Distributed network security supervision device and method
Through the decentralized network security supervision device, the combination of domain modules, intermediary proxy modules and virtualized resource management layers is used to solve the problems of insufficient scalability and rigid resource management of the traditional centralized network security monitoring system, and efficient and flexible resource management and secure packet transmission are achieved.
Patent Information
- Application Number
- CN202411771241.6
- Authority / Receiving Office
- CN · China
- Patent Type
- Applications(China)
- Current Assignee / Owner
- Filing Date
- 2024-12-04
- Publication Date
- 2025-04-22
AI Technical Summary
When facing a complex and expanding network environment, the traditional centralized network security monitoring system is insufficient in scalability, rigid in resource management, and it is difficult to deal with sudden security incidents and traffic fluctuations, and the risk of single point failure is high.
The distributed network security supervision device is adopted, and the coordinated work of multiple domain modules and intermediary agent modules realizes distributed monitoring and dynamic resource allocation of the entire network. Each user group is configured with a unique identifier and protection module, combined with the virtualized resource management layer, and dynamically adjust resource allocation to optimize utilization.
It improves the scalability and flexibility of the system, enhances the security of data packet transmission, realizes accurate identification and protection of different user groups, optimizes resource utilization and management efficiency, and reduces resource waste and management complexity.
Smart Images
Figure CN119865330A_ABST
Abstract
Description
Technical Field
[0001] The invention relates to the field of network security, and in particular to a decentralized network security monitoring device and method. Background Art
[0002] With the rapid development of the Internet and information technology, network security issues are becoming increasingly severe. With the increase in the number of Internet users and application scenarios, network threats and attack methods are constantly evolving and upgrading. Traditional network security protection measures can no longer meet the needs of the current complex network environment. The field of network security is facing new challenges, especially in a decentralized network architecture. How to efficiently and flexibly monitor and manage security has become an urgent problem to be solved.
[0003] Traditional network security monitoring systems usually adopt a centralized architecture, managing and monitoring the entire network through a single security monitoring center. The main disadvantage of this approach is its lack of scalability. In the face of the ever-expanding network scale and increasingly complex network environment, the centralized architecture is difficult to expand effectively. Increasing monitoring nodes and coverage usually requires a large amount of hardware investment and architecture adjustment, which is costly and inefficient. In addition, the centralized monitoring system relies on a single security center. Once the center is attacked or fails, the security protection capabilities of the entire network will be greatly reduced, which may lead to serious security incidents. The resource management method under the centralized architecture is often fixed and rigid, and it is impossible to dynamically adjust resource allocation according to changes in the network environment, resulting in low resource utilization and difficulty in responding to sudden security incidents and traffic fluctuations.
[0004] Decentralized network architecture is widely used in modern Internet environments due to its natural scalability and redundancy. Decentralized architecture can effectively improve the scalability and reliability of the system and reduce the risk of single point failure through the collaborative work of multiple nodes. However, decentralized network architecture also faces many challenges in security monitoring and management. First, the difficulty of security monitoring increases. In a decentralized network environment, communication and data exchange between nodes are frequent, and the monitoring system needs to have higher real-time and accuracy to promptly detect and respond to potential security threats. Secondly, the security issue of data packet transmission. In a decentralized network, the transmission paths of data packets are diverse and complex. How to ensure the security of data packets during transmission and prevent them from being intercepted, tampered with, and forged is an important technical problem.
[0005] In response to the above challenges, some solutions have been proposed in the prior art in order to improve the security monitoring and management capabilities in a distributed network environment. These solutions mainly include firewalls and intrusion detection systems (IDS), distributed security monitoring systems, and virtualization technology applications. Firewalls and intrusion detection systems are traditional means of network security protection, which identify and prevent potential security threats by monitoring and analyzing network traffic. However, when faced with a distributed network environment, these systems often have problems such as limited monitoring range and slow response speed, making it difficult to provide comprehensive security protection. The distributed security monitoring system deploys monitoring devices at each node of the network to achieve distributed monitoring of the entire network, which can improve the real-time nature and coverage of monitoring, but there are still deficiencies in resource management and data packet transmission security. Summary of the invention
[0006] In order to solve the above-mentioned deficiencies in the prior art, the present invention provides a distributed network security monitoring device, the device comprising:
[0007] A plurality of domain modules 10, each domain module being associated with a different user group 20;
[0008] One or more intermediary proxy modules 40 are configured in each domain module, and the intermediary proxy modules are used to act as intermediaries in the following two situations: first, to process data packets sent to users of the associated user group 20 and initiated from external sources 50 of the decentralized network; second, to process data packets sent to external sources 50 of the decentralized network and initiated from users of the associated user group 20;
[0009] Each user group 20 is provided with a unique identifier 60, which is not shared with other user groups and which is assigned to at least one protection module 70 associated with the corresponding user group 20;
[0010] When the requesting user 90 issues a domain name resolution request, the system receives the request and determines which user group 20 the requesting user 90 belongs to; the system returns a unique identifier 60 configured based on the determined user group 20 to which the requesting user 90 belongs;
[0011] The device further includes a virtualized resource management layer 120 , which performs dynamic allocation of resources between the mediation agent module 40 and the domain module 10 .
