119 results about "Network security policy" patented technology

The invention relates to the technical field of automatic deployment of cloud computing platforms, in particular to a self-adaptive deployment method and system oriented to a credential heterogeneous environment. Aiming at three technical bottlenecks of low multi-CPU architecture adaptation efficiency, frequent software dependence conflicts and complex security baseline configuration in a localization process, a heterogeneous computing resource intelligent scheduling engine and a dynamic security policy generation mechanism are innovatively provided. The method comprises the following steps: constructing a heterogeneous resource portrait through a hardware feature automatic identification technology, and realizing component installation sequence optimization based on a DAG dependency relationship analysis algorithm and Kahn topological sorting; and creating an adaptive network security policy, and sensing the firewall state of the target system in real time through a probe. Compared with a traditional deployment mode, the method supports cross-architecture compatibility, solves the problem of dependency conflicts, improves deployment efficiency, and guarantees consistency and safety of the system.

Techniques are described for providing a natural language network security policy assistant for allowing a network administrator to implement network security policies using natural language security policy requests. A natural language request can be received by a user and can be translated using Artificial Intelligence into one or more security policy clauses. If the natural language security policy request leads to ambiguities with regard to intended security policies, one or more clarifying questions can be generated as natural language questions and sent to the user for clarification. One or more security policies can be implemented based on the one or more security policy clauses generated in response to the natural language security policy request and / or the natural language response to the clarifying questions.

Various aspects of the disclosure relate to enforcing dynamically updated network security policies in real-time (or upon an identified update) from multiple organizations and anonymously analyze computing system configuration information uploaded from third-party computing systems. An analysis engine monitors compliance information and compare the compliance information against the security rules and / or requirements for one or more enterprise networks. A visualization providing a network map with a visual representation of each product system service system may include communication links between internal applications and / or computing systems and drill-down capability to identify issues as they are occurring or are predicted to occur. The security escrow system may include a mechanism to automatically enable / disable access between third party networks and one or more enterprise computing systems in real-time based on identified compliance information.

Systems, devices, and techniques are disclosed for network security policy generation and distribution. A security policy written using a Domain Specific Language (DSL) for network security may be received. The security policy may be associated with a service owner and a control plane. A representation of the security policy may be generated from the security policy. A configuration bundle of the service owner may be updated with the representation of the security policy. The security policy may be determined to be approved. A rule set may be generated from the representation of the security policy. A differential between the rule set and a current rule set may be determined. A security component associated with the control plane based on the differential may be configured.

Embodiments are directed to managing access to network resources. A first mesh agent may be configured to provide a client with access to a resource via an overlay network. The first mesh agent may determine an identity and an activity associated with requests such that the identity corresponds to an entity that may be authenticated to access the overlay network and the resource. A policy container associated with the activity may be determined based on characteristics of the requests such that the policy container may include policies associated with the activity. The requests may be validated based on the policies included in the policy container such that the validated requests may be forwarded to the resource and invalidated requests may be discarded and such that persistence of the connection may be maintained during the validation.

Methods, apparatuses, systems, and machine-readable media are disclosed for improving packet filtering efficiency by reducing processing time and / or by reducing memory usage. Any of various types of data structures, such as flat hash maps and / or ruletrees, may be used by a packet filtering appliance to search for cybersecurity policy packet filtering rules that should be applied to in-transit packets. The packet filtering appliance may search the index data structures for matches of search objects, in the form of values that the packet filtering appliance extracts from in-transit packets, to threat indicator matching criteria of the policy rules. Each of the index data structures may map rule identifiers (rule IDs) of policy rules to keys that are based on (or that comprise) the matching criteria of those rules.

