Platform data fusion method and system, readable storage medium and electronic device

Abstract

A platform data fusion method, system, readable storage medium and electronic device, the method comprising: a first platform acquires third-party platform data to be processed, and converts the format of the data to be processed into a format recognizable by a second platform; the first platform sends the data to be processed in the converted format to a message queue; when the second platform listens to the data to be processed in the message queue, it acquires the data to be processed in the message queue, analyzes the data to be processed based on its own security analysis system, and sends the analysis result to the message queue; when the first platform listens to the analysis result in the message queue, it acquires and stores the analysis result. In the present application, two platforms do not need to be greatly changed, and decoupling and non-perception fusion can be realized, and the normal business functions of the two platforms will not be affected.

Description

Technical Field

[0001] This invention relates to the field of data processing technology, and in particular to a platform data fusion method, system, readable storage medium, and electronic device. Background Technology

[0002] Situational awareness is a dynamic and holistic ability to understand security risks based on the environment. It is a way to improve the ability to discover, identify, understand, analyze, and respond to security threats from a global perspective, based on security big data.

[0003] As the importance of cybersecurity becomes increasingly apparent, situational awareness is beginning to emerge in the cybersecurity field. To ensure cybersecurity, enterprises deploy situational awareness systems to monitor, identify, and perform security analysis on data from third-party platforms. Generally, multiple departments within an enterprise develop situational awareness systems, each operating as an independent system with different focuses; for example, some may emphasize business capabilities, while others may focus on security analysis.

[0004] However, with the development of the industry, situational awareness systems that focus on developing only one aspect of capabilities can no longer meet customer needs. Customers are increasingly favoring situational awareness systems that are comprehensively developed and feature-rich, encompassing business capabilities, security capabilities, and other functionalities. Based on this demand, new situational awareness systems need to be developed, which results in significant cost waste. Summary of the Invention

[0005] In view of the above situation, it is necessary to provide a platform data fusion method, system, readable storage medium and electronic device to address the problem of cost waste caused by redeveloping a new and fully functional situational awareness system for enterprises that have already deployed situational awareness systems.

[0006] A platform data fusion method, comprising:

[0007] The first platform acquires the data to be processed from the third-party platform and converts the format of the data to be processed into a format that the second platform can recognize;

[0008] The first platform sends the converted data to the message queue;

[0009] When the second platform detects the data to be processed in the message queue, it obtains the data to be processed in the message queue, analyzes the data to be processed based on its own security analysis system, and sends the analysis results to the message queue.

[0010] When the first platform detects the analysis results in the message queue, it acquires and stores the analysis results.

[0011] Furthermore, in the aforementioned platform data fusion method, after the step of acquiring and storing the analysis results, the method further includes:

[0012] The first platform returns the analysis results based on the analysis data request sent by the front end, so that the front end can present the data.

[0013] Furthermore, in the aforementioned platform data fusion method, before the step of the first platform converting the format of the data to be processed into a format recognizable by the second platform, the method further includes:

[0014] The first platform converts the data to be processed into a format that it can recognize through a data converter, then consumes the data and stores the processed data in a local database.

[0015] The step of converting the format of the data to be processed into a format recognizable by the second platform, as described by the first platform, includes:

[0016] The first platform converts the data to be processed in the local database into a format recognizable by the second platform.

[0017] Furthermore, in the aforementioned platform data fusion method, the step of the first platform converting the data to be processed into a format recognizable by its own platform using a data converter includes:

[0018] The first platform converts the data to be processed into XML format using the converter.

[0019] Furthermore, in the aforementioned platform data fusion method, the step of the first platform acquiring the data to be processed from the third-party platform includes:

[0020] The first platform acquires data to be processed from a third-party platform collected by the data collector. The data collector collects the data to be processed by calling the third-party data interface of the first platform, or by collecting the data to be processed pushed by the third-party platform.

[0021] Furthermore, in the aforementioned platform data fusion method, the first platform includes multiple situation monitoring modules, and the first platform monitors the data of the third-party platform through each of the situation monitoring modules.