[0012] The virtualized resource management layer 120 includes:
[0013] Virtualization management server, used to manage and schedule virtualization resources;
[0014] Virtual resource pool, including virtual CPU, virtual memory and virtual storage;
[0015] Resource monitoring module, used to monitor resource usage and network traffic in the system in real time;
[0016] Dynamic allocation engine, which adjusts the allocation of virtual resources in real time based on the data provided by the resource monitoring module;
[0017] The interface module provides a communication interface between the mediation agent module 40 and the domain module 10 .
[0018] The resource monitoring module collects resource usage and network traffic data of each module in the system, including CPU utilization, memory utilization, storage read and write rates, and network bandwidth.
[0019] The dynamic allocation engine uses intelligent algorithms to perform analysis and calculation to determine the resource requirements of each mediation agent module 40 and domain module 10. The intelligent algorithms include load balancing algorithms and resource prediction algorithms.
[0020] A decentralized network security monitoring method is also disclosed, comprising the following steps:
[0021] a. Deploy multiple domain modules, each of which is associated with a different user group;
[0022] b. configuring one or more intermediary proxy modules in each domain module, the intermediary proxy module is used to process packets sent to users of the associated user group and initiated from external sources of the decentralized network, as well as packets sent to external sources of the decentralized network and packets initiated from users of the associated user group;
[0023] c. Each user group is configured with a unique identifier, the unique identifier is assigned to at least one protection module associated with the corresponding user group;
[0024] d. When the requesting user issues a domain name resolution request, the system receives the request and determines which user group the requesting user belongs to, and the system returns a unique identifier configured based on the user group to which the requesting user belongs;
[0025] e. A virtualized resource management layer is set between the intermediary agent module and the domain module, and dynamic allocation of resources between the intermediary agent module and the domain module is realized through virtualization technology.
[0026] The virtualization resource management layer performs resource monitoring and analysis, and uses the resource monitoring module to monitor the resource usage and network traffic of each module in the system in real time; the collected data includes CPU utilization, memory utilization, storage read and write rates, and network bandwidth; the monitoring data is transmitted to the virtualization management server through the interface module for comprehensive analysis.
[0027] The virtualized resource management layer performs dynamic resource allocation, and the dynamic allocation engine determines the resource requirements of each intermediate agent module 40 and the domain module 10 based on the data provided by the resource monitoring module; when the network traffic of a domain module 10 increases, the dynamic allocation engine allocates more virtual CPU, virtual memory and bandwidth resources to the module from the virtual resource pool, and when the network traffic decreases, the dynamic allocation engine recycles the excess resources into the virtual resource pool.
[0028] Also disclosed is an electronic device, which includes a memory, a processor, and a program stored in the memory and executable on the processor, wherein the program implements the decentralized network security supervision method when executed by the processor.
[0029] Beneficial effects: The distributed network security monitoring device and method of the present invention can improve the scalability and flexibility of the system, adapt to network environments of different sizes and requirements; enhance the security of data packet transmission, prevent external attacks and internal leaks; through unique identifiers and protection modules, achieve accurate identification and protection of different user groups; through the virtualized resource management layer, optimize the utilization and allocation efficiency of system resources, reduce resource waste and management complexity. BRIEF DESCRIPTION OF THE DRAWINGS
[0030] The drawings described herein are used to provide a further understanding of the present invention and constitute a part of the present application, but do not constitute an improper limitation of the present invention. In the drawings:
[0031] Figure 1 It is a system architecture diagram of the distributed network security monitoring device of the present invention;
[0032] Figure 2 It is a schematic diagram of the interaction between the modules in the system of the present invention. DETAILED DESCRIPTION
[0033] The present invention will be described in detail below in conjunction with the accompanying drawings and specific embodiments, wherein the illustrative embodiments and descriptions are only used to explain the present invention but are not intended to limit the present invention.
[0034] Example 1
[0035] Figure 1As shown, the present invention provides a distributed network security monitoring device, including multiple domain modules 10, a user group 20, an intermediary agent module 40, a distributed network external source 50, a unique identifier 60, a protection module 70, a requesting user 90 and a virtualized resource management layer 120.
