Cross-domain cooperative network abnormal information sharing method, device, equipment and medium

Abstract

The invention provides a cross-domain cooperative network exception information sharing method and device, equipment and a medium, relates to the technical field of network security, and is used for solving the technical problem that in the prior art, a network exception detection method mostly depends on data in a single domain and is difficult to adapt to security requirements in a cross-domain network environment. The method comprises the following steps: constructing a trust framework based on a plurality of network domains, the trust framework being configured to enable information sharing among the plurality of network domains; unifying a data exchange protocol among the network domains in the trust framework; in response to the abnormality of at least one network domain in the plurality of network domains, performing root cause analysis on the abnormality to obtain an analysis result; and the analysis result is shared to the plurality of network domains through the trust framework, so that the plurality of network domains can respond in real time according to the analysis result.

Description

Technical Field

[0001] The present disclosure relates to the field of network security technology, and more specifically, to a method, device, equipment and medium for sharing abnormal information of a cross-domain collaborative network. Background Art

[0002] With the rapid development of information technology, network attack methods are becoming increasingly complex. Anomaly detection systems within a single network domain often find it difficult to cope with cross-domain network threats. Cross-domain network collaboration has become an important way for enterprises and institutions to share information and integrate resources. However, the complexity of the cross-domain network environment has also brought new challenges to network security management. Network abnormal behaviors, such as data leakage, not only threaten data security, but may also affect the stability and reliability of the entire collaborative network.

[0003] In the process of implementing the concept of the present disclosure, the inventors found that there are at least the following defects in the related technologies: traditional network anomaly detection methods mostly rely on data in a single domain and are difficult to adapt to the security requirements in a cross-domain network environment. Therefore, it is particularly important to develop a method that can realize cross-domain identification of network anomaly information sharing. Summary of the invention

[0004] In view of the above problems, the present invention provides a cross-domain collaborative network anomaly information sharing method, device, equipment and medium to solve the technical problem that the network anomaly detection methods in the prior art mostly rely on data within a single domain and are difficult to adapt to security requirements in a cross-domain network environment.

[0005] One aspect of the present disclosure provides a cross-domain collaborative network anomaly information sharing method, comprising: building a trust framework based on multiple network domains, wherein the trust framework is configured to enable information sharing between the multiple network domains; unifying the data exchange protocol between the network domains in the trust framework; in response to an anomaly occurring in at least one of the multiple network domains, performing a root cause analysis on the anomaly to obtain an analysis result; and sharing the analysis result to the multiple network domains through the trust framework, so that the multiple network domains can respond in real time according to the analysis result.

[0006] According to an embodiment of the present disclosure, building a trust framework based on multiple network domains includes: determining a trust model based on the structure of the multiple network domains; establishing a mutual authentication mechanism based on the trust model, wherein the mutual authentication mechanism is configured to be able to perform identity authentication when the multiple network domains communicate with each other, ensuring that only verified network domains can participate in information sharing.

[0007] According to an embodiment of the present disclosure, the data exchange protocol between various network domains in a unified trust framework includes: establishing a data conversion mechanism, wherein the data conversion mechanism is configured to be able to convert local data of each network domain into a unified JSON format; using encryption technology to encrypt the data transmission channel between multiple network domains to ensure security during data transmission.

[0008] According to an embodiment of the present disclosure, in response to an anomaly occurring in at least one of a plurality of network domains, a root cause analysis is performed on the anomaly, and the analysis results obtained include: when an anomaly is detected in at least one of the plurality of network domains, system logs, network traffic data, and security event reports are collected when the anomaly occurs; the time point when the anomaly occurs and its duration are determined; correlation analysis, behavior analysis, and machine learning are performed on the collected anomaly data to identify the root cause of the anomaly; and analysis results are generated based on the root cause, wherein the analysis results include: event description, scope of impact, analysis process, repair measures, and prevention plans.

[0009] According to an embodiment of the present disclosure, sharing the analysis results to multiple network domains through a trust framework includes: establishing one or more central nodes based on the trust framework; and sharing the analysis results to multiple network domains through the central nodes.

[0010] According to an embodiment of the present disclosure, sharing the analysis results to multiple network domains through a central node includes: pushing the analysis results to other network domains through the central node using a unified API interface; in response to other network domains receiving the analysis results, initiating a response mechanism and updating local protection strategies.

[0011] According to an embodiment of the present disclosure, the method also includes: establishing a monitoring mechanism, wherein the monitoring mechanism is configured to track the effectiveness of cross-domain collaboration through continuous monitoring, and regularly evaluate and optimize collaboration strategies to ensure that the trust framework can adapt to the ever-changing network threat environment.

[0012] Another aspect of the present disclosure provides a cross-domain collaborative network anomaly information sharing device, including: a construction module, used to build a trust framework based on multiple network domains, wherein the trust framework is configured to enable information sharing between multiple network domains; a unification module, used to unify the data exchange protocol between each network domain in the trust framework; an analysis module, used to respond to an anomaly occurring in at least one of the multiple network domains, perform root cause analysis on the anomaly, and obtain an analysis result; a sharing module, used to share the analysis result to multiple network domains through the trust framework, so that the multiple network domains can respond in real time according to the analysis result.