[0022] The present invention also provides a platform data fusion system, comprising a first platform and a second platform, wherein,

[0023] The first platform is used for:

[0024] The system acquires data to be processed from a third-party platform, converts the format of the data to be processed into a format recognizable by the second platform, sends the converted data to a message queue, and acquires and stores the analysis results when the first platform listens to the analysis results in the message queue.

[0025] The second platform is used to: when it detects the data to be processed in the message queue, obtain the data to be processed in the message queue, analyze the data to be processed based on its own security analysis system, and send the analysis results to the message queue.

[0026] Furthermore, in the aforementioned platform data fusion system, the first platform is also used for:

[0027] Based on the analysis data request sent by the front end, the analysis results are returned so that the front end can present the data.

[0028] Furthermore, the aforementioned platform data fusion system also includes a data converter, and the first platform is further used for:

[0029] After the data to be processed is converted into a format that the platform can recognize by the data converter, it is consumed and the processed data is stored in the local database.

[0030] The step of converting the format of the data to be processed into a format recognizable by the second platform, as described by the first platform, includes:

[0031] The data to be processed in the local database is converted into a format recognizable by the second platform.

[0032] Furthermore, the aforementioned platform data fusion system also includes a data collector, and the steps for the first platform to acquire data to be processed from a third-party platform include:

[0033] The first platform acquires data to be processed from a third-party platform collected by the data collector. The data collector collects the data to be processed by calling the third-party data interface of the first platform, or by collecting the data to be processed pushed by the third-party platform.

[0034] The present invention also provides a computer-readable storage medium having a program stored thereon, which, when executed by a processor, implements any of the methods described above.

[0035] The present invention also provides an electronic device, including a memory, a processor, and a program stored in the memory and executable on the processor, wherein the processor executes the program to implement the method described in any of the above-mentioned embodiments.

[0036] This invention uses message queues to synchronize and share data between two platforms, and achieves the integration of the two platforms into a single system by reusing their functions and interfaces. In this invention, the two platforms can achieve decoupling and seamless integration without requiring significant modifications, and their normal business functions will not be affected. Attached Figure Description

[0037] Figure 1 This is a flowchart of the platform data fusion method in the first embodiment of the present invention;

[0038] Figure 2 This is a structural block diagram of the platform data fusion system in the second embodiment of the present invention;

[0039] Figure 3 This is a flowchart of the platform data fusion method in the second embodiment of the present invention;

[0040] Figure 4 This is a timing diagram of platform data fusion in an embodiment of the present invention;

[0041] Figure 5 This is a structural block diagram of the platform data fusion system in the third embodiment of the present invention;

[0042] Figure 6 This is a schematic diagram of the structure of the electronic device in the first embodiment of the present invention.

[0043] The following detailed description, in conjunction with the accompanying drawings, will further illustrate the present invention. Detailed Implementation

[0044] To make the objectives, technical solutions, and advantages of this application clearer, the application is described and illustrated below with reference to the accompanying drawings and embodiments. It should be understood that the specific embodiments described herein are merely illustrative and not intended to limit the scope of this application. All other embodiments obtained by those skilled in the art based on the embodiments provided in this application without inventive effort are within the scope of protection of this application.

[0045] Obviously, the accompanying drawings described below are merely some examples or embodiments of this application. Those skilled in the art can apply this application to other similar scenarios based on these drawings without any inventive effort. Furthermore, it is understood that although the efforts made in this development process may be complex and lengthy, for those skilled in the art related to the content disclosed in this application, any changes to design, manufacturing, or production based on the technical content disclosed in this application are merely conventional technical means and should not be construed as insufficient disclosure of the content of this application.

[0046] In this application, the reference to "embodiment" means that a specific feature, structure, or characteristic described in connection with an embodiment may be included in at least one embodiment of this application. The appearance of this phrase in various places in the specification does not necessarily refer to the same embodiment, nor is it a separate or alternative embodiment that is mutually exclusive with other embodiments. It will be explicitly and implicitly understood by those skilled in the art that the embodiments described in this application may be combined with other embodiments without conflict.