[0036] Each domain module 10 is associated with a different user group 20. Each user group 20 is composed of multiple users, and these users perform network activities under the management of the same domain module 10. The domain module 10 is used to manage the user groups 20 associated with it to ensure that the network activities between different groups do not interfere with each other.
[0037] One or more intermediary agent modules 40 are configured in each domain module 10. The intermediary agent module 40 is used to act as an intermediary in the following two situations: first, processing data packets sent to users of the associated user group 20 and initiated from a source 50 outside the distributed network; second, processing data packets sent to a source 50 outside the distributed network and initiated from users of the associated user group 20. The intermediary agent module 40 ensures the security and integrity of the data packets by intermediating the transmission of the data packets.
[0038] Each user group 20 is configured with a unique identifier 60, which is not shared with other user groups. The unique identifier 60 is assigned to at least one protection module 70 associated with the corresponding user group 20. The protection module 70 is used to identify and protect the corresponding user group 20 according to the unique identifier 60 to ensure the security of data and network activities within the group.
[0039] When the requesting user 90 issues a domain name resolution request, the system receives the request and determines which user group 20 the requesting user 90 belongs to. The system returns a unique identifier 60 configured based on the determined user group 20 to which the requesting user 90 belongs. This process ensures that the network request of the requesting user 90 can be correctly identified and processed.
[0040] A virtualized resource management layer 120 is provided between the intermediary agent module 40 and the domain module 10. The virtualized resource management layer 120 implements dynamic allocation of resources between the intermediary agent module 40 and the domain module 10 through virtualization technology. In this way, the system can dynamically adjust resource allocation according to network traffic and usage requirements, optimize resource utilization efficiency, and improve system flexibility and scalability.
[0041] The distributed network security monitoring device of the present invention significantly improves the scalability and flexibility of the system through multi-level modular design and virtualization technology. Each domain module 10 is associated with a different user group 20, ensuring that the network activities between the user groups do not interfere with each other. The intermediary agent module 40 plays an intermediary role in the data packet transmission process to ensure the security and integrity of the data packet. The combination of the unique identifier 60 and the protection module 70 realizes the accurate identification and protection of different user groups.
[0042] The present invention further optimizes the resource utilization efficiency and management capability of the system through the virtualized resource management layer 120. Virtualization technology enables the system to dynamically adjust resource allocation according to actual needs, thereby improving the flexibility and response speed of the system.
[0043] Example 2
[0044] Figure 2 A schematic diagram of the interaction between the modules in the system of the present invention is further shown.
[0045] In this embodiment, when a user initiates a data packet request, the request is first received by the domain module 10 of the user group 20 to which the user belongs. The domain module 10 performs preliminary processing on the request through the intermediate agent module 40, including checking the source and destination of the data packet.
[0046] If the destination of the data packet is a source outside the distributed network 50, the intermediary agent module 40 will perform necessary security checks and processing on the data packet to ensure that the content of the data packet has not been tampered with and the source is legitimate. Then, the intermediary agent module 40 forwards the data packet to the source outside the distributed network 50.
[0047] On the contrary, if the data packet is initiated from a source 50 outside the distributed network, the intermediate proxy module 40 will check the data packet to confirm that its destination is the associated user group 20. After the security check, the intermediate proxy module 40 forwards the data packet to the corresponding domain module 10, and the domain module 10 distributes the data packet to the end users of the user group 20.
[0048] The virtualized resource management layer 120 in the system plays an important role between the intermediary agent module 40 and the domain module 10. Through virtualization technology, the virtualized resource management layer 120 can dynamically adjust the resource allocation between the intermediary agent module 40 and the domain module 10 according to the actual network traffic and resource requirements. For example, during peak hours, the virtualized resource management layer 120 can increase the resource allocation to a certain domain module 10 to cope with the increased network traffic. During low hours, the resource allocation can be reduced to save system resources.
[0049] Example 3
[0050] The virtualized resource management layer 120 uses virtualization technology to dynamically allocate resources between the intermediary agent module 40 and the domain module 10. In this way, the system can dynamically adjust resource allocation according to network traffic and usage requirements, optimize resource utilization efficiency, and improve system flexibility and scalability.
[0051] The virtualization resource management layer 120 is one of the key components of the present invention, and its main function is to realize the dynamic allocation of resources between the intermediary agent module 40 and the domain module 10 through virtualization technology. The virtualization resource management layer 120 is composed of the following main parts:
[0052] 1. Virtualization management server: responsible for the management and scheduling of overall virtualization resources. This server includes high-performance CPU, memory and storage devices, and can handle a large number of data requests and computing tasks.