[0013] Another aspect of the present disclosure provides an electronic device, including: one or more processors; and a memory for storing one or more programs, wherein when the one or more programs are executed by the one or more processors, the one or more processors implement the above method.

[0014] Another aspect of the present disclosure provides a computer-readable storage medium storing computer-executable instructions, which are used to implement the above method when executed.

[0015] Another aspect of the present disclosure provides a computer program product, which includes computer executable instructions, and the instructions are used to implement the above method when executed.

[0016] Compared with the prior art, the cross-domain collaborative network abnormal information sharing method, device, equipment and medium provided by the present disclosure have at least the following beneficial effects:

[0017] (1) The cross-domain collaborative network anomaly information sharing method, apparatus, device and medium provided by the present invention establish a cross-domain trust relationship, data sharing mechanism and intelligent decision support system between multiple network domains, so that different network domains can safely and effectively share information and coordinate the processing of network anomalies, thereby solving the technical problem that the network anomaly detection methods in the prior art mostly rely on data within a single domain and are difficult to adapt to the security requirements in a cross-domain network environment.

[0018] (2) The cross-domain collaborative network anomaly information sharing method, device, equipment and medium provided by the present disclosure utilize the root cause analysis method to improve the recognition accuracy and processing efficiency of network anomalies. BRIEF DESCRIPTION OF THE DRAWINGS

[0019] The above and other objects, features and advantages of the present disclosure will become more apparent through the following description of the embodiments of the present disclosure with reference to the accompanying drawings, in which:

[0020] Figure 1 A flowchart of a method for sharing abnormal information in a cross-domain collaborative network according to an embodiment of the present disclosure is schematically shown;

[0021] Figure 2 The overall architecture diagram of the trust framework according to the embodiment of the present disclosure is schematically shown;

[0022] Figure 3 A schematic diagram of a structure of a cross-domain collaborative network abnormal information sharing device according to an embodiment of the present disclosure is shown; and

[0023] Figure 4 The structural block diagram of an electronic device suitable for implementing a method for sharing abnormal information of a cross-domain collaborative network according to an embodiment of the present disclosure is schematically shown. DETAILED DESCRIPTION

[0024] Hereinafter, embodiments of the present disclosure will be described with reference to the accompanying drawings. However, it should be understood that these descriptions are exemplary only and are not intended to limit the scope of the present disclosure. In the following detailed description, for ease of explanation, many specific details are set forth to provide a comprehensive understanding of the embodiments of the present disclosure. However, it is apparent that one or more embodiments may also be implemented without these specific details. In addition, in the following description, descriptions of known structures and technologies are omitted to avoid unnecessary confusion of the concepts of the present disclosure.

[0025] The terms used herein are only for describing specific embodiments and are not intended to limit the present disclosure. The terms "comprise", "include", etc. used herein indicate the existence of the features, steps, operations and / or components, but do not exclude the existence or addition of one or more other features, steps, operations or components.

[0026] All terms (including technical and scientific terms) used herein have the meanings commonly understood by those skilled in the art unless otherwise defined. It should be noted that the terms used herein should be interpreted as having a meaning consistent with the context of this specification and should not be interpreted in an idealized or overly rigid manner.

[0027] When using expressions such as "at least one of A, B, and C, etc.", they should generally be interpreted according to the meaning of the expression commonly understood by those skilled in the art (for example, "a system having at least one of A, B, and C" should include but is not limited to a system having A alone, B alone, C alone, A and B, A and C, B and C, and / or A, B, C, etc.).

[0028] In the embodiments of the present disclosure, the collection, updating, analysis, processing, use, transmission, provision, disclosure, storage, etc. of the data involved (for example, including but not limited to user personal information) are in compliance with the provisions of relevant laws and regulations, are used for legitimate purposes, and do not violate public order and good morals. In particular, necessary measures are taken for user personal information to prevent illegal access to user personal information data and maintain the security of user personal information, network security, and national security.

[0029] With the rapid development of information technology, network attack methods are becoming increasingly complex. Anomaly detection systems within a single network domain often find it difficult to cope with cross-domain network threats. Cross-domain network collaboration has become an important way for enterprises and institutions to share information and integrate resources. However, the complexity of the cross-domain network environment has also brought new challenges to network security management. Network abnormal behaviors, such as data leakage, not only threaten data security, but may also affect the stability and reliability of the entire collaborative network.

[0030] In the process of implementing the concept of the present disclosure, the inventors found that there are at least the following defects in the related technologies: traditional network anomaly detection methods mostly rely on data in a single domain and are difficult to adapt to the security requirements in a cross-domain network environment. Therefore, it is particularly important to develop a method that can realize cross-domain identification of network anomaly information sharing.

[0031] Based on this, the embodiment of the present disclosure provides a cross-domain collaborative network anomaly information sharing method to solve the technical problem that the network anomaly detection methods in the prior art mostly rely on data in a single domain and are difficult to adapt to the security requirements in a cross-domain network environment. The method includes: building a trust framework based on multiple network domains, wherein the trust framework is configured to enable information sharing between multiple network domains; unifying the data exchange protocol between each network domain in the trust framework; in response to an anomaly in at least one of the multiple network domains, performing root cause analysis on the anomaly to obtain an analysis result; sharing the analysis result to multiple network domains through the trust framework, so that the multiple network domains can respond in real time according to the analysis result.