[0047] Unless otherwise defined, the technical or scientific terms used in this application shall have the ordinary meaning understood by one of ordinary skill in the art to which this application pertains. The terms “a,” “an,” “an,” “the,” and similar words used in this application do not indicate quantity limitation and may indicate singular or plural. The terms “comprising,” “including,” “having,” and any variations thereof used in this application are intended to cover non-exclusive inclusion; for example, a process, method, system, product, or device that includes a series of steps or modules (units) is not limited to the listed steps or units, but may also include steps or units not listed, or may include other steps or units inherent to these processes, methods, products, or devices. The terms “connected,” “linked,” “coupled,” and similar words used in this application are not limited to physical or mechanical connections, but may include electrical connections, whether direct or indirect. “Multiple” used in this application refers to two or more. “And / or” describes the relationship between related objects, indicating that three relationships may exist; for example, “A and / or B” can represent: A alone, A and B simultaneously, and B alone. The character " / " generally indicates that the preceding and following objects are in an "or" relationship. The terms "first," "second," and "third" used in this application are merely to distinguish similar objects and do not represent a specific ordering of the objects.

[0048] Most existing internet companies operate with two situational awareness systems: a primary situational awareness system and a secondary situational awareness system. The primary situational awareness system, also known as the older version, boasts powerful business functions relevant to many specialized departments' real-world needs. However, it suffers from a weakness in security analysis capabilities, failing to meet customer expectations. The secondary situational awareness system, the internet-connected version, possesses very strong security analysis capabilities—a crucial feature for specialized departments. However, its core business capabilities are currently weak, lacking many essential functions and failing to meet current customer requirements. Therefore, rapidly integrating these two systems is an urgent issue that needs to be addressed.

[0049] The platform data fusion method in this invention integrates the situational awareness systems of two different departments. Essentially, this fusion combines the business capabilities of the older version of the situational awareness system with the enterprise industry security analysis capabilities of the interconnected version. Furthermore, rapid fusion necessitates interface and function reuse to minimize development complexity.

[0050] Please see Figure 1 The platform data fusion method in the first embodiment of the present invention includes steps S11 to S14.

[0051] Step S11: The first platform obtains the data to be processed from the third-party platform and converts the format of the data to be processed into a format that the second platform can recognize.

[0052] Understandably, this first platform is part of a first situational awareness system. This first situational awareness system may also include multiple situational monitoring modules, such as a vulnerability situational monitoring module (a real-time dashboard displaying the status of system vulnerabilities), an attack situational monitoring module (a real-time dashboard displaying the status of the system under external attacks), a log situational monitoring module (a dashboard displaying the status of the system under external access interfaces), a traffic situational monitoring module (a real-time dashboard displaying the status of the system's incoming and outgoing traffic), and an event situational monitoring module (a real-time dashboard displaying the status of security events occurring in the system). This first platform is used to collect and store data from each situational monitoring module, primarily collecting and storing data on vulnerabilities, events, attacks, traffic, and logs.

[0053] The third-party platform is the object monitored by each situation monitoring module, and the first platform can monitor the data of the third-party platform through each situation monitoring module.

[0054] The second platform is the main part of the second situational awareness system, or in other embodiments of the present invention, the second platform can be understood as the second situational awareness system.

[0055] Furthermore, in one embodiment of the present invention, the first platform collects data from a third-party platform via a data collector. The data collector can actively call third-party data interfaces to collect data from the first platform, for example, it can actively collect data detected by various situation monitoring modules. The data collector can also passively receive data, such as data pushed to it from a third-party platform.

[0056] Understandably, data formats are generally not standardized between platforms. Therefore, after the first platform obtains the data to be processed, it needs to convert the data to the format required by the second platform.

[0057] In step S12, the first platform sends the converted data to the message queue.

[0058] After the first platform completes the data transformation, it sends the data to the Kafka message queue. Kafka is a distributed, high-throughput, and highly scalable message queue system. It is an asynchronous inter-service communication method suitable for serverless and microservice architectures. Messages are stored on the queue until they are processed and deleted. Each message can only be processed once by one user. Message queues can be used to separate heavyweight processing, buffer or batch processing tasks, and alleviate peak workloads.