The invention relates to the field of Internet of Things security, in particular to a network security policy generation method and system based on an AI large model. According to the method, firstly, a scene library containing historical security events and a strategy library containing various strategies are included, a to-be-processed security event currently received by a network is obtained at the same time, scene matching analysis is carried out on the to-be-processed security event and the historical security events based on data information of all dimensions, and the security event matching result is obtained. And screening out similar security events of the to-be-processed security events from all the historical security events, carrying out iterative training on the historical security events by using the constructed weak classifier about the target dimension to obtain the key degree of the target dimension, and obtaining the security events of the to-be-processed security events based on the screened key dimensions. And further performing scene matching analysis on the to-be-processed security event and the similar security event to generate a strategy set of the to-be-processed security event. According to the invention, the interference of redundant dimensions on network security event scene matching can be eliminated, and the security policy generation effect is improved.

A device, system, and method are provided for generating a network security policy automatically based on network traffic. The network security policy is generated by building a directional graph from the network traffic, with the nodes of the graph representing network end points, and the edges representing communication between two nodes on a communication channel. A feature vector is generated for each of the nodes and a graph neural network is applied to the feature vectors to generate output vectors. The output vectors are clustered using a cost function based on a weighted combination of a distance-based cost function and a network functionality cost function. The clusters generated from the output vectors are used to assign network security rules to each of the clusters.

The invention discloses a method for enhancing a network boundary security policy of a power monitoring system, and belongs to the field of network security. Comprising the following steps: collecting security equipment strategies of different brands in the power monitoring system in combination with network security equipment characteristics of the power monitoring system, and performing intelligent analysis in combination with asset routing conditions; on the basis of asset detection, routing strategy acquisition and protection strategy acquisition, network security strategy calculation is carried out, and unified strategy management of security boundaries is realized; under the condition that the information security requirement is met, automatic issuing of protection and blocking strategies is realized; through centralized management of security policies of heterogeneous equipment, policy configuration data of the network security equipment is captured in an online acquisition mode, and a unified security policy library is formed in a normalization mode, so that unified management, carding reinforcement, carding optimization, topology modeling, path management and policy opening and plugging functions of the security policies of the heterogeneous network security equipment are realized. The method can be widely applied to the field of safety management and operation maintenance of a power monitoring system network.

Methods, apparatuses, systems, and machine-readable media are disclosed for improving packet filtering efficiency by reducing processing time and / or by reducing memory usage. Any of various types of data structures, such as flat hash maps and / or ruletrees, may be used by a packet filtering appliance to search for cybersecurity policy packet filtering rules that should be applied to in-transit packets. The packet filtering appliance may search the index data structures for matches of search objects, in the form of values that the packet filtering appliance extracts from in-transit packets, to threat indicator matching criteria of the policy rules. Each of the index data structures may map rule identifiers (rule IDs) of policy rules to keys that are based on (or that comprise) the matching criteria of those rules.

The invention discloses a computer network information security monitoring method, which relates to the technical field of network information security monitoring, and comprises the following steps of: monitoring and collecting network flow data in real time by using a monitoring and collecting module, extracting and recording historical network flow data, judging the abnormal degree of the current flow by using a comprehensive evaluation and adjustment module, and judging the abnormal degree of the current flow. The method comprises the following steps: evaluating the overall risk level of network security, adjusting a network security policy, generating a policy adjustment report, executing the adjusted network security policy by using a security execution module based on the policy adjustment report, and continuously monitoring network traffic by using a monitoring acquisition module. The beneficial effects and optimization innovation of comprehensive assessment, dynamic risk assessment, flexible strategy adjustment and sensitivity improvement are realized, and the optimization and innovation not only solve the problems and defects in the prior art, but also improve the accuracy and reliability of the monitoring system. And a more comprehensive and effective guarantee is provided for computer network information security.

Systems and methods for providing system wide cyber security policies include providing a unified security policy to a distributed cloud environment that includes cloud, edge, and local infrastructure. The method includes identifying one or more assets and using telemetry and logs associated with the assets to determine one or more paths connecting the one or more assets. Once one or more paths are determined, the method produces a map of the paths and determines the level of compliance for each. The paths are ranked and a user, such as an administrator or CISO, may be informed of the rankings.

