

[0045] The security configuration of the second network device is compared with the content of the reinforcement item to obtain a comparison result.

[0046] In one implementation, when the reinforcement item is a reinforcement item built into the second network device, the reinforcement item is converted into a reinforcement item command readable by the second network device through a built-in policy.

[0047] In another implementation, when the reinforcement item is not a built-in reinforcement item of the second network device, a script of the reinforcement item is called to convert the reinforcement item into a reinforcement item command readable by the second network device.

[0048] This step may include the first network device sending a query command corresponding to the reinforcement item to the second network device; receiving a security configuration of the second network device fed back by the second network device; and comparing the security configuration with a policy value defined by the reinforcement item.

[0049] S306: Output the comparison result.

[0050] Through the patrol inspection of user-defined reinforcement items, customized patrol items are realized. Through the above steps, user-defined patrol items can be supported when built-in reinforcement items are added. For example: to support the opening and closing of a certain port of the base station, but the first network device does not have this patrol item built in, the network manager cannot construct a communication message system to send the opening and closing to the base station. At this time, the script of the customized patrol item can complete this conversion. For example, the security reinforcement item of a certain port of the base station = closed, the network manager converts it into a command that the base station can recognize through the script and sends it. In one implementation method, it can be converted into a message interface that the base station can recognize, such as the Simple Network Management Protocol (SNMP) or the Network Configuration Protocol (NETCONF). This step can be implemented by the security patrol module shown in Figure 1. The function of the security patrol module can be implemented by hardware or software in the network management system.

[0051] The network security detection method provided by the embodiment of the present application can improve the overall security of the network by defining security reinforcement items to perform security reinforcement for specific scenarios and needs.

[0052] A network security detection method provided by an embodiment of the present application can perform security inspections and issue security policies on base stations based on security reinforcement templates or security reinforcement items, thereby improving the efficiency of security management.

[0053] FIG4 is a schematic diagram of a network security detection device provided in an embodiment of the present application. The device 400 includes a query module 410 and a determination module 420 .

[0054] The query module 410 is configured to query the first security configuration and first security policy of the second network device based on a received user security request, wherein the user security request includes a list of information about the second network device and the first hardening item set by the user. The determination module 420 is configured to determine a network security detection result of the second network device based on the queried first security policy and the first security configuration of the second network device, so as to adjust the security configuration of the second network device based on the network security detection result.

[0055] In one implementation, the query module 410 is configured to send a query command for a security hardening item to the second network device in the information list; and receive a first security configuration and a first security policy of the second network device.

[0056] In one implementation, the query module 410 is configured to compare the first reinforcement item with the first security policy of the second network device to obtain a comparison result; and determine a difference value in the comparison result as a network security detection result of the second network device.

[0057] In one implementation, the query module 410 is used to send a second security policy to the second network device based on a received security policy issuance request after determining the network security detection result of the second network device, wherein the security policy issuance request includes an information list of the second network device and the second reinforcement item set by the user; and receive the effectiveness result of the second security policy fed back by the second network device.

[0058] In one implementation, the query module 410 is used to query the third security policy of the second network device based on the received security policy check request after receiving the effectiveness result of the second security policy fed back by the second network device, wherein the security policy effectiveness check request includes an information list of the second network device; and receive the security policy check result, which is a comparison result of the third security policy and the second security policy.

[0059] In one implementation, the query module 410 is used to receive the reinforcement items set by the user as follows: create a reinforcement item template; wherein the reinforcement item template includes at least one of the following: the reinforcement item template identifier, the reinforcement item template name, the reinforcement item template description, and the reinforcement item list included in the reinforcement item template; and receive the reinforcement items set by the user through the reinforcement item template.

[0060] In one implementation, the query module 410 is used to establish a correspondence between the scene and the reinforcement item template; determine the reinforcement item template corresponding to the target scene based on the target scene associated with the user and the correspondence; and receive the reinforcement item set by the user through the reinforcement item template.

