93 results about "Network security policy" patented technology

The invention relates to the technical field of automatic deployment of cloud computing platforms, in particular to a self-adaptive deployment method and system oriented to a credential heterogeneous environment. Aiming at three technical bottlenecks of low multi-CPU architecture adaptation efficiency, frequent software dependence conflicts and complex security baseline configuration in a localization process, a heterogeneous computing resource intelligent scheduling engine and a dynamic security policy generation mechanism are innovatively provided. The method comprises the following steps: constructing a heterogeneous resource portrait through a hardware feature automatic identification technology, and realizing component installation sequence optimization based on a DAG dependency relationship analysis algorithm and Kahn topological sorting; and creating an adaptive network security policy, and sensing the firewall state of the target system in real time through a probe. Compared with a traditional deployment mode, the method supports cross-architecture compatibility, solves the problem of dependency conflicts, improves deployment efficiency, and guarantees consistency and safety of the system.

Techniques are described for providing a natural language network security policy assistant for allowing a network administrator to implement network security policies using natural language security policy requests. A natural language request can be received by a user and can be translated using Artificial Intelligence into one or more security policy clauses. If the natural language security policy request leads to ambiguities with regard to intended security policies, one or more clarifying questions can be generated as natural language questions and sent to the user for clarification. One or more security policies can be implemented based on the one or more security policy clauses generated in response to the natural language security policy request and / or the natural language response to the clarifying questions.

Various aspects of the disclosure relate to enforcing dynamically updated network security policies in real-time (or upon an identified update) from multiple organizations and anonymously analyze computing system configuration information uploaded from third-party computing systems. An analysis engine monitors compliance information and compare the compliance information against the security rules and / or requirements for one or more enterprise networks. A visualization providing a network map with a visual representation of each product system service system may include communication links between internal applications and / or computing systems and drill-down capability to identify issues as they are occurring or are predicted to occur. The security escrow system may include a mechanism to automatically enable / disable access between third party networks and one or more enterprise computing systems in real-time based on identified compliance information.

Systems, devices, and techniques are disclosed for network security policy generation and distribution. A security policy written using a Domain Specific Language (DSL) for network security may be received. The security policy may be associated with a service owner and a control plane. A representation of the security policy may be generated from the security policy. A configuration bundle of the service owner may be updated with the representation of the security policy. The security policy may be determined to be approved. A rule set may be generated from the representation of the security policy. A differential between the rule set and a current rule set may be determined. A security component associated with the control plane based on the differential may be configured.

Embodiments are directed to managing access to network resources. A first mesh agent may be configured to provide a client with access to a resource via an overlay network. The first mesh agent may determine an identity and an activity associated with requests such that the identity corresponds to an entity that may be authenticated to access the overlay network and the resource. A policy container associated with the activity may be determined based on characteristics of the requests such that the policy container may include policies associated with the activity. The requests may be validated based on the policies included in the policy container such that the validated requests may be forwarded to the resource and invalidated requests may be discarded and such that persistence of the connection may be maintained during the validation.

A device, system, and method are provided for generating a network security policy automatically based on network traffic. The network security policy is generated by building a directional graph from the network traffic, with the nodes of the graph representing network end points, and the edges representing communication between two nodes on a communication channel. A feature vector is generated for each of the nodes and a graph neural network is applied to the feature vectors to generate output vectors. The output vectors are clustered using a cost function based on a weighted combination of a distance-based cost function and a network functionality cost function. The clusters generated from the output vectors are used to assign network security rules to each of the clusters.

The invention discloses a network security policy adjustment method and device and electronic equipment, and relates to the field of network security or other related technical fields, and the adjustment method comprises the steps: determining a network event triggering a network security policy, and obtaining suspected false alarm data based on the network event; inputting the suspected false alarm data and a preset prompt text into a large language model, and outputting an optimization measure of a network security policy through the large language model in combination with a knowledge base; and adjusting the network security policy according to the optimization measure of the network security policy. According to the method and the device, the technical problem of relatively low efficiency of a mode of manually analyzing and adjusting massive network security policies depending on expert experience in related technologies is solved.

