Network security product multi-source interoperation method and system, storage medium and equipment
By building a multi-source interoperability architecture in the field of security technology, the problems of isolation and lack of linkage of traditional security products have been solved, and the multi-source interoperability and overall efficiency of security products have been improved.
Patent Information
- Application Number
- CN202411698715.9
- Authority / Receiving Office
- CN · China
- Patent Type
- Applications(China)
- Current Assignee / Owner
- Filing Date
- 2024-11-26
- Publication Date
- 2025-02-25
AI Technical Summary
Among the existing security technologies, traditional multi-source security products have isolated functions and lack linkage mechanisms, making it difficult to adapt to complex and changeable network security environments, resulting in lagging security response and inefficient efficiency.
By building a multi-source interoperability architecture, interoperability is divided into a driver layer, a data layer and a control layer to achieve deep integration and linkage between security products. The driver layer encapsulates the driver application of security products, the data layer builds multi-source interoperable data space, the control layer configures data control policies, automatically calls registration functions, and schedules security products.
It realizes multi-source interoperability of security products, improves the overall efficiency of security products, enhances the ability to automatically identify threats and trigger defense mechanisms, and promotes cross-platform and cross-product collaborative operations.
Smart Images
Figure CN119520128A_ABST
Abstract
Description
Technical Field
[0001] The present application belongs to the field of network security technology, and in particular, relates to a multi-source interoperability method, system, storage medium and device for network security products. Background Art
[0002] In the existing security technology field, the application of traditional multi-source security products faces significant limitations and challenges. These products often focus on in-depth mining of a single functional area, such as focusing on the detailed collection and analysis of logs, or only performing basic security policy configuration. However, this functional isolation and segmentation not only limits the overall effectiveness of security products, but also makes it difficult to adapt to the current complex and changing network security environment.
[0003] From the perspective of log collection, although traditional products can capture detailed records of network activities, they lack automated intelligent analysis and instant response capabilities. This means that even if the system captures potential threat signals, it cannot quickly trigger the corresponding defense mechanism, resulting in delayed and inefficient security response. In addition, the isolated storage and analysis of log data also limits cross-product and cross-domain information sharing and collaborative combat capabilities.
[0004] On the other hand, although basic strategy security products, such as firewalls and intrusion detection systems, can block known threats to a certain extent, their static defense strategies are difficult to cope with rapidly evolving network attack methods. More importantly, there is a lack of effective linkage mechanism between these products, resulting in serious information islands within the security system, making it difficult to form a unified defense system.
[0005] In order to solve the above problems, the industry urgently needs an innovative security solution that can break down product barriers and achieve deep integration and linkage of multi-source security products. This solution not only needs to have powerful collection and analysis capabilities, but also needs to be able to automatically identify threats, trigger defense mechanisms, and achieve cross-platform and cross-product collaborative operations. At the same time, in order to ensure the compatibility, stability and scalability of the solution, it is also necessary to formulate unified standards and specifications to promote interoperability and compatibility between products, and strengthen cooperation and communication between defense networks. Summary of the invention
[0006] In response to the above-mentioned technical problems existing in the prior art, the present application provides a method, system, storage medium and device for multi-source interoperability of network security products. By proposing the construction of a multi-source interoperability architecture, the interoperability is divided into a driver layer, a data layer and a control layer, thereby realizing multi-source interoperability of security products and improving the overall performance of security products.
[0007] In order to achieve the above-mentioned purpose, the first technical solution adopted in this application is: to provide a multi-source interoperability method for network security products, including: encapsulating the driver application of the security product through the driver layer to realize communication with the security product; constructing a multi-source interoperability data space through the data layer, and maintaining data tables and function tables; and configuring data control strategies through the control layer, automatically calling registration functions, and scheduling the interoperability of security products.
[0008] The second technical solution adopted in this application is: to provide a multi-source interoperable system for network security products, including: a driver layer, which encapsulates the driver application of the security product to achieve communication with the security product; a data layer, which builds a multi-source interoperable data space and maintains data tables and function tables; a control layer, which configures data control strategies, automatically calls registration functions, and schedules the interoperability of security products.
[0009] The third technical solution adopted in the present application is: providing a computer-readable storage medium storing computer instructions, wherein the computer instructions are operated to execute the multi-source interoperability method of network security products in solution one.