[0059] Step S13: When the second platform detects the data to be processed in the message queue, it obtains the data to be processed in the message queue, analyzes the data to be processed based on its own security analysis system, and sends the analysis results to the message queue.

[0060] The second platform monitors the message queue in real time. When it detects data to be processed in the message queue, it processes the data and stores it in the local database. Then, it analyzes and judges the data and stores the results in the local database. At the same time, it forwards the data to the message queue Kafka.

[0061] Step S14: When the first platform detects the analysis result in the message queue, it acquires and stores the analysis result.

[0062] The first platform listens to the message queue in real time, and when the first platform detects the analysis result, it stores the analysis result in its own database, thus completing the data fusion between the two platforms.

[0063] This embodiment uses message queues to synchronize and share data between two platforms, and reuses the functions and interfaces of the two platforms to achieve integration into a single system. In this embodiment, the two platforms can achieve decoupling and seamless integration without significant modifications, and the normal business functions of both platforms will not be affected.

[0064] The second embodiment of the present invention also provides a platform data fusion method, which is applied to a platform data fusion system, the data fusion system including a first situational awareness system, a second situational awareness system, a message queue data collector, and a data converter.

[0065] This first situational awareness system monitors information such as organizational information, website system information, and asset information. It mainly includes the following functional modules:

[0066] (1) Hazard Status: This is a real-time display of the hazard status of the monitoring system on a large screen. Its main functions include:

[0067] The latest hidden dangers include: top 10 statistics by type, such as sensitive directories, missing secure attributes in session cookies (data stored on the user's local terminal), cross-scripting, etc.; statistics on specific hidden dangers such as Struts2 (an open-source framework) and webshell (a web management tool); statistics on the latest hidden dangers across all data sources; real-time alerts and lists of the latest hidden dangers; trends in the number of the latest hidden dangers; statistics on the regions where the latest hidden dangers are located; statistics on the industries to which the websites with the latest hidden dangers belong; and the top 10 systems with the latest hidden dangers.

[0068] (2) Attack Status: This is a large screen that monitors the real-time situation of external attacks on the system. Its main functions include: statistics on attack data sources; statistics on attack types; latest attack alerts and the latest attack list; latest attack trends; top 10 attacked systems; distribution of attack types; statistics on the distribution of foreign and domestic attack regions; top 10 attacking IPs and top 10 attacked IPs.

[0069] (3) Log Status: This is the monitoring system's awareness of external access interfaces. Its main functions include: Top 10 IPs accessing the system; Top 10 URLs accessing the system; Top 20 users accessing the system; Statistics on the number of abnormal interface accesses; User access trends; System access trends; Interface access trends.

[0070] (4) Traffic Status: A large screen for monitoring the real-time inbound and outbound traffic of the system. Its main functions include: ranking of traffic to the system; ranking of traffic to URLs (Uniform Resource Locator); traffic trend of the system; traffic trend of URLs to the system; abnormal traffic alarms; and a list of real-time traffic monitoring of the system.

[0071] (5) Event Status: This is a real-time awareness screen for security events monitored by the system. Its main functions include: total number of events; event type distribution statistics; event trends; event area distribution; evidence collection events; latest event alarms and latest event list;

[0072] (6) First platform: mainly for collecting and storing data such as potential risks, events, attacks, traffic and logs.

[0073] The first situational awareness system includes the following functional modules:

[0074] (1) Model management: In specific implementation, multiple models can be created to collide alarm data and obtain the desired data results. When adding a model, you can choose a model type (such as rule model, correlation model, statistical model, intelligence model, AI model) to create it.

[0075] (2) Traffic trends, mainly used for analysis, including today's total inbound traffic and real-time traffic, today's total outbound traffic and real-time traffic, website area visits, visitor IP ranking and traffic trends.

[0076] (3) Cyberspace, mainly used to form a cyberspace IP map based on the initial IP;

[0077] (4) Analysis and judgment, mainly used to analyze the current basic situation of an IP, attack chain, access relationship, behavior profile, service port, vulnerability, fingerprint information, etc.

[0078] (5) Tracing and source tracking is mainly used for the management of clues, rule management, and the analysis of data results and the tracking of attack trajectories based on the above clues and rules;

[0079] (6) Intelligence analysis, mainly used for intelligence analysis based on IP, domain name, file hash value, email, etc.