[0032] The cross-domain collaborative network anomaly information sharing method provided by the embodiments of the present disclosure establishes a cross-domain trust relationship, a data sharing mechanism and an intelligent decision support system between multiple network domains, so that different network domains can safely and effectively share information and coordinate the processing of network anomalies. Therefore, it solves the technical problem that the network anomaly detection methods in the prior art mostly rely on data within a single domain and are difficult to adapt to the security requirements in a cross-domain network environment.

[0033] In order to make the objectives, technical solutions and advantages of the present disclosure more clearly understood, the present disclosure is further described in detail below in conjunction with specific embodiments and with reference to the accompanying drawings.

[0034] Figure 1 The flowchart of the cross-domain collaborative network abnormality information sharing method according to an embodiment of the present disclosure is schematically shown.

[0035] like Figure 1 As shown, the cross-domain collaborative network anomaly information sharing method of this embodiment may include operations S1 to S4.

[0036] In operation S1 , a trust framework is constructed based on multiple network domains, wherein the trust framework is configured to enable information sharing between the multiple network domains.

[0037] To achieve cross-domain collaboration, a trust framework must first be established, for example by using public key infrastructure (PKI) technology to ensure that only verified network domains can participate in information sharing.

[0038] In this embodiment, for example, an access control matrix may be used to represent the authorization relationship between different network domains, where the matrix element Aij Represents the access rights of network domain i to network domain j.

[0039] In operation S2, a data exchange protocol between various network domains in the trust framework is unified.

[0040] Since the various network domain systems involved in the collaboration may use different data formats and standards, it is necessary to develop a unified data exchange protocol or standard, such as using the JSON format for data encapsulation and defining clear metadata tags to ensure data consistency and parsability.

[0041] In this embodiment, for example, a mapping function f:D i →D j To represent the conversion of the data format of network domain i into a format compatible with network domain j.

[0042] In operation S3, in response to an abnormality occurring in at least one of the plurality of network domains, a root cause analysis is performed on the abnormality to obtain an analysis result.

[0043] In this embodiment, when an abnormal behavior or event is detected, the root cause of the problem is found through in-depth investigation and analysis, rather than just the surface phenomenon. The goal of root cause analysis is to eliminate the problem at the source and prevent it from happening again.

[0044] In operation S4, the analysis results are shared with multiple network domains through a trust framework, so that the multiple network domains can respond in real time according to the analysis results.

[0045] After detecting a potential cross-domain anomaly, the participating network domain systems need to coordinate their incident response activities to reduce duplication of work and waste of resources. For example, if one network domain successfully mitigates an attack, relevant information should be immediately shared with other network domains so that they can also take preventive measures.

[0046] In this embodiment, for example, the concept of anomaly score can be introduced to implement the response:

[0047] Score(A)=w1×f1(A)+w2×f2(A)+…+w n ×f n (A)

[0048] Where A represents an alarm or event, and f n represents the characteristic function, w n Indicates the corresponding weight.

[0049] The cross-domain collaborative network anomaly information sharing method provided by the embodiments of the present disclosure establishes a cross-domain trust relationship, a data sharing mechanism and an intelligent decision support system between multiple network domains, so that different network domains can safely and effectively share information and coordinate the processing of network anomalies. Therefore, it solves the technical problem that the network anomaly detection methods in the prior art mostly rely on data within a single domain and are difficult to adapt to the security requirements in a cross-domain network environment.

[0050] According to an embodiment of the present disclosure, operation S1 may construct a trust framework based on multiple network domains, for example, including:

[0051] Determine the trust model based on the structure of multiple network domains;

[0052] Based on the trust model, a mutual authentication mechanism is established, wherein the mutual authentication mechanism is configured to be able to perform identity authentication when multiple network domains communicate with each other, ensuring that only verified network domains can participate in information sharing.

[0053] In this embodiment, first, a suitable trust model is selected according to the structure of the network domain. Common trust models include:

[0054] Hierarchical trust model: There are different trust levels between network domains. Domains with higher trust levels can manage and authorize domains at lower levels.

[0055] Peer-to-peer trust model: Network domains are peers, trust each other, and have no hierarchical relationship.

[0056] Hybrid trust model: combines hierarchical and peer models and is flexibly designed based on specific needs.

[0057] After selecting a suitable trust model, further establish a mutual authentication mechanism for the trust model. For example, by establishing a public key infrastructure (PKI) to support cross-domain identity authentication and encryption. The implementation of PKI usually includes:

[0058] Certificate Authority (CA): Each network domain can have its own CA, or use a common third-party CA. CA is responsible for issuing digital certificates to ensure that entities (users, devices, services) within each network domain have authenticated identities.

[0059] Digital certificate: Use digital certificates to verify the identities of both communicating parties, ensure the authenticity of the message source, and prevent man-in-the-middle attacks.

[0060] Certificate chain verification: When two network domains communicate, the receiver confirms the sender's identity by verifying its certificate chain.

[0061] Establishing a trust framework between multiple network domains and configuring a mutual authentication mechanism is to ensure that the communication and interaction between different network domains are secure and prevent unauthorized access.

[0062] According to an embodiment of the present disclosure, the data exchange protocol between various network domains in the unified trust framework in operation S2 may include, for example:

[0063] A data conversion mechanism is established, wherein the data conversion mechanism is configured to be able to convert local data of each network domain into a unified JSON format.