[0061] In one implementation, the determination module 420 is used to, when the reinforcement item is a built-in reinforcement item of the second network device, convert the reinforcement item into a reinforcement item command readable by the second network device through a built-in policy; when the reinforcement item is not a built-in reinforcement item of the second network device, call the script of the reinforcement item to convert the reinforcement item into a reinforcement item command readable by the second network device.

[0062] In one implementation, the query module 410 is configured to receive a reinforcement item set by a user through a reinforcement item operation interface provided by the first network device.

[0063] In one implementation, the reinforcement item set by the user includes at least one of the following: an identifier of the reinforcement item, a name of the reinforcement item, content of the reinforcement item, a description of the comparison result corresponding to the reinforcement item, a policy value of the reinforcement item, and a script of the reinforcement item.

[0064] The network security detection device 400 in the embodiment of the present application can be an electronic device, such as an electronic device with an operating system, or a component in an electronic device, such as an integrated circuit or chip. The electronic device can be a terminal, or it can be other devices other than a terminal. For example, the terminal can include but is not limited to the types of terminals listed above, and other devices can be servers, network attached storage (NAS), etc., which are not limited in the embodiment of the present application.

[0065] The network security detection device provided in the embodiment of the present application can implement the various processes implemented in the method embodiments of Figures 2 to 3 and achieve the same technical effects. To avoid repetition, they will not be described here.

[0066] The present application also provides an electronic device. The electronic device may include a terminal device or a network device. As shown in FIG5 , the electronic device 500 includes a processor 501, a network interface 502, and a memory 503. The network interface 502 is, for example, a common public radio interface (CPRI).

[0067] In one implementation, the electronic device 500 of an embodiment of the present invention also includes: instructions or programs stored in the memory 503 and executable on the processor 501. The processor 501 calls the instructions or programs in the memory 503 to execute the various processes implemented in the method embodiments of Figures 2 to 3 and achieve the same technical effects. To avoid repetition, they will not be described here.

[0068] The present application also provides a readable storage medium having a program or instruction stored thereon. When the program or instruction is executed by a processor, the various processes implemented in the method embodiments of Figures 2 to 3 are implemented, and the same technical effects are achieved. To avoid repetition, they are not described here. The processor is the processor in the terminal described in the above embodiment. The readable storage medium includes a computer-readable storage medium, such as a computer read-only memory (ROM), a random access memory (RAM), a magnetic disk, or an optical disk.

[0069] The present application also provides a chip, which includes a processor and a communication interface, wherein the communication interface is coupled to the processor, and the processor is configured to execute a program or instruction to implement the various processes implemented in the method embodiments of Figures 2 to 3, and achieve the same technical effects. To avoid repetition, these are not described here. It should be understood that the chip mentioned in the present application can also be referred to as a system-on-chip, a system-on-chip, a chip system, or a system-on-chip chip.

[0070] An embodiment of the present application further provides a computer program / program product, which is stored in a storage medium. The computer program / program product is executed by at least one processor to implement the various processes implemented in the method embodiments of Figures 2 to 3 above and achieve the same technical effects. To avoid repetition, they are not described here.

[0071] It should be noted that, in this article, the terms "comprise", "include" or any other variants thereof are intended to cover non-exclusive inclusion, so that a process, method, article or device comprising a series of elements includes not only those elements, but also other elements not explicitly listed, or also includes elements inherent to such process, method, article or device. In the absence of further restrictions, an element defined by the statement "comprises a ..." does not exclude the presence of other identical elements in the process, method, article or device comprising the element. In addition, it should be noted that the scope of the methods and devices in the embodiments of the present application is not limited to performing functions in the order shown or discussed, and may also include performing functions in a substantially simultaneous manner or in the opposite order according to the functions involved. For example, the described method may be performed in an order different from that described, and various steps may also be added, omitted, or combined. In addition, the features described with reference to certain examples may be combined in other examples.