A business poly-intelligence application enabling the secure collection, warehousing, analysis, and reporting of manually shared and publicly sourced business strategy data is presented with systems, methods, and computer-readable media with a specific focus on crowdsourced cybersecurity strategy development.

The invention discloses a network security policy adjustment method and device and electronic equipment, and relates to the field of network security or other related technical fields, and the adjustment method comprises the steps: determining a network event triggering a network security policy, and obtaining suspected false alarm data based on the network event; inputting the suspected false alarm data and a preset prompt text into a large language model, and outputting an optimization measure of a network security policy through the large language model in combination with a knowledge base; and adjusting the network security policy according to the optimization measure of the network security policy. According to the method and the device, the technical problem of relatively low efficiency of a mode of manually analyzing and adjusting massive network security policies depending on expert experience in related technologies is solved.

A system and method for cybersecurity policy management in a computing environment is presented. The method includes receiving a selection of a first cybersecurity policy of a digital security platform of a computing environment; applying the first cybersecurity policy to generate a first measurement; generating a second cybersecurity policy based on the first cybersecurity policy and a result of the first measurement; applying the second cybersecurity policy to generate a second measurement; generating a third cybersecurity policy based on a result of the second measurement and the second cybersecurity policy; and applying the third cybersecurity policy on the computing environment.

The invention discloses a biological monitoring equipment fault-tolerant control method based on a network security policy, and relates to the technical field of medical equipment management, and the method comprises the steps: S1, obtaining a historical operation log monitored by biological monitoring equipment, extracting a service life, combining with a time sequence data sequence and fault history, fusing long-term dependence capture, and forming an initial data set; s2, processing the initial data set through a long short-term memory network, capturing a time sequence dependency relationship between performance degradation and fault history by applying a forgetting gate mechanism and input gate control, obtaining a quantization vector of a change trend by utilizing output gate adjustment and cell state updating, and fusing hidden state output; according to the biological monitoring equipment fault-tolerant control method based on the network security policy, the reliability and the fault-tolerant capability of wetland zone micro algae monitoring equipment are remarkably improved, the service life of the equipment is prolonged, and the maintenance cost is reduced.

The invention relates to the technical field of network security, and provides a network security policy optimization method and system, and the method comprises the steps: obtaining a detection sensitivity adjustment record of a process of adjusting and managing a network communication mode through a self-adaptive network security system, and carrying out the optimization of a network security policy based on the detection sensitivity adjustment record; identifying a communication mode in which the detection sensitivity is continuously reduced; performing multi-dimensional risk re-assessment on the communication mode to obtain a multi-dimensional risk re-assessment result; the multi-dimensional risk re-assessment comprises the steps of performing association analysis on the communication mode and a preset abnormal behavior to obtain association analysis information; obtaining the current state and operation logic of the industrial production process; verifying the rationality of the communication mode in the industrial control system in combination with the current state and the operation logic to obtain rationality verification information; and according to a multi-dimensional risk re-assessment result, adjusting and optimizing a security policy, and generating and sending alarm information. The method has the effect of improving the network security protection level of the industrial control system.

Various aspects of the disclosure relate to enforcing dynamically updated network security policies in real-time (or upon an identified update) from multiple organizations and anonymously analyze computing system configuration information uploaded from third-party computing systems. An analysis engine monitors compliance information and compare the compliance information against the security rules and / or requirements for one or more enterprise networks. A visualization providing a network map with a visual representation of each product system service system may include communication links between internal applications and / or computing systems and drill-down capability to identify issues as they are occurring or are predicted to occur. The security escrow system may include a mechanism to automatically enable / disable access between third party networks and one or more enterprise computing systems in real-time based on identified compliance information.