[0053] 2. Virtual resource pool: including resources such as virtual CPU, virtual memory and virtual storage. These resources are abstracted through virtualization technology and can be flexibly allocated to different intermediary agent modules 40 and domain modules 10 for use.
[0054] 3. Resource monitoring module: monitors the resource usage and network traffic in the system in real time, and determines the current resource requirements by analyzing the data.
[0055] 4. Dynamic allocation engine: According to the data provided by the resource monitoring module, the allocation of virtual resources is adjusted in real time. The engine uses advanced algorithms to ensure the optimization and efficiency of resource allocation.
[0056] 5. Interface module: provides a communication interface between the mediation agent module 40 and the domain module 10 to ensure the real-time transmission of resource allocation instructions and status information.
[0057] The virtualization resource management layer 120 realizes efficient resource management through dynamic allocation technology. First, the resource monitoring and analysis module collects the resource usage and network traffic data of each module in the system in real time through various monitoring means, including CPU utilization, memory utilization, storage read and write rate and network bandwidth, etc. These monitoring data are transmitted to the virtualization management server through the interface module for comprehensive analysis to ensure real-time monitoring and effective management of system resources.
[0058] Dynamic resource allocation is implemented by a dynamic allocation engine, which uses intelligent algorithms (such as load balancing algorithms and resource prediction algorithms) to analyze and calculate based on the data provided by the resource monitoring module to determine the resource requirements of each intermediary agent module 40 and the domain module 10. When the network traffic of a domain module 10 increases, the dynamic allocation engine will allocate more virtual CPU, virtual memory and bandwidth resources to the module from the virtual resource pool to ensure that its performance will not decrease. On the contrary, when the network traffic decreases, the dynamic allocation engine will recycle the excess resources into the virtual resource pool for use by other modules, thereby improving the overall resource utilization efficiency.
[0059] The virtualization management server sends resource allocation instructions to the intermediary agent module 40 and the domain module 10 through the interface module according to the decision of the dynamic allocation engine. After receiving the instructions, each module adjusts its own resource usage status to meet the current performance requirements. This process ensures that each module can respond and adjust resource usage in a timely manner to adapt to the ever-changing network environment and usage requirements.
[0060] The system is equipped with an early warning mechanism and automatic adjustment strategy. When the monitoring data indicates that the resource usage of a module is close to the upper limit, the system will immediately trigger the resource allocation process to ensure stable performance. At the same time, the system regularly reviews and optimizes resource usage to adapt to the ever-changing network environment and usage requirements. This real-time response and adjustment mechanism enables the virtualized resource management layer 120 to maintain an efficient and stable operating state under any circumstances and provide high-quality resource management services.
[0061] Example 4
[0062] The present invention provides an operation method of a decentralized network security monitoring device, and the specific implementation scheme is as follows:
[0063] 1. Relationship between domain modules and user groups
[0064] a. Deploy multiple domain modules 10 , each domain module is associated with a different user group 20 .
[0065] b. Ensure that each user group 20 is composed of multiple users, and these users perform network activities under the management of the same domain module 10.
[0066] c. The domain module 10 is used to manage the user groups 20 associated with it to ensure that network activities between different groups do not interfere with each other.
[0067] 2. Configure the intermediary agent module
[0068] a. One or more intermediate agent modules 40 are configured in each domain module 10.
[0069] b. The intermediary agent module 40 is used to process data packets in the following two situations:
[0070] i. A data packet sent to a user associated with the user group 20 and initiated from a decentralized network external source 50;
[0071] ii. Data packets sent to a source 50 outside the decentralized network and initiated from a user associated with the user group 20.
[0072] c. The intermediary agent module 40 ensures the security and integrity of the data packet by intermediating the transmission of the data packet.
[0073] 3. Assign unique identifiers and protect modules
[0074] a. Each user group 20 is configured with a unique identifier 60, which is not shared with other user groups.
[0075] b. A unique identifier 60 is assigned to at least one protection module 70 associated with a corresponding user group 20 .
[0076] c. The protection module 70 is used to identify and protect the corresponding user group 20 according to the unique identifier 60 to ensure the security of data and network activities within the group.
[0077] 4. Domain name resolution request processing
[0078] a. When requesting user 90 sends a domain name resolution request, the system receives the request.
[0079] b. The system determines which user group 20 the requesting user 90 belongs to.
[0080] c. The system returns a unique identifier 60 configured based on the determined user group 20 to which the requesting user 90 belongs.
[0081] d. Ensure that network requests from request user 90 can be correctly identified and processed.
[0082] 5. Configuration and operation of virtualization resource management layer
[0083] a. A virtualized resource management layer 120 is set between the intermediate agent module 40 and the domain module 10.
[0084] b. The virtualized resource management layer 120 implements dynamic allocation of