[0010] The fourth technical solution adopted in the present application is: to provide a computer device, which includes a processor and a memory, the memory stores computer instructions, wherein the processor operates the computer instructions to execute the multi-source interoperability method of network security products in solution one.
[0011] The beneficial effects that can be achieved by the technical solution of the present application are as follows: the present application proposes to build a multi-source interoperability architecture, divides interoperability into a driver layer, a data layer, and a control layer, adapts to different security products by encapsulating the driver layer, abstracts the data of security product interoperability and scheduling through the data layer, and implements scheduling of security product interoperability through the control layer. It also provides a unified interoperability interface for other clients, thereby realizing multi-source interoperability of security products and improving the overall effectiveness of security products. BRIEF DESCRIPTION OF THE DRAWINGS
[0012] Figure 1 is a schematic diagram of a specific example of a multi-source interoperability architecture in this application;
[0013] Figure 2 It is a flowchart of a specific implementation method of the multi-source interoperability method of the network security product of the present application;
[0014] Figure 3 is a flowchart of a specific example of security product interoperability in this application;
[0015] Figure 4 It is a flowchart of a specific example of the interoperation between the client and the security product in this application;
[0016] Figure 5 It is a schematic diagram of a specific implementation of the multi-source interoperable system of the network security product of the present application. DETAILED DESCRIPTION
[0017] The preferred embodiments of the present application are described in detail below in conjunction with the accompanying drawings so that the advantages and features of the present application can be more easily understood by those skilled in the art, thereby making a clearer and more definite definition of the protection scope of the present application.
[0018] Existing technologies for achieving interoperability of network security devices rely more on developers to interface different security products, which limits the overall effectiveness of security products and makes it difficult to adapt to the current complex and changing network security environment.
[0019] Due to the different business scenarios in different industries, different enterprises, and even within the same enterprise, the requirements and environment configurations for security products are different, resulting in extremely complex development challenges in realizing the linkage function between security products. This includes but is not limited to solving compatibility issues between different products, ensuring stability and reliability during the linkage process, and maintaining continuous updating and expansion of linkage functions as business development and technology evolution to meet changing security needs.
[0020] In order to solve the above problems, this application aims to propose a new type of multi-source security product linkage technology. By building a multi-source interoperability architecture to integrate the advantageous resources of existing security products, multi-source interoperability of network security products and comprehensive upgrade and intelligent transformation of the security defense system can be achieved. This technology will break through the functional limitations of traditional security products and bring new changes to the field of network security.
[0021] Figure 1 is a schematic diagram of a specific example of the multi-source interoperability architecture in this application.
[0022] like Figure 1 As shown, the multi-source interoperability architecture in this application divides interoperability into driver layer, data layer and control layer. The driver layer has a built-in driver for each security product; the data layer is a data abstraction for the interoperability and scheduling of all security products, maintaining data tables and function tables; the control layer, as the core of interoperability, implements the scheduling of security product interoperability.
[0023] Figure 2 It is a flowchart of a specific implementation method of the multi-source interoperability method of the network security product of the present application.
[0024] exist Figure 2 In a specific implementation shown, the network security product multi-source interoperability method of the present application includes process S201, encapsulating the driver application of the security product through the driver layer to achieve communication with the security product.
[0025] In this specific implementation, a driver layer is proposed to encapsulate driver applications of security products and support registration of various security products in the driver layer. The driver layer can provide ready-to-use interface services by shielding the underlying interface implementation logic.
[0026] Figure 3 It is a flowchart of a specific example of security product interoperability in this application.
[0027] In a specific embodiment of the present application, the driver application of the security product is encapsulated by the driver layer to achieve communication with the security product, including: registering the driver application of the security product and configuring the access policy of the security product to achieve communication between the security product and the driver layer.
[0028] In this specific embodiment, the driver layer registers the driver application of the security product, such as Figure 3 As shown. The access policy of the security product includes: the logical name of the security product, the physical address, IP address, port information of the security product, and the authentication information of the security product. The driver layer saves the physical address, IP address, port information of the security product, and the mapping relationship between the logical name and the physical address. The authentication information is the authorization information of the security product associated with the identification data.
[0029] In a specific example of the present application, the driver layer can provide a ready-to-use interface service by shielding the underlying interface implementation logic.
[0030] In a specific example of the present application, the driver layer encapsulation protocol processing module can automatically call the corresponding driver to process the task request of the security product according to the security product policy configuration protocol information.