The invention discloses a network security policy intelligent optimization system based on an improved SPF algorithm, and belongs to the technical field of network security. According to the system, by constructing a network security topological graph, network assets, services and users are defined as nodes of the graph, and potential access relations are defined as edges. A multi-dimensional and dynamically quantized'security risk index 'is provided as a weight of an edge, and the index integrates multiple dimensions. An improved SPF algorithm is adopted, and a lowest risk path from any source node to a target node is calculated. And according to the calculated optimal path, a refined access control strategy is automatically generated and issued, and redundancy analysis and optimization suggestion are carried out on the existing strategy. According to the method, the problems that a traditional security policy is complex in configuration, prone to errors and incapable of adapting to dynamic risk changes are solved, conversion from static and passive access control to dynamic and active risk path optimization is achieved, and the intelligent level and overall security of network security defense are remarkably improved.

The invention discloses a security policy identification analysis method and system based on an LLM power monitoring system. The method comprises the following steps: respectively and automatically acquiring network routing information and security policy information of SSH and Web type equipment by using an intelligent acquisition strategy through an SSH interface and a Web interface; performing association analysis on all network routing information and security policy information by using a graph data method; and based on the association analysis result of the routing information and the security policy information, automatically generating a network security policy optimization suggestion by using an LLM model. According to the scheme, the LLM model is used for identifying the security policy, and the optimization suggestion is generated in combination with the network information.

The invention discloses a network security policy full-life-cycle adaptive tuning system based on intelligent computation driving, relates to the technical field of network security, and is used for solving the problems of policy adaptation and efficiency balance under resource limitation. The method comprises the following steps: firstly, predicting an attack probability and mapping a topological weight by using an LSTM combined with an attention mechanism, and generating a risk prediction vector; then, performing weighted pruning on the rule based on the computing power constraint and the flow priority, and generating an execution state strategy packet; after issuing, monitoring a delay increment and an interception hit rate during operation, and generating a regular degradation instruction for a low-efficiency and high-consumption rule; and finally, regular scanning parameters are adjusted through gradient optimization, a self-adaptive system from risk pre-judgment to closed-loop optimization is constructed, and intelligent support is provided for network security defense.

A method of managing a computer network includes: receiving, at a network port, a stream of multimodal data; obtaining, from the multimodal data, a subset of the multimodal data that corresponds to a modality; determining, using a large-language model (LLM) agent, a semantic context of the subset of the multimodal data; determining, based on the semantic context and among a plurality of network policies, a network security policy corresponding to the subset of the multimodal data; and directing the subset of the multimodal data according to the network security policy.

The invention discloses a network security policy generation method, a network security protection method, devices and equipment, and relates to the technical field of network security, and the network security policy generation method applied to a network data analysis function NWDAF comprises the following steps: receiving a network data report sent by a network monitoring platform; generating a network access policy according to the network data report and network service information of an operator network to which the NWDAF belongs, the network service information including at least one of user subscription information, service policy information and network state information; and sending the network access policy to a policy control function (PCF). According to the embodiment of the invention, the problem that the network service interruption is easily caused by adopting the existing network attack mode under the convergence scene of the industry private network and the public network can be solved.

Disclosed are examples of systems, apparatus, methods and computer program products for automation of network security policy analysis and deployment. A server system can obtain a system input comprising two versions of a policy output. The system can generate a severity characteristic that indicates a severity of deploying the second version of the policy output. The system can then determine whether to deploy the second version of the policy output based on the severity characteristic. The system can then, in response to determining that the second version of the policy output is to be deployed, deploy the second version of the policy output to one of a plurality of clouds.

The invention discloses a network security policy configuration method, system and device and a medium, and the method comprises the steps: obtaining security intention information inputted by a user, determining a current security intention according to the security intention information, and when the current security intention conflicts with a historical security intention, determining a network security policy according to the current security intention; calculating a conflict evaluation value between the current security intention and the historical security intention, judging whether the conflict evaluation value is greater than a preset threshold, and if yes, continuing to execute a historical security policy corresponding to the historical security intention; and if not, executing the current security policy corresponding to the current security intention. Through the method, the automatic configuration of the network security policy based on the user intention is completed, the configuration efficiency of the network security policy is improved, the conflict between the network security policies can be avoided based on the conflict evaluation between the security intentions, and the accuracy of the configured network security policy is ensured.