A system and method for cybersecurity policy management in a computing environment is presented. The method includes receiving a selection of a first cybersecurity policy of a digital security platform of a computing environment; applying the first cybersecurity policy to generate a first measurement; generating a second cybersecurity policy based on the first cybersecurity policy and a result of the first measurement; applying the second cybersecurity policy to generate a second measurement; generating a third cybersecurity policy based on a result of the second measurement and the second cybersecurity policy; and applying the third cybersecurity policy on the computing environment.

The invention discloses a biological monitoring equipment fault-tolerant control method based on a network security policy, and relates to the technical field of medical equipment management, and the method comprises the steps: S1, obtaining a historical operation log monitored by biological monitoring equipment, extracting a service life, combining with a time sequence data sequence and fault history, fusing long-term dependence capture, and forming an initial data set; s2, processing the initial data set through a long short-term memory network, capturing a time sequence dependency relationship between performance degradation and fault history by applying a forgetting gate mechanism and input gate control, obtaining a quantization vector of a change trend by utilizing output gate adjustment and cell state updating, and fusing hidden state output; according to the biological monitoring equipment fault-tolerant control method based on the network security policy, the reliability and the fault-tolerant capability of wetland zone micro algae monitoring equipment are remarkably improved, the service life of the equipment is prolonged, and the maintenance cost is reduced.

The invention relates to the technical field of network security, and provides a network security policy optimization method and system, and the method comprises the steps: obtaining a detection sensitivity adjustment record of a process of adjusting and managing a network communication mode through a self-adaptive network security system, and carrying out the optimization of a network security policy based on the detection sensitivity adjustment record; identifying a communication mode in which the detection sensitivity is continuously reduced; performing multi-dimensional risk re-assessment on the communication mode to obtain a multi-dimensional risk re-assessment result; the multi-dimensional risk re-assessment comprises the steps of performing association analysis on the communication mode and a preset abnormal behavior to obtain association analysis information; obtaining the current state and operation logic of the industrial production process; verifying the rationality of the communication mode in the industrial control system in combination with the current state and the operation logic to obtain rationality verification information; and according to a multi-dimensional risk re-assessment result, adjusting and optimizing a security policy, and generating and sending alarm information. The method has the effect of improving the network security protection level of the industrial control system.

Various aspects of the disclosure relate to enforcing dynamically updated network security policies in real-time (or upon an identified update) from multiple organizations and anonymously analyze computing system configuration information uploaded from third-party computing systems. An analysis engine monitors compliance information and compare the compliance information against the security rules and / or requirements for one or more enterprise networks. A visualization providing a network map with a visual representation of each product system service system may include communication links between internal applications and / or computing systems and drill-down capability to identify issues as they are occurring or are predicted to occur. The security escrow system may include a mechanism to automatically enable / disable access between third party networks and one or more enterprise computing systems in real-time based on identified compliance information.

The invention discloses a network security policy intelligent optimization system based on an improved SPF algorithm, and belongs to the technical field of network security. According to the system, by constructing a network security topological graph, network assets, services and users are defined as nodes of the graph, and potential access relations are defined as edges. A multi-dimensional and dynamically quantized'security risk index 'is provided as a weight of an edge, and the index integrates multiple dimensions. An improved SPF algorithm is adopted, and a lowest risk path from any source node to a target node is calculated. And according to the calculated optimal path, a refined access control strategy is automatically generated and issued, and redundancy analysis and optimization suggestion are carried out on the existing strategy. According to the method, the problems that a traditional security policy is complex in configuration, prone to errors and incapable of adapting to dynamic risk changes are solved, conversion from static and passive access control to dynamic and active risk path optimization is achieved, and the intelligent level and overall security of network security defense are remarkably improved.