[0080] Specifically, such as Figure 3 and Figure 4 As shown, the data fusion method of this platform includes steps S21 to S27.

[0081] Step S21: The data collector collects the data to be processed from the third-party platform and sends it to the data converter.

[0082] Understandably, there are multiple ways to collect data. Currently, there are two main types of platforms: one is passively receiving data, such as data being pushed to the collector from a third-party platform; the other is actively acquiring data, where the collector actively calls third-party data interfaces to obtain data.

[0083] In step S22, the data converter converts the data to be processed into a format recognizable by the first platform and then sends it to the first platform.

[0084] When the data collector receives or acquires data, it forwards it to the data converter. The data converter converts the data according to the format required by the first platform. This format can be dynamically configured, for example, it can be configured to convert according to XML format.

[0085] Step S23: The first platform consumes the data to be processed, stores the processed data in a local database, and then converts the format of the data to be processed into a format recognizable by the second platform.

[0086] Step S24: The first platform sends the converted data to the message queue.

[0087] Once the data converter has completed the format conversion, it sends the converted data to the corresponding data receiving interface of the first platform. This interface then sends the data to the local message queue of the first platform. The local message queue of the first platform consumes and processes the data, and then performs data storage and ingestion operations. After ingestion, the data is converted to the format required by the second platform, and then sent to the message queue Kafka.

[0088] Step S25: When the second platform detects the data to be processed in the message queue, it obtains the data to be processed in the message queue and analyzes the data to be processed based on its own security analysis system.

[0089] Step S26: The second platform sends the analysis results to the message queue.

[0090] The second platform is the main part of the second situational awareness system, such as the data processor of the second situational awareness system. When the second platform listens for data to be processed in the message queue Kafka, it first performs unified processing of the raw data and puts it into the database. Then, it analyzes and judges the data to be processed, stores the analysis results in the local database, and forwards the data to the message queue Kafka.

[0091] Step S27: When the first platform detects the analysis result in the message queue, it acquires and stores the analysis result.

[0092] When the first platform receives the analysis results in the message queue, it inputs the analysis data into the first platform's local database, at which point the data fusion is complete.

[0093] Furthermore, following step S27 above, the following may also be included:

[0094] Step S28: The first platform returns the analysis results according to the analysis data request sent by the front end, so that the front end can present the data.

[0095] The front end of the first situational awareness system initiates a data request to the X platform. The X platform returns the analysis results as the old situational awareness, and the front end obtains the data to display on the front-end page.

[0096] Please see Figure 5 The platform data fusion system in the third embodiment of the present invention includes a first platform 31 and a second platform 32, wherein...

[0097] The first platform 31 is used for:

[0098] The system acquires data to be processed from a third-party platform 33, converts the format of the data to be processed into a format recognizable by the second platform, sends the converted data to a message queue, and acquires and stores the analysis results when the first platform listens to the analysis results in the message queue.

[0099] The second platform 32 is used to: when it detects the data to be processed in the message queue, obtain the data to be processed in the message queue, analyze the data to be processed based on its own security analysis system, and send the analysis results to the message queue.

[0100] Furthermore, in the aforementioned platform data fusion system, the first platform 31 is also used for:

[0101] Based on the analysis data request sent by the front end, the analysis results are returned so that the front end can present the data.

[0102] Furthermore, the aforementioned platform data fusion system also includes a data converter 34, and the first platform 31 is further used for:

[0103] After the data converter 34 converts the data to be processed into a format that its own platform can recognize, it is consumed and the processed data is stored in the local database.

[0104] The step of converting the format of the data to be processed into a format recognizable by the second platform 32, as described by the first platform 31, includes:

[0105] The data to be processed in the local database is converted into a format recognizable by the second platform 32.

[0106] Furthermore, the aforementioned platform data fusion system also includes a data collector 35, and the steps for the first platform 31 to acquire the data to be processed from the third-party platform 33 include:

[0107] The first platform 31 acquires the data to be processed from the third-party platform 33 collected by the data collector 35. The data collector 35 collects the data to be processed by calling the third-party data interface of the first platform 31, or by collecting the data to be processed pushed by the third-party platform 33.