[0064] Encryption technology is used to encrypt data transmission channels between multiple network domains to ensure the security of data transmission.

[0065] In this embodiment, the JSON format is selected as the standardized data format of the trust framework.

[0066] JSON (JavaScript Object Notation) is a lightweight data exchange format suitable for data transmission between different systems and programming languages. Choosing JSON as the data format ensures:

[0067] Human readability: JSON format is intuitive and concise, making it easy for developers to understand and debug.

[0068] Cross-language compatibility: Almost all programming languages ​​provide support for JSON, allowing different systems to easily parse and generate JSON data.

[0069] When using JSON as a standardized data format for cross-domain systems, standardized rules need to be defined and agreed upon in advance. Specific steps may include:

[0070] Define the data model: Define the fields and their meanings of the JSON structure according to the system requirements. For example, in network anomaly detection, it may be necessary to include timestamps, source addresses, destination addresses, anomaly types, etc.

[0071] Field standardization: Ensure that all network domains use the same field names, data types, and units. For example, the time format should be standardized to ISO 8601 (UTC time), the IP address should use the standard IPv4 or IPv6 format, and the traffic rate should use Mbps.

[0072] Metadata tags: Add necessary metadata tags to each data block to ensure that different systems can quickly identify and parse the data. For example, you can add metadata such as message type and version number to each JSON message.

[0073] In addition, in order to ensure the security of data exchange between different network domains, secure communication protocols and encryption measures are adopted, for example, HTTP (Hyper Text Transfer Protocol) or HTTPS (Hyper Text Transfer Protocol Secure) protocol encrypted with SSL / TLS (Secure Sockets Layer and Transport Layer Security) is used to isolate and protect the data transmission process.

[0074] In this embodiment, for example, an encryption algorithm E:M×K→C may be used to represent a process in which a message M is encrypted into a ciphertext C using a key K.

[0075] According to an embodiment of the present disclosure, in operation S3, in response to an abnormality occurring in at least one of the multiple network domains, a root cause analysis is performed on the abnormality, and the analysis result obtained includes, for example:

[0076] When an anomaly is detected in at least one of the multiple network domains, collect system logs, network traffic data, and security event reports when the anomaly occurs;

[0077] Determine when the anomaly occurred and its duration;

[0078] Perform correlation analysis, behavior analysis, and machine learning on the collected abnormal data to identify the root cause of the abnormality; generate analysis results based on the root cause, where the analysis results include: event description, impact range, analysis process, repair measures, and prevention plans.

[0079] In this embodiment, when an anomaly is detected, sufficient data needs to be collected to support root cause analysis, for example:

[0080] Capture logs and monitor data: Collect system logs, network traffic data, security incident reports, etc. when anomalies occur. For example, network intrusion detection systems (IDS), firewall logs, server logs, etc. can provide preliminary anomaly information.

[0081] Document the timeline: Identify the exact point in time when the anomaly occurred and its duration, which helps narrow down the possible root causes in subsequent steps.

[0082] After the data is collected, anomalies are initially classified to help quickly exclude events that are obviously irrelevant or unimportant. Classification can be based on the following methods:

[0083] Categorize by anomaly type: such as DDoS (Distributed Denial of Service Attack) attacks, malware infections, configuration errors, hardware failures, etc. This step helps to identify issues that require priority attention.

[0084] Classify by impact scope and severity: such as whether it affects key business functions and how far the anomaly has spread.

[0085] Classify by exception source: such as from external attackers, internal user errors, third-party service exceptions, etc.

[0086] The classified data is further subjected to association analysis, behavior analysis, and machine learning to identify the root causes of the anomalies, such as:

[0087] Fault tree analysis (FTA) is used to build a fault tree to analyze potential causes at different levels and gradually trace back to the most fundamental source. The idea of ​​FTA is to "infer the cause from the result". For example, if the server is inaccessible, it may be caused by network congestion, DNS (Domain Name System) failure or application crash. By checking layer by layer, it is finally determined which link has a problem.

[0088] After the root cause is confirmed, a solution is developed and implemented to completely eliminate the problem. For example, if the root cause is a technical problem, such as a configuration error, software vulnerability, or hardware failure, it needs to be repaired or replaced immediately. If the root cause involves human error or management issues, similar problems can be prevented from happening again by optimizing operating procedures, increasing monitoring measures, or conducting personnel training.

[0089] The entire process of root cause analysis is recorded and a root cause analysis report is generated, including event description, impact scope, analysis process, root cause, repair measures and prevention plans. This report is then shared with all network domains to quickly identify and handle similar issues in the future.

[0090] The cross-domain collaborative network anomaly information sharing method provided by the embodiment of the present disclosure utilizes a root cause analysis method to improve the recognition accuracy and processing efficiency of network anomalies.

[0091] According to an embodiment of the present disclosure, operation S4 of sharing the analysis results to multiple network domains through a trust framework may include, for example:

[0092] Based on the trust framework, establish one or more central nodes;

[0093] The analysis results are shared to multiple network domains through the central node.

[0094] According to an embodiment of the present disclosure, sharing the analysis results to multiple network domains through a central node includes:

[0095] Push analysis results to other network domains through the central node and unified API interface;

[0096] In response to other network domains receiving the analysis results, a response mechanism is initiated and a local protection strategy is updated.