The invention relates to the technical field of network security, and particularly discloses a self-adaptive dynamic network security policy intelligent regulation and control method, which comprises the following steps of: respectively extracting a communication link abnormal characteristic value and a channel disturbance characteristic value by monitoring a quantum bit error rate and communication channel signal strength in network traffic in real time; wherein high-sensitivity identification of quantum noise interference is realized based on Bayesian reasoning, and robustness of external interference detection is improved based on Haar wavelet transform; fusing the two types of features into a comprehensive security risk feature vector, inputting the comprehensive security risk feature vector into a gradient boosting tree model for training, outputting a network security score by taking minimization of a prediction score error as a target, and dividing threat levels according to the network security score; the system automatically adjusts the protection strategy according to the security level, and forms closed-loop optimization control through continuous feedback, thereby improving the adaptability and active defense capability of the network system, and solving the problems of security response lagging and inaccurate strategy adjustment in a complex environment in the prior art.

Technique or mechanism in which network security policies are applied close to the source or origin associated with policy decisions. For example. the disclosed technology moves dropped flows from a firewall cluster to a leaf switch based on host location.

The invention discloses an industrial internet security operation and maintenance risk assessment method and system, and relates to the technical field of data management.The industrial internet security operation and maintenance risk assessment method comprises the steps that initial information collection is conducted on an industrial internet operation environment, risk links are constructed, and primary risk links are further analyzed and screened out; then obtaining dynamic operation data of each primary risk link, performing priority ranking based on the dynamic comprehensive risk score, and dynamically adjusting response triggering measures of the primary risk links at the same time to realize pertinence and timeliness of risk disposal; and finally, through cross validation of multi-level risk links, evaluation of actual effects of each adjustment measure and fine adjustment of a network security policy, potential risks can be effectively identified and quantified, a protection policy can be dynamically adjusted, the high-risk link disposal efficiency can be improved, and the security and stability of the whole system can be ensured. Therefore, the scientificity, controllability and reliability of industrial internet security operation and maintenance are obviously enhanced.

On the granularity of a single application layer session, sensing and flow processing of multi-part file transmission of different application programs are separated, and efficient network security implementation on multi-part file transmission is promoted. A protocol-based multi-part file transfer regulator ("regulator") determines a per-session message handling action to prevent completion of the multi-part file transfer based on the protocol of the application identified for the session until a network security analysis can be performed. The regulator then communicates the message handling action to a network component that supports the session. The regulator maintains information and file chunks for active sessions in a data store and uses the data store to determine whether conditions requesting network security analysis for multi-part file transfers are satisfied. Upon obtaining a network security analysis decision, the regulator provides the decision or decision-based instructions to the network component, which ensures that the multi-part file transfer conforms to the network security policy (s).

The present application relates to a method and device for security detection and tracing of software-defined network flow rules, wherein the method includes: intercepting the current network top-level security policy, forwarding rules and flow rules stored in the data plane from a preset software-defined network controller, and converting the security policy into a concrete security rule based on a preset conversion rule; encoding and storing the security rules, forwarding rules and flow rules based on a preset data structure, and calculating the actual scope of each rule; simulating the actual behavior of data packets in the network and the security behavior that meets the security policy requirements through a pre-established network topology-hardware device-logical function network behavior model, identifying unsafe network behavior, and tracing it back to the unsafe network rules that caused the behavior. Thus, the technical problem that it is difficult to verify the consistency of network behavior with network security policy, and that the general verification tools used are slow and not timely, is solved, thereby improving the user experience.