[0108] The platform data fusion system provided in this embodiment of the invention has the same implementation principle and technical effects as the aforementioned method embodiment. For the sake of brevity, any parts not mentioned in the device embodiment can be referred to the corresponding content in the aforementioned method embodiment.

[0109] It should be noted that the above modules can be functional modules or program modules, and can be implemented through software or hardware. For modules implemented through hardware, the above modules can reside in the same processor; or the above modules can be located in different processors in any combination.

[0110] In addition, combined Figure 1 and Figure 3 The platform data fusion method described in this application embodiment is mainly implemented by an electronic device. This electronic device may be, for example, a controller, a computer device, or a server.

[0111] Figure 6 This is a schematic diagram of the hardware structure of an electronic device according to an embodiment of this application. The electronic device may include a processor 81 and a memory 82 storing computer program instructions.

[0112] Specifically, the processor 81 may include a central processing unit (CPU), an application specific integrated circuit (ASIC), or one or more integrated circuits that can be configured to implement the embodiments of this application.

[0113] The memory 82 may include a mass storage device for data or instructions. For example, and not limitingly, the memory 82 may include a hard disk drive (HDD), a floppy disk drive, a solid-state drive (SSD), flash memory, an optical disk drive, a magneto-optical disk drive, magnetic tape, or a Universal Serial Bus (USB) drive, or a combination of two or more of these. Where appropriate, the memory 82 may include removable or non-removable (or fixed) media. Where appropriate, the memory 82 may be internal or external to a data processing device. In a particular embodiment, the memory 82 is non-volatile memory. In a particular embodiment, the memory 82 includes read-only memory (ROM) and random access memory (RAM). Where appropriate, the ROM may be a mask-programmed ROM, a programmable read-only memory (PROM), an erasable programmable read-only memory (EPROM), an electrically erasable programmable read-only memory (EEPROM), an electrically alterable read-only memory (EAROM), or flash memory, or a combination of two or more of these. Where appropriate, the RAM can be Static Random-Access Memory (SRAM) or Dynamic Random-Access Memory (DRAM). DRAM can be Fast Page Mode Dynamic Random-Access Memory (FPMDRAM), Extended Data Out Dynamic Random-Access Memory (EDODRAM), Synchronous Dynamic Random-Access Memory (SDRAM), etc.

[0114] The memory 82 can be used to store or cache various data files that need to be processed and / or communicated, as well as possible computer program instructions executed by the processor 81.

[0115] The processor 81 implements the platform data fusion method in the above embodiments by reading and executing computer program instructions stored in the memory 82.

[0116] In some embodiments, the data providing terminal and platform may further include a communication interface 83 and a bus 80. For example, Figure 6 As shown, the processor 81, memory 82, and communication interface 83 are connected through bus 80 and complete communication with each other.

[0117] The communication interface 83 is used to enable communication between the various modules, devices, units, and / or equipment in the embodiments of this application. The communication interface 83 can also enable data communication with other components such as external devices, image / data acquisition devices, databases, external storage, and image / data processing workstations.

[0118] Bus 80 includes hardware, software, or both, that couples components of a corresponding device together. Bus 80 includes, but is not limited to, at least one of the following: data bus, address bus, control bus, expansion bus, and local bus. For example, and not as a limitation, bus 80 may include an Accelerated Graphics Port (AGP) or other graphics bus, an Extended Industry Standard Architecture (EISA) bus, a Front Side Bus (FSB), a Hyper Transport (HT) interconnect, an Industry Standard Architecture (ISA) bus, an InfiniBand interconnect, a Low Pin Count (LPC) bus, a memory bus, a Micro Channel Architecture (MCA) bus, a Peripheral Component Interconnect (PCI) bus, a PCI-Express (PCI-X) bus, a Serial Advanced Technology Attachment (SATA) bus, a Video Electronics Standards Association Local Bus (VLB) bus, or other suitable buses, or a combination of two or more of these. Where appropriate, bus 80 may include one or more buses. Although specific buses are described and illustrated in the embodiments of this application, this application considers any suitable bus or interconnection.