[0097] In this embodiment, one or more central nodes can be set up to share and synchronize cross-domain key information using a unified API (Application Programming Interface). These central nodes will be responsible for collecting, aggregating and distributing abnormal indicators, threat intelligence and repair strategies.

[0098] In this embodiment, for example, a state synchronization equation may be established:

[0099] S j =S i +Lag(t)

[0100] Among them, S j and S i represents the states of two different network domains at time t, and Lag(t) represents the state synchronization lag function introduced due to communication delay.

[0101] Furthermore, in this embodiment, a cooperation strategy can also be designed to define when and how to share information between different network domains, and artificial intelligence and machine learning algorithms can be combined to jointly analyze data from different network domains to intelligently identify and respond to cross-domain network anomalies.

[0102] For example, a decision function D:F×I→R is used to represent how to make a response decision R based on the feature set F and input information I.

[0103] During the cross-domain data sharing process, all shared personal information must be properly processed, such as de-identification or anonymization, to protect user privacy.

[0104] In this embodiment, for example, the probability X of data leakage under a given protection measure Y can be represented by a probability model P(X|Y).

[0105] According to an embodiment of the present disclosure, the cross-domain collaborative network abnormality information sharing method may also include:

[0106] Establish a monitoring mechanism that is configured to track the effectiveness of cross-domain collaboration through continuous monitoring, and regularly evaluate and optimize collaboration strategies to ensure that the trust framework can adapt to the ever-changing cyber threat environment.

[0107] In this embodiment, the system can be continuously monitored for performance and security assessment, and strategies can be adjusted in time to deal with new threats. For example, the utility function U:M×O→U is used to quantify the effect or utility U of the monitoring behavior M in the face of an attack or anomaly O.

[0108] The cross-domain collaborative network anomaly information sharing method provided by the embodiment of the present disclosure can achieve broader and deeper security protection through the above method, and improve the security and responsiveness of the entire network ecosystem.

[0109] Figure 2 The overall architecture diagram of the trust framework according to the embodiment of the present disclosure is schematically shown.

[0110] like Figure 2 As shown, the overall architecture of the trust framework of the embodiment of the present disclosure includes the following parts:

[0111] Network domain: Represented as individual network nodes, such as "data center", "cloud service", "enterprise network", etc.

[0112] Data collection unit: responsible for collecting data from various network domains, including traffic logs, system logs, exception reports, etc.

[0113] Feature Extraction Module: Automatically extract key features from the collected data using advanced pattern recognition techniques.

[0114] Root Cause Analysis Engine: The core of the architecture, which analyzes potential anomalies based on extracted features and historical knowledge base and determines their root causes.

[0115] Cross-domain collaboration component: responsible for security authentication, data exchange and synchronization with external domains.

[0116] Knowledge base: stores known abnormal patterns, security policies, and processed event information.

[0117] Intelligent decision-making processing module: Combines root cause analysis results and cross-domain information to formulate response strategies.

[0118] User Interface (UI): Allows security administrators to monitor status, view alerts, and configure system settings.

[0119] Exception handling and coordination interface: used to communicate and coordinate incident response measures with relevant domains when an anomaly is detected.

[0120] In this embodiment, the cross-domain information sharing and synchronization data flow process between various network domains includes steps such as data collection, transmission, reception and processing, specifically:

[0121] The network domain is the source of data generation, such as data centers, cloud services, enterprise networks, etc. Within each network domain, data cleaning, formatting and preliminary analysis are first performed, and the output data should use a standardized format, such as JSON format, to facilitate cross-domain transmission and processing.

[0122] To ensure data security during transmission, all data needs to be encrypted before transmission. The data flow path can be a direct connection, a VPN (Virtual Private Network) tunnel, or a secure cloud service.

[0123] Data is gathered to the central node for synchronization. The central node can be a dedicated server or cloud platform responsible for collecting and distributing data. Data synchronization can be done in push or pull mode.

[0124] The root cause analysis engine is responsible for in-depth analysis of the received data, including correlation analysis, behavior analysis, machine learning, etc. It identifies potential network anomalies and generates alerts or recommendations.

[0125] The analysis results need to be fed back to each network domain to adjust local security policies, form a closed loop, and improve overall network security protection capabilities.

[0126] The visualization interface provides a graphical interface that displays key indicators, alarms, and network status through a web-based dashboard.

[0127] Generate cybersecurity reports regularly, including event statistics, trend analysis, and improvement suggestions. Reports can be automatically sent to relevant managers or security teams.

[0128] Based on the analysis results, the system can automatically execute predefined response measures. For example, isolate infected terminals, adjust firewall rules, etc. In cases involving multiple network domains, coordinate the response measures of all parties to avoid conflicts. Through shared response strategies and communication channels, collaborative defense is achieved.

[0129] In this embodiment, the detailed operation flow from abnormality detection to visualization and reporting can be as follows:

[0130] 1. Anomaly Detection

[0131] Data collection: Collect key data from various network domains and devices, such as alarm information, network traffic data, etc. The data can include system logs, security logs, firewall logs, IDS (Intrusion Detection System) / IPS (Intrusion Prevention System) alerts, etc.