[0031] In a specific example of the present application, Figure 3 As shown, the driver layer is responsible for linking the request tasks of each security product, decomposing them and distributing them to the data layer of this application.
[0032] In a specific embodiment of the present application, the driver application of the security product is encapsulated by the driver layer to achieve communication with the security product, and also includes: using the driver layer to receive task data of multiple security products, and abstracting the task data, decomposing it into action data and parameter data, and after completing the mapping and conversion, transmitting the result to the data layer for processing; and issuing instructions of multiple security products to the corresponding security products through the driver layer for execution.
[0033] In this specific embodiment, Figure 3As shown, the driver layer receives task requests from multiple security products, abstracts and decomposes the task data, and transmits the results to the data layer for processing after mapping and conversion. The driver layer can also issue instructions to multiple security products. The control information processed by the control layer and the data layer can also be issued through the driver layer to the corresponding security products for execution.
[0034] exist Figure 2 In a specific implementation shown, the network security product multi-source interoperability method of the present application includes process S202, constructing a multi-source interoperability data space through a data layer, and maintaining a data table and a function table.
[0035] In this specific implementation, a data layer is proposed for abstracting data for interoperation and scheduling of all security products and maintaining data tables and function tables.
[0036] In a specific embodiment of the present application, a multi-source interoperable data space is constructed through a data layer, including: analyzing data of a heterogeneous driver layer, parsing and mapping the heterogeneous data into metadata, and saving the parsed data into a data domain.
[0037] In a specific embodiment of the present application, a data layer is used to unify data naming and data format to form a metadata service, which includes a directory service, data registration, and access control.
[0038] In this specific embodiment, the metadata service provides data directory service, data registration and access control service. Among them, the directory service is used to maintain and provide a unified logical view of data of various security products, including data concepts, data attributes and data relationships; data registration supports security product data expansion, and when the security product transmits non-standard data, new metadata and data domains can be configured; access control is used to control the reading and writing of data.
[0039] In a specific example of the present application, the data domain adopts a data storage method related to metadata, and each metadata is divided into a data domain. When new metadata is registered, a new data domain is established to ensure the scalability of data storage.
[0040] In a specific example of the present application, the data after the security product data is parsed is stored in the data domain, and the corresponding parameter data is processed according to the security product action data, including adding, modifying, deleting and viewing.
[0041] In a specific example of the present application, the data layer has consistency, and the consistency of the data is ensured by performing verification, and the storage data is ensured not to be lost and / or damaged during transmission.
[0042] exist Figure 2In a specific implementation shown, the network security product multi-source interoperability method of the present application includes process S203, which configures the data control strategy through the control layer, automatically calls the registration function, and schedules the security product interoperability.
[0043] In this specific implementation, a control layer is proposed. The control layer is based on the data layer and automatically calls the registration function by configuring the data control strategy to schedule the security product.
[0044] In a specific embodiment of the present application, data control policies are configured through the control layer, registration functions are automatically called, and security product interoperability is scheduled, including: establishing a security model for data through policy management, monitoring data domains, and automatically linking security scenarios when policies are triggered to achieve automated scheduling of security products.
[0045] In this specific embodiment, the policy management achieves the effect of data monitoring on the data domain by establishing a security model for the data. When the policy is triggered, the security scenario can be automatically linked and the security overclocking can be automatically scheduled.
[0046] In a specific embodiment of the present application, scenario-based applications are encapsulated by a control layer, and an interoperable API is provided to implement scenario-based control, wherein the scenario-based applications include automatic blocking, request filtering, automatic disposal, and automatic protection.
[0047] In this specific embodiment, the control layer has built-in scenario-based applications. Based on security logs, events and rules, the system orchestrates common security scenarios, including automatic blocking, filtering requests, automatic disposal and automatic protection. The control layer provides an interoperability API and the most basic registration function and data operation function for security products. The registration function controls the security product through the driver layer, and the data operation function can control the metadata service and data management of the data layer. Then, through the flexible combination of basic registration functions, the scenario-based control effect is achieved.
[0048] In a specific example of the present application, the basic registration function is summarized from the functions that multiple security products need to interoperate and control.
[0049] In a specific example of the present application, the registration function may send instructions to the security product, and the security product that receives the instructions executes corresponding actions, wherein the encapsulated instruction types include: obtain, insert, and delete.