[0119] Furthermore, in conjunction with the platform data fusion method in the above embodiments, this application embodiment can provide a computer-readable storage medium for implementation. This computer-readable storage medium stores computer program instructions; when executed by a processor, these computer program instructions implement any of the platform data fusion methods in the above embodiments.

[0120] The technical features of the above embodiments can be combined in any way. For the sake of brevity, not all possible combinations of the technical features in the above embodiments are described. However, as long as there is no contradiction in the combination of these technical features, they should be considered to be within the scope of this specification.

[0121] The embodiments described above are merely illustrative of several implementation methods of this application, and while the descriptions are relatively specific and detailed, they should not be construed as limiting the scope of the invention patent. It should be noted that those skilled in the art can make various modifications and improvements without departing from the concept of this application, and these all fall within the protection scope of this application. Therefore, the protection scope of this patent application should be determined by the appended claims.

Claims

1. A method for platform data fusion, the method comprising: The method comprises the following steps: The first platform obtains the to-be-processed data of the third-party platform, and converts the to-be-processed data into a format recognizable by the first platform through a data converter, and then performs consumption processing, and stores the to-be-processed data after the consumption processing in a local database; The first platform converts the to-be-processed data in the local database into a format recognizable by the second platform; the first platform comprises a plurality of situation monitoring modules, and the first platform monitors the data of the third-party platform through each of the situation monitoring modules; the plurality of situation monitoring modules comprise an attack situation monitoring module and a traffic situation monitoring module; The first platform sends the to-be-processed data in the converted format to a message queue; When the second platform listens to the to-be-processed data in the message queue, the second platform obtains the to-be-processed data in the message queue, analyzes the to-be-processed data based on a security analysis system of the second platform, and sends the analysis result to the message queue; When the first platform listens to the analysis result in the message queue, the first platform obtains and stores the analysis result.

2. The method of claim 1, wherein, After the step of obtaining and storing the analysis result, the method further comprises the following steps: The first platform returns the analysis result according to an analysis data request sent by a front end, so that the front end performs data presentation.

3. The method of claim 2, wherein, The step of converting the to-be-processed data into a format recognizable by the first platform through a data converter comprises the following steps: The first platform converts the to-be-processed data into an xml format through the converter.

4. The method of claim 1, wherein, The step of obtaining the to-be-processed data of the third-party platform by the first platform comprises the following steps: The first platform obtains the to-be-processed data of the third-party platform collected by a data collector, and the data collector collects the to-be-processed data by calling a third-party data interface of the first platform, or collects the to-be-processed data pushed by the third-party platform.

5. A platform data fusion system, characterized by, The method comprises the following steps: The first platform comprises a plurality of situation monitoring modules, and the plurality of situation monitoring modules comprise an attack situation monitoring module and a traffic situation monitoring module; The first platform is used for obtaining to-be-processed data of a third-party platform, and converting the to-be-processed data into a format recognizable by the first platform through a data converter, and then performing consumption processing; The first platform stores the to-be-processed data after the consumption processing in a local database; The first platform is further used for detecting the data of the third-party platform through each of the situation monitoring modules; The first platform is further used for converting the to-be-processed data in the local database into a format recognizable by the second platform, sending the to-be-processed data in the converted format to a message queue, and obtaining and storing the analysis result when the first platform listens to the analysis result in the message queue; The second platform is used for: when listening to the to-be-processed data in the message queue, obtaining the to-be-processed data in the message queue, analyzing the to-be-processed data based on a security analysis system of the second platform, and sending the analysis result to the message queue.

6. The platform data fusion system of claim 5, wherein, The first platform is further used for: According to an analysis data request sent by a front end, the analysis result is returned to enable the front end to perform data presentation.

7. A computer-readable storage medium having stored thereon a program, characterized in that, The program, when executed by a processor, implements the method of any one of claims 1 to 4.

8. An electronic device comprising a memory, a processor, and a program stored in the memory and executable on the processor, characterized by The program, when executed by a processor, implements the method of any one of claims 1 to 4.

Images