[0132] Feature extraction: Extract features from the collected data for analysis. Features can include timestamp, source address, destination address, event type, event severity, etc.

[0133] Analysis engine: Use the analysis engine to perform real-time analysis on the extracted features. Analysis methods can include association analysis, behavior analysis, machine learning, etc.

[0134] Anomaly Identification: Based on the analysis results, potential anomalies or threats are identified. Anomalies can be defined as behaviors that do not conform to normal patterns, or events that conform to known threat patterns.

[0135] 2. Incident Response Coordination

[0136] Alert generation: When an anomaly is detected, the system generates an alert and records relevant information. The alert information should include event details, possible impacts, recommended response measures, etc.

[0137] Notification and distribution: Notify relevant personnel or teams of alert information, such as the security operations center or network administrator. Distribution can be done via email, SMS, etc.

[0138] Coordination mechanism: If multiple network domains or teams are involved, activate a coordination mechanism to unify the response. Communicate via conference calls, instant messaging tools, or dedicated collaboration platforms.

[0139] Response execution: Execute corresponding response measures according to the alarm information and the predetermined response plan. Response measures may include isolating infected terminals, blocking malicious IP addresses, updating firewall rules, etc.

[0140] Tracking and feedback: Track the effectiveness of response measures and collect feedback information. Adjust the response plan based on the feedback to optimize future incident responses.

[0141] 3. Visualization and Reporting

[0142] Visualization interface: Provides a graphical interface that displays real-time alarms, event status, and response measures. The interface is based on a web-based dashboard.

[0143] Report generation: Generate incident response reports regularly, including incident statistics, handling process and improvement suggestions. Reports can be automatically sent to relevant managers or security teams.

[0144] Figure 3 The structural block diagram of the cross-domain collaborative network abnormal information sharing device according to an embodiment of the present disclosure is schematically shown.

[0145] like Figure 3As shown, the cross-domain collaborative network abnormality information sharing device 300 of the embodiment of the present disclosure includes: a construction module 310, a unification module 320, an analysis module 330 and a sharing module 340.

[0146] The construction module 310 is used to construct a trust framework based on multiple network domains, wherein the trust framework is configured to enable information sharing between the multiple network domains.

[0147] The unification module 320 is used to unify the data exchange protocols between various network domains in the trust framework.

[0148] The analysis module 330 is used for performing root cause analysis on the anomaly in response to an anomaly occurring in at least one of the multiple network domains to obtain an analysis result.

[0149] The sharing module 340 is used to share the analysis results to multiple network domains through the trust framework, so that the multiple network domains can respond in real time according to the analysis results.

[0150] According to the embodiments of the present invention, any one or more of the modules, submodules, units, and subunits, or at least part of the functions of any one of them can be implemented in one module. According to the embodiments of the present invention, any one or more of the modules, submodules, units, and subunits can be split into multiple modules for implementation. According to the embodiments of the present invention, any one or more of the modules, submodules, units, and subunits can be at least partially implemented as hardware circuits, such as field programmable gate arrays (FPGAs), programmable logic arrays (PLAs), systems on chips, systems on substrates, systems on packages, application specific integrated circuits (ASICs), or can be implemented by hardware or firmware in any other reasonable way of integrating or packaging circuits, or can be implemented in any one of the three implementation methods of software, hardware, and firmware, or in any appropriate combination of any of them. Alternatively, according to the embodiments of the present invention, one or more of the modules, submodules, units, and subunits can be at least partially implemented as computer program modules, and when the computer program modules are run, the corresponding functions can be performed.

[0151] For example, any multiple of the building module 310, the unified module 320, the analysis module 330, and the shared module 340 can be combined in one module / unit / sub-unit for implementation, or any one of the modules / units / sub-units can be split into multiple modules / units / sub-units. Alternatively, at least part of the functions of one or more of these modules / units / sub-units can be combined with at least part of the functions of other modules / units / sub-units and implemented in one module / unit / sub-unit. According to an embodiment of the present disclosure, at least one of the building module 310, the unified module 320, the analysis module 330, and the shared module 340 can be at least partially implemented as a hardware circuit, such as a field programmable gate array (FPGA), a programmable logic array (PLA), a system on a chip, a system on a substrate, a system on a package, an application specific integrated circuit (ASIC), or can be implemented by hardware or firmware such as any other reasonable way of integrating or packaging the circuit, or implemented in any one of the three implementation methods of software, hardware, and firmware, or in any appropriate combination of any of them. Alternatively, at least one of the construction module 310 , the unification module 320 , the analysis module 330 , and the sharing module 340 may be at least partially implemented as a computer program module, and when the computer program module is executed, a corresponding function may be performed.

[0152] It should be noted that the cross-domain collaborative network anomaly information sharing device part in the embodiment of the present disclosure corresponds to the cross-domain collaborative network anomaly information sharing method part in the embodiment of the present disclosure. The description of the cross-domain collaborative network anomaly information sharing device part specifically refers to the cross-domain collaborative network anomaly information sharing method part, which will not be repeated here.

[0153] Figure 4 The structural block diagram of an electronic device suitable for implementing a method for sharing abnormal information of a cross-domain collaborative network according to an embodiment of the present disclosure is schematically shown. Figure 4 The electronic device shown is only an example and should not bring any limitation to the functions and scope of use of the embodiments of the present disclosure.