The invention discloses a network security policy full-life-cycle adaptive tuning system based on intelligent computation driving, relates to the technical field of network security, and is used for solving the problems of policy adaptation and efficiency balance under resource limitation. The method comprises the following steps: firstly, predicting an attack probability and mapping a topological weight by using an LSTM combined with an attention mechanism, and generating a risk prediction vector; then, performing weighted pruning on the rule based on the computing power constraint and the flow priority, and generating an execution state strategy packet; after issuing, monitoring a delay increment and an interception hit rate during operation, and generating a regular degradation instruction for a low-efficiency and high-consumption rule; and finally, regular scanning parameters are adjusted through gradient optimization, a self-adaptive system from risk pre-judgment to closed-loop optimization is constructed, and intelligent support is provided for network security defense.

A method of managing a computer network includes: receiving, at a network port, a stream of multimodal data; obtaining, from the multimodal data, a subset of the multimodal data that corresponds to a modality; determining, using a large-language model (LLM) agent, a semantic context of the subset of the multimodal data; determining, based on the semantic context and among a plurality of network policies, a network security policy corresponding to the subset of the multimodal data; and directing the subset of the multimodal data according to the network security policy.

Disclosed are examples of systems, apparatus, methods and computer program products for automation of network security policy analysis and deployment. A server system can obtain a system input comprising two versions of a policy output. The system can generate a severity characteristic that indicates a severity of deploying the second version of the policy output. The system can then determine whether to deploy the second version of the policy output based on the severity characteristic. The system can then, in response to determining that the second version of the policy output is to be deployed, deploy the second version of the policy output to one of a plurality of clouds.

The invention discloses a network security policy configuration method, system and device and a medium, and the method comprises the steps: obtaining security intention information inputted by a user, determining a current security intention according to the security intention information, and when the current security intention conflicts with a historical security intention, determining a network security policy according to the current security intention; calculating a conflict evaluation value between the current security intention and the historical security intention, judging whether the conflict evaluation value is greater than a preset threshold, and if yes, continuing to execute a historical security policy corresponding to the historical security intention; and if not, executing the current security policy corresponding to the current security intention. Through the method, the automatic configuration of the network security policy based on the user intention is completed, the configuration efficiency of the network security policy is improved, the conflict between the network security policies can be avoided based on the conflict evaluation between the security intentions, and the accuracy of the configured network security policy is ensured.

The invention relates to the technical field of network security, and particularly discloses a self-adaptive dynamic network security policy intelligent regulation and control method, which comprises the following steps of: respectively extracting a communication link abnormal characteristic value and a channel disturbance characteristic value by monitoring a quantum bit error rate and communication channel signal strength in network traffic in real time; wherein high-sensitivity identification of quantum noise interference is realized based on Bayesian reasoning, and robustness of external interference detection is improved based on Haar wavelet transform; fusing the two types of features into a comprehensive security risk feature vector, inputting the comprehensive security risk feature vector into a gradient boosting tree model for training, outputting a network security score by taking minimization of a prediction score error as a target, and dividing threat levels according to the network security score; the system automatically adjusts the protection strategy according to the security level, and forms closed-loop optimization control through continuous feedback, thereby improving the adaptability and active defense capability of the network system, and solving the problems of security response lagging and inaccurate strategy adjustment in a complex environment in the prior art.

Technique or mechanism in which network security policies are applied close to the source or origin associated with policy decisions. For example. the disclosed technology moves dropped flows from a firewall cluster to a leaf switch based on host location.

