Method for controlling boundary access control strategy for abnormal behavior discovery, and equipment

Abstract

The invention discloses a method for controlling a boundary access control strategy for abnormal behavior discovery, and equipment. The method comprises the following steps: obtaining access control request data; processing the access control request data by using a pre-determined access control strategy partitioning and sorting model, determining a partition access control strategy corresponding to the access control request data, and recording the access control request data according to the corresponding partition access control strategy, wherein the determination process of the pre-access control strategy partitioning and sorting model comprises the following steps: acquiring a boundary access control strategy; and dividing and sorting the boundary access control strategies according to the access security levels, and determining a partition access strategy corresponding to each partition. The problems of many, coarse and disordered strategies and the like are solved, different types of logs can be recorded for independent strategy matching, the operation and maintenance and auditing efficiency is greatly improved, and meanwhile a good foundation is laid for early discovery and early prevention of abnormal behaviors.

Description

technical field [0001] The invention relates to a control method and equipment for a boundary access control strategy oriented to abnormal behavior discovery, and belongs to the technical field of boundary access control. Background technique [0002] With the deepening of enterprise informatization, network security has become an important prerequisite for ensuring the safe and reliable operation of information systems. Border access control software and hardware devices can control incoming and outgoing traffic according to policies, so as to achieve the purpose of ensuring network security. At this stage, access control policies can be defined in combination with various security requirements to meet the protection needs of different areas. [0003] Boundary access control technology is relatively mature and widely used. Devices from different vendors, different interfaces, and thousands of policies accumulated over time, together with the large number of logs generated,...

AI Technical Summary

Problems solved by technology

In the later stage of application, with the gradual implementation of security requirements, the border device access control policy has been accurate to the port level, but there are many new attack methods, such as implanting a Trojan horse and initiating a reverse connection from the server, although the behavior can also be intercepted by the protection device , but there is no separate log for this type of behavior, these red flags are often submerged in a large number of useless logs, which have a huge impact on the reliability and availability of the device