[0154] like Figure 4As shown, the electronic device 400 according to an embodiment of the present disclosure includes a processor 401, which can perform various appropriate actions and processes according to a program stored in a read-only memory (ROM) 402 or a program loaded from a storage part 408 to a random access memory (RAM) 403. The processor 401 may include, for example, a general-purpose microprocessor (e.g., a CPU), an instruction set processor and / or a related chipset and / or a dedicated microprocessor (e.g., an application-specific integrated circuit (ASIC)), etc. The processor 401 may also include an onboard memory for caching purposes. The processor 401 may include a single processing unit or multiple processing units for performing different actions of the method flow according to an embodiment of the present disclosure.

[0155] In RAM 403, various programs and data required for the operation of electronic device 400 are stored. Processor 401, ROM 402 and RAM 403 are connected to each other via bus 404. Processor 401 performs various operations of the method flow according to the embodiment of the present disclosure by executing the program in ROM 402 and / or RAM 403. It should be noted that the program can also be stored in one or more memories other than ROM 402 and RAM 403. Processor 401 can also perform various operations of the method flow according to the embodiment of the present disclosure by executing the program stored in the one or more memories.

[0156] According to an embodiment of the present disclosure, the electronic device 400 may further include an input / output (I / O) interface 405, which is also connected to the bus 404. The electronic device 400 may further include one or more of the following components connected to the input / output (I / O) interface 405: an input portion 406 including a keyboard, a mouse, etc.; an output portion 407 including a cathode ray tube (CRT), a liquid crystal display (LCD), etc., and a speaker, etc.; a storage portion 408 including a hard disk, etc.; and a communication portion 409 including a network interface card such as a LAN card, a modem, etc. The communication portion 409 performs communication processing via a network such as the Internet. A drive 410 is also connected to the input / output (I / O) interface 405 as needed. A removable medium 411, such as a magnetic disk, an optical disk, a magneto-optical disk, a semiconductor memory, etc., is installed on the drive 410 as needed, so that a computer program read therefrom is installed into the storage portion 408 as needed.

[0157] According to an embodiment of the present disclosure, the method flow according to an embodiment of the present disclosure can be implemented as a computer software program. For example, an embodiment of the present disclosure includes a computer program product, which includes a computer program carried on a computer-readable storage medium, and the computer program contains a program code for executing the method shown in the flowchart. In such an embodiment, the computer program can be downloaded and installed from the network through the communication part 409, and / or installed from the removable medium 411. When the computer program is executed by the processor 401, the above-mentioned functions defined in the system of the embodiment of the present disclosure are executed. According to an embodiment of the present disclosure, the system, equipment, device, module, unit, etc. described above can be implemented by a computer program module.

[0158] The present disclosure also provides a computer-readable storage medium, which may be included in the device / apparatus / system described in the above embodiments; or may exist independently without being assembled into the device / apparatus / system. The above computer-readable storage medium carries one or more programs, and when the above one or more programs are executed, the method according to the embodiment of the present disclosure is implemented.

[0159] According to an embodiment of the present disclosure, the computer-readable storage medium may be a non-volatile computer-readable storage medium. For example, it may include, but is not limited to: a portable computer disk, a hard disk, a random access memory (RAM), a read-only memory (ROM), an erasable programmable read-only memory (EPROM or flash memory), a portable compact disk read-only memory (CD-ROM), an optical storage device, a magnetic storage device, or any suitable combination thereof. In the present disclosure, a computer-readable storage medium may be any tangible medium containing or storing a program that may be used by or in combination with an instruction execution system, apparatus, or device.

[0160] For example, according to an embodiment of the present disclosure, the computer-readable storage medium may include the ROM 402 and / or the RAM 403 described above and / or one or more memories other than the ROM 402 and the RAM 403 .

[0161] The embodiments of the present disclosure also include a computer program product, which includes a computer program, and the computer program contains program code for executing the method provided by the embodiments of the present disclosure. When the computer program product runs on an electronic device, the program code is used to enable the electronic device to implement the method provided by the embodiments of the present disclosure.

[0162] When the computer program is executed by the processor 401, the above functions defined in the system / device of the embodiment of the present disclosure are executed. According to the embodiment of the present disclosure, the system, device, module, unit, etc. described above can be implemented by a computer program module.

[0163] In one embodiment, the computer program may rely on tangible storage media such as optical storage devices, magnetic storage devices, etc. In another embodiment, the computer program may also be transmitted and distributed in the form of signals on a network medium, and downloaded and installed through the communication part 409, and / or installed from the removable medium 411. The program code contained in the computer program may be transmitted using any appropriate network medium, including but not limited to: wireless, wired, etc., or any suitable combination of the above.

[0164] According to an embodiment of the present disclosure, the program code for executing the computer program provided by the embodiment of the present disclosure can be written in any combination of one or more programming languages. Specifically, these computing programs can be implemented using high-level process and / or object-oriented programming languages, and / or assembly / machine languages. Programming languages ​​include, but are not limited to, Java, C++, python, "C" language or similar programming languages. The program code can be executed entirely on the user computing device, partially on the user device, partially on the remote computing device, or entirely on the remote computing device or server. In the case of a remote computing device, the remote computing device can be connected to the user computing device through any type of network, including a local area network (LAN) or a wide area network (WAN), or can be connected to an external computing device (for example, using an Internet service provider to connect through the Internet).