The invention discloses an industrial internet security operation and maintenance risk assessment method and system, and relates to the technical field of data management.The industrial internet security operation and maintenance risk assessment method comprises the steps that initial information collection is conducted on an industrial internet operation environment, risk links are constructed, and primary risk links are further analyzed and screened out; then obtaining dynamic operation data of each primary risk link, performing priority ranking based on the dynamic comprehensive risk score, and dynamically adjusting response triggering measures of the primary risk links at the same time to realize pertinence and timeliness of risk disposal; and finally, through cross validation of multi-level risk links, evaluation of actual effects of each adjustment measure and fine adjustment of a network security policy, potential risks can be effectively identified and quantified, a protection policy can be dynamically adjusted, the high-risk link disposal efficiency can be improved, and the security and stability of the whole system can be ensured. Therefore, the scientificity, controllability and reliability of industrial internet security operation and maintenance are obviously enhanced.

On the granularity of a single application layer session, sensing and flow processing of multi-part file transmission of different application programs are separated, and efficient network security implementation on multi-part file transmission is promoted. A protocol-based multi-part file transfer regulator ("regulator") determines a per-session message handling action to prevent completion of the multi-part file transfer based on the protocol of the application identified for the session until a network security analysis can be performed. The regulator then communicates the message handling action to a network component that supports the session. The regulator maintains information and file chunks for active sessions in a data store and uses the data store to determine whether conditions requesting network security analysis for multi-part file transfers are satisfied. Upon obtaining a network security analysis decision, the regulator provides the decision or decision-based instructions to the network component, which ensures that the multi-part file transfer conforms to the network security policy (s).

The present application relates to a method and device for security detection and tracing of software-defined network flow rules, wherein the method includes: intercepting the current network top-level security policy, forwarding rules and flow rules stored in the data plane from a preset software-defined network controller, and converting the security policy into a concrete security rule based on a preset conversion rule; encoding and storing the security rules, forwarding rules and flow rules based on a preset data structure, and calculating the actual scope of each rule; simulating the actual behavior of data packets in the network and the security behavior that meets the security policy requirements through a pre-established network topology-hardware device-logical function network behavior model, identifying unsafe network behavior, and tracing it back to the unsafe network rules that caused the behavior. Thus, the technical problem that it is difficult to verify the consistency of network behavior with network security policy, and that the general verification tools used are slow and not timely, is solved, thereby improving the user experience.

The invention relates to the technical field of network security, and discloses a network security knowledge graph construction method and system, and the system comprises a data obtaining and preprocessing module which is used for obtaining original network security related data; the entity and relationship extraction module is used for identifying important network security entities from the preprocessed data; the storage and management module is used for effectively storing the constructed network security knowledge graph; the analysis and reasoning module is used for carrying out deep analysis and reasoning based on the constructed knowledge graph; and the visualization and interaction module is used for visualizing the complex knowledge graph. According to the method, the comprehensive and accurate knowledge graph can help a security team to take defense measures more quickly in advance, loss caused by network attacks is effectively reduced, support based on data and knowledge is provided for making a network security strategy, decision making is more scientific and reasonable, resource utilization efficiency is improved, and blind investment is avoided.

The invention provides a network flow multi-level security protection model, system, method, equipment and medium. According to the method, a plurality of modularized atomization protection points are constructed through a predefined eBPF program library, and network control capabilities such as matching, speed limiting and state observation are realized. In a system initialization stage, a data plane architecture comprising a plurality of kernel execution layer dispatcher programs is constructed, and persistence of the programs and resource Map is realized through pin operation. The declarative network security policy is received through the SDK module, the policy control module analyzes the declarative network security policy to generate a configuration parameter, and the user mode module loads an eBPF program according to the configuration parameter and mounts the eBPF program to a kernel execution layer. The network flow triggers a protection point according to a path and outputs observation data; and the state aggregation sub-module aggregates the data according to the strategy and feeds information back to the upper-layer application. Therefore, flexible deployment of protection points and strategy dynamic driving can be realized, and the method has good expandability and response capability.

The application discloses a network device optimization method and device, computer equipment and a storage medium, the method comprises the following steps: obtaining the network security policy table of a target network device; determining the network security policy group with a policy relationship in the network security policy table based on the policy action, the policy virtual wall and the communication five tuple information; performing optimization processing on the network security policy table based on the policy relationship of the network security policy group, to obtain an optimized network security policy table; and performing optimization processing on the target network device based on the optimized network security policy table, to obtain an optimized target network device. The network security policy table after optimization can effectively sort out and optimize the network security policy of the target network device, and since no human intervention is required throughout the process, the management efficiency is effectively improved while ensuring the accuracy of management.