[0050] Figure 4 It is a flowchart of a specific example of the interoperation between the client and the security product in this application.
[0051] like Figure 4As shown, the present application also provides a unified interoperability interface for the client, through which the authorization information and task request of the security product are sent to the driver layer. The driver layer determines the authorization information and decomposes the task data, and then transmits the determined authorization information and task decomposition results to the data layer. The data layer analyzes and processes the data, and then the control layer monitors the data domain based on the data layer. When there is data triggering, the security scene linkage is performed through scene arrangement and configuration, thereby automatically scheduling the security product and realizing interoperability between the client and the security product.
[0052] In the multi-source interoperability method of network security products of the present application, a multi-source interoperability architecture is proposed to be built, and the interoperability is divided into a driver layer, a data layer and a control layer. The driver layer is encapsulated to adapt to different security products, and the data of the interoperability and scheduling of security products is abstracted through the data layer. The scheduling of the interoperability of security products is realized through the control layer. In addition, a unified interoperability interface is provided for other clients, thereby realizing multi-source interoperability of security products and improving the overall effectiveness of security products.
[0053] Figure 5 It is a schematic diagram of a specific implementation of the multi-source interoperable system of the network security product of the present application.
[0054] exist Figure 5 In a specific embodiment shown, the multi-source interoperable system of the network security product of the present application includes: a driver layer 501, which encapsulates the driver application of the security product to realize communication with the security product; a data layer 502, which builds a multi-source interoperable data space and maintains data tables and function tables; a control layer 503, which configures data control strategies, automatically calls registration functions, and schedules security product interoperability.
[0055] In a specific embodiment of the present application, the driver application of the security product is encapsulated by the driver layer to achieve communication with the security product, including: registering the driver application of the security product and configuring the access policy of the security product to achieve communication between the security product and the driver layer.
[0056] In a specific embodiment of the present application, the driver application of the security product is encapsulated by the driver layer to achieve communication with the security product, and also includes: using the driver layer to receive task data of multiple security products, and abstracting the task data, decomposing it into action data and parameter data, and after completing the mapping and conversion, transmitting the result to the data layer for processing; and issuing instructions of multiple security products to the corresponding security products through the driver layer for execution.
[0057] In a specific embodiment of the present application, a multi-source interoperable data space is constructed through a data layer, including: analyzing data of a heterogeneous driver layer, parsing and mapping the heterogeneous data into metadata, and saving the parsed data into a data domain.
[0058] In a specific embodiment of the present application, a data layer is used to unify data naming and data format to form a metadata service, which includes a directory service, data registration, and access control.
[0059] In a specific embodiment of the present application, data control policies are configured through the control layer, registration functions are automatically called, and security product interoperability is scheduled, including: establishing a security model for data through policy management, monitoring data domains, and automatically linking security scenarios when policies are triggered to achieve automated scheduling of security products.
[0060] In a specific embodiment of the present application, scenario-based applications are encapsulated by a control layer, and an interoperable API is provided to implement scenario-based control, wherein the scenario-based applications include automatic blocking, request filtering, automatic disposal, and automatic protection.
[0061] In the multi-source interoperability system of the network security product of the present application, it is proposed to build a multi-source interoperability architecture, and the interoperability is divided into a driver layer, a data layer, and a control layer. The driver layer is encapsulated to adapt to different security products, and the data of the interoperability and scheduling of security products is abstracted through the data layer. The scheduling of the interoperability of security products is realized through the control layer. In addition, a unified interoperability interface is provided for other clients, thereby realizing multi-source interoperability of security products and improving the overall performance of security products.
[0062] In a specific embodiment of the present application, a computer-readable storage medium stores computer instructions, which are operated to execute the multi-source interoperability method of network security products described in any embodiment. The storage medium can be directly in hardware, in a software module executed by a processor, or in a combination of the two.
[0063] The software modules may reside in RAM memory, flash memory, ROM memory, EPROM memory, EEPROM memory, registers, hard disk, removable disk, CD-ROM or any other form of storage medium known in the art. An exemplary storage medium is coupled to the processor so that the processor can read information from and write information to the storage medium.