[0165] The flowcharts and block diagrams in the accompanying drawings illustrate the possible implementation architecture, functions and operations of the systems, methods and computer program products according to various embodiments of the present disclosure. In this regard, each box in the flowchart or block diagram may represent a module, a program segment, or a part of a code, and the above-mentioned module, program segment, or a part of the code contains one or more executable instructions for implementing the specified logical function. It should also be noted that in some alternative implementations, the functions marked in the box may also occur in an order different from that marked in the accompanying drawings. For example, two boxes represented in succession can actually be executed substantially in parallel, and they can sometimes be executed in the opposite order, depending on the functions involved. It should also be noted that each box in the block diagram or flowchart, and the combination of boxes in the block diagram or flowchart, can be implemented with a dedicated hardware-based system that performs a specified function or operation, or can be implemented with a combination of dedicated hardware and computer instructions. It can be understood by those skilled in the art that the features recorded in the various embodiments of the present disclosure can be combined and / or combined in a variety of ways, even if such a combination or combination is not explicitly recorded in the present disclosure. In particular, without departing from the spirit and teaching of the present disclosure, the features described in the various embodiments of the present disclosure may be combined and / or combined in a variety of ways. All of these combinations and / or combinations fall within the scope of the present disclosure.

[0166] The embodiments of the present disclosure are described above. However, these embodiments are only for illustrative purposes and are not intended to limit the scope of the present disclosure. Although the embodiments are described above, this does not mean that the measures in the various embodiments cannot be used in combination to advantage. Without departing from the scope of the present disclosure, those skilled in the art may make a variety of substitutions and modifications, which should all fall within the scope of the present disclosure.

Claims

1. A cross-domain collaborative network abnormal information sharing method, characterized in that: The method comprises: Building a trust framework based on multiple network domains, wherein the trust framework is configured to enable information sharing between the multiple network domains; Unifying data exchange protocols between various network domains in the trust framework; In response to an abnormality occurring in at least one of the plurality of network domains, performing a root cause analysis on the abnormality to obtain an analysis result; The analysis results are shared with the multiple network domains through the trust framework, so that the multiple network domains can respond in real time according to the analysis results.

2. The method according to claim 1, characterized in that The building of a trust framework based on multiple network domains includes: determining a trust model according to the structure of the plurality of network domains; Based on the trust model, a mutual authentication mechanism is established, wherein the mutual authentication mechanism is configured to be able to perform identity authentication when the multiple network domains communicate with each other, ensuring that only authenticated network domains can participate in information sharing.

3. The method according to claim 1, characterized in that The data exchange protocol between the various network domains in the unified trust framework includes: Establishing a data conversion mechanism, wherein the data conversion mechanism is configured to convert local data of each network domain into a unified JSON format; Encryption technology is used to encrypt the data transmission channels between the multiple network domains to ensure the security of the data transmission process.

4. The method according to claim 1, characterized in that: In response to an abnormality occurring in at least one of the multiple network domains, performing root cause analysis on the abnormality to obtain an analysis result includes: When an abnormality is detected in at least one of the plurality of network domains, collecting system logs, network traffic data and security event reports when the abnormality occurs; Determine when the anomaly occurred and its duration; Perform correlation analysis, behavioral analysis, and machine learning on the collected abnormal data to identify the root causes of the abnormalities; According to the root cause, an analysis result is generated, wherein the analysis result includes: event description, impact scope, analysis process, repair measures and prevention plan.

5. The method according to claim 4, characterized in that The sharing of the analysis results to the multiple network domains through the trust framework includes: Based on the trust framework, establish one or more central nodes; The analysis result is shared to the multiple network domains through the central node.

6. The method according to claim 5, characterized in that The sharing of the analysis results to the multiple network domains through the central node includes: Pushing the analysis results to other network domains through the central node using a unified API interface; In response to other network domains receiving the analysis results, a response mechanism is initiated and a local protection strategy is updated.

7. The method according to any one of claims 1 to 6, characterized in that: The method further comprises: A monitoring mechanism is established, wherein the monitoring mechanism is configured to track the effectiveness of cross-domain collaboration through continuous monitoring, and to regularly evaluate and optimize collaboration strategies to ensure that the trust framework can adapt to the ever-changing cyber threat environment.

8. A cross-domain collaborative network abnormal information sharing device, characterized in that: The device comprises: A construction module, configured to construct a trust framework based on a plurality of network domains, wherein the trust framework is configured to enable information sharing between the plurality of network domains; A unification module, used to unify the data exchange protocol between various network domains in the trust framework; an analysis module, configured to, in response to an abnormality occurring in at least one of the plurality of network domains, perform a root cause analysis on the abnormality to obtain an analysis result; A sharing module is used to share the analysis result to the multiple network domains through the trust framework, so that the multiple network domains can respond in real time according to the analysis result.

9. An electronic device, characterized in that: include: one or more processors; A storage device for storing one or more programs; When the one or more programs are executed by the one or more processors, the one or more processors execute the method according to any one of claims 1 to 7.

10. A computer-readable storage medium having executable instructions stored thereon, characterized in that: When the instruction is executed by a processor, the processor executes the method according to any one of claims 1 to 7.

Images