Techniques are described for providing a natural language network security policy assistant for allowing a network administrator to implement network security policies using natural language security policy requests. A natural language request can be received by a user and can be translated using Artificial Intelligence into one or more security policy clauses. If the natural language security policy request leads to ambiguities with regard to intended security policies, one or more clarifying questions can be generated as natural language questions and sent to the user for clarification. One or more security policies can be implemented based on the one or more security policy clauses generated in response to the natural language security policy request and / or the natural language response to the clarifying questions.

The invention provides a service access method and equipment. The method is applied to a first device, and the method comprises the following steps: obtaining a first corresponding relationship between a plurality of service names and a plurality of service identities (ID); a first service ID corresponding to the first service name is determined according to the first corresponding relation, and the first service name comprises the service name of the source service and / or the service name of the target service; and sending a first message to a second device where the target service is located, wherein the first message comprises the first service ID. In the technical scheme, when service access is carried out, service information can be directly associated by carrying the service ID in the first message, so that a manager can configure a network security policy based on the service information, and a source service or a target service of service access can be limited to improve network security.

The invention relates to the technical field of industrial control system safety, in particular to an MAC address management method of an MES system. Comprising the following steps: receiving contextual data related to a manufacturing process from a manufacturing execution system in real time, such as a work order state, an equipment operation mode, a bill of materials and operator allocation; the method comprises the following steps of: finding equipment connected to an OT network and a corresponding MAC (Media Access Control) address in a mode of passively monitoring and actively querying a network switch; in a central data storage library, the found MAC address is associated with context data obtained from an MES, and a dynamic identity portrait with rich situations is established for each device; dynamically generating a network access strategy with timeliness and a minimum permission principle for the equipment on the basis of the association relationship; finally, an instruction is sent to the network switch to enforce the policy. According to the method, the network security policy is bound with the actual production plan, so that the security of the industrial network is remarkably improved on the premise of ensuring the production continuity.

The invention provides a domain name resolution method, system and device based on DNS proxy identity authentication and strategy control, and belongs to the technical field of computer network DNS resolution. The method comprises the following steps: receiving a DNS request of a client by a DNS agent, and extracting a query domain name and a client source IP (Internet Protocol); the DNS agent obtains a locally stored device ID, wherein the device ID is a 16-byte global unique identifier; constructing an EDNSOPT record containing a device ID and a timestamp; setting an option code as a private value 0xFF01; the data part comprises a 4-byte UNIX timestamp and a 16-byte equipment ID (Identity); adding the EDNSOPT record to an additional part of the DNS request message, and forwarding the EDNSOPT record to a DNS server; the DNS server executes a dynamic strategy decision; executing strategy matching on the verified request; and returning the DNS response message to the client through the DNS agent. According to the invention, the uniqueness authentication of the equipment is realized, the accuracy of equipment identification is obviously improved, and a solid foundation is provided for the implementation of a network security policy.

Techniques and architecture are described for abstracting a real physical twin network wherein security policies are mapped as an overlay on a graphical representation of the network topology. The techniques include receiving, at a computing device, a first security policy) for a first network device. The computing device processes the first security policy to generate a plurality of first access control entries. The computing device creates first graph nodes corresponding to the first access control entries. Based at least in part on a processing order of the first security policy on the first network device, the computing device links the first graph nodes into a graph. The computing device displays the graph on a display, wherein the graph is displayed as an overlay on a network topology graph that includes the first network device.

Technique or mechanism in which network security policies are applied close to the source or origin associated with policy decisions. For example. the disclosed technology moves dropped flows from a firewall cluster to a leaf switch based on host location.