[0072] Through the description of the above implementation methods, those skilled in the art can clearly understand that the above-mentioned embodiment methods can be implemented by means of software plus the necessary general hardware platform, and of course can also be implemented by hardware, but in many cases the former is a better implementation method. Based on this understanding, the technical solution of the present application, or the part that contributes to the prior art, can be embodied in the form of a computer software product, which is stored in a storage medium (such as ROM / RAM, magnetic disk, optical disk), and includes a number of instructions for enabling a terminal (which can be a mobile phone, computer, server, air conditioner, or network device, etc.) to execute the methods described in each embodiment of the present application.

[0073] The embodiments of the present application are described above in conjunction with the accompanying drawings, but the present application is not limited to the above-mentioned specific implementation methods. The above-mentioned specific implementation methods are merely illustrative and not restrictive. Under the guidance of this application, ordinary technicians in this field can also make many forms without departing from the purpose of this application and the scope of protection of the claims, all of which are within the protection of this application.

Claims

1. A network security detection method, performed by a first network device, comprising: Based on the received user security request, query the first security configuration and the first security policy of the second network device, wherein the user security request includes the information list of the second network device and the first reinforcement item set by the user; According to the query of the first security policy and the first security configuration of the second network device, a network security detection result of the second network device is determined, so that the security configuration of the second network device is adjusted based on the network security detection result.

2. The method according to claim 1, wherein querying the first security configuration and the first security policy of the second network device based on the received user security request comprises: Sending a security hardening item query command to the second network device in the information list; A first security configuration and a first security policy of the second network device are received.

3. The method according to claim 2, wherein determining the network security detection result of the second network device according to the query of the first security policy and the first security configuration of the second network device comprises: Compare the first reinforcement item with the first security policy of the second network device to obtain a comparison result; The difference value in the comparison result is determined as the network security detection result of the second network device.

4. The method according to claim 1, wherein: After determining the network security detection result of the second network device, the method further includes: Sending a second security policy to the second network device based on the received security policy delivery request, wherein the security policy delivery request includes an information list of the second network device and a second reinforcement item set by the user; Receive the effectiveness result of the second security policy fed back by the second network device.

5. The method according to claim 4, wherein: After receiving the effectiveness result of the second security policy fed back by the second network device, the method further includes: Based on the received security policy check request, query the third security policy of the second network device, wherein the security policy effectiveness check request includes an information list of the second network device; A security policy check result is received, where the security policy check result is a comparison result of the third security policy and the second security policy.

6. According to the method of claim 1, the method of receiving the reinforcement item set by the user is as follows: Create a reinforcement item template; where: The reinforcement item template includes at least one of the following: the reinforcement item template identifier, the reinforcement item template name, the reinforcement item template description, and a reinforcement item list included in the reinforcement item template; The reinforcement item set by the user is received through the reinforcement item template.

7. The method according to claim 6, wherein receiving the reinforcement item set by the user through the reinforcement item template comprises: Establishing a correspondence between the scenario and the reinforcement item template; Determining a reinforcement item template corresponding to the target scenario according to the target scenario associated with the user and the corresponding relationship; The reinforcement item set by the user is received through the reinforcement item template.

8. The method according to claim 1, further comprising: In the case where the reinforcement item is a reinforcement item built into the second network device, converting the reinforcement item into a reinforcement item command readable by the second network device through a built-in policy; In the case that the reinforcement item is not a reinforcement item built into the second network device, a script of the reinforcement item is called to convert the reinforcement item into a reinforcement item command readable by the second network device.

9. The method according to claim 1, further comprising: The reinforcement items set by the user are received through the reinforcement item operation interface provided by the first network device.

10. According to the method of claim 1, the reinforcement item set by the user includes at least one of the following: The identification of the reinforcement item, the name of the reinforcement item, the content of the reinforcement item, the description of the comparison result corresponding to the reinforcement item, the policy value of the reinforcement item, and the script of the reinforcement item.

11. A network side device, comprising a processor and a memory, wherein the memory stores a program or instruction that can be run on the processor, and when the program or instruction is executed by the processor, the steps of the network security detection method according to any one of claims 1 to 10 are implemented.

12. A readable storage medium storing a program or instruction, wherein the program or instruction, when executed by a processor, implements the steps of the network security detection method according to any one of claims 1 to 10.

Images