[0064] The processor may be a central processing unit (CPU), or other general-purpose processors, digital signal processors (DSP), application-specific integrated circuits (ASIC), field programmable gate arrays (FPGA), or other programmable logic devices, discrete gates or transistor logic, discrete hardware components, or any combination thereof. A general-purpose processor may be a microprocessor, but in an alternative, the processor may be any conventional processor, controller, microcontroller, or state machine. The processor may also be implemented as a combination of computing devices, such as a combination of a DSP and a microprocessor, a plurality of microprocessors, one or more microprocessors combined with a DSP core, or any other such configuration. In an alternative, the storage medium may be integrated with the processor. The processor and the storage medium may reside in an ASIC. The ASIC may reside in a user terminal. In an alternative, the processor and the storage medium may reside in a user terminal as discrete components.
[0065] In a specific embodiment of the present application, a computer device includes a processor and a memory, wherein the memory stores computer instructions, wherein the processor operates the computer instructions to execute the multi-source interoperability method for network security products described in any embodiment.
[0066] In the embodiments provided in the present application, it should be understood that the disclosed devices and methods can be implemented in other ways. For example, the device embodiments described above are only schematic. For example, the division of the units is only a logical function division. There may be other division methods in actual implementation, such as multiple units or components can be combined or integrated into another system, or some features can be ignored or not executed. Another point is that the mutual coupling or direct coupling or communication connection shown or discussed can be through some interfaces, indirect coupling or communication connection of devices or units, which can be electrical, mechanical or other forms.
[0067] The units described as separate components may or may not be physically separated, and the components shown as units may or may not be physical units, that is, they may be located in one place or distributed on multiple network units. Some or all of the units may be selected according to actual needs to achieve the purpose of the solution of this embodiment.
[0068] The above description is only an embodiment of the present application and does not limit the patent scope of the present application. Any equivalent structural transformation made using the contents of the present application specification and drawings, or directly or indirectly applied in other related technical fields, are also included in the patent protection scope of the present application.
Claims
1. A multi-source interoperability method for network security products, characterized in that: include: Encapsulating the driver application of the security product through the driver layer to achieve communication with the security product; Build a multi-source interoperable data space through the data layer and maintain data tables and function tables; as well as The data control strategy is configured through the control layer, and the registration function is automatically called to schedule the interoperability of the security products.
2. The multi-source interoperability method for network security products according to claim 1, characterized in that: The step of encapsulating the driver application of the security product through the driver layer to achieve communication with the security product includes: The driver application of the security product is registered, and the access policy of the security product is configured to achieve communication between the security product and the driver layer.
3. The multi-source interoperability method for network security products according to claim 1, characterized in that: The step of encapsulating the driver application of the security product through the driver layer to achieve communication with the security product further includes: Utilizing the driver layer to receive the task data of the plurality of security products, abstracting the task data, decomposing the task data into action data and parameter data, and transmitting the result to the data layer for processing after completing mapping and conversion; and The driver layer sends multiple instructions of the security products to the corresponding security products for execution.
4. The multi-source interoperability method for network security products according to claim 1, characterized in that: The multi-source interoperable data space is constructed through the data layer, including: Analyze the heterogeneous data of the driver layer, parse and map the heterogeneous data into metadata, and save the parsed data into the data domain.
5. The network security product multi-source interoperability method according to claim 3, characterized in that: The data control strategy is configured through the control layer, the registration function is automatically called, and the interoperation of the security products is scheduled, including: Through policy management, a security model is established for the data, the data domain is monitored, and when the policy is triggered, the security scenario is automatically linked to achieve automatic scheduling of the security product.
6. The network security product multi-source interoperability method according to claim 5, characterized in that: The control layer encapsulates scenario-based applications and provides an interoperable API to implement scenario-based control, wherein the scenario-based applications include automatic blocking, request filtering, automatic disposal, and automatic protection.
7. The network security product multi-source interoperability method according to claim 1, characterized in that: The data layer is used to unify data naming and data format to form metadata services, which include directory services, data registration and access control.
8. A multi-source interoperable system for network security products, characterized in that: include: A driver layer encapsulates driver applications of security products and implements communication with the security products; The data layer builds a multi-source interoperable data space and maintains data tables and function tables; The control layer configures data control policies, automatically calls registration functions, and schedules the interoperability of the security products.
9. A computer-readable storage medium storing computer instructions, wherein the computer instructions are operated to execute the network security product multi-source interoperability method according to any one of claims 1 to 7.
10. A computer device comprising a processor and a memory, wherein the memory stores computer instructions, wherein the processor operates the computer instructions to execute the network security product multi-source interoperability method according to any one of claims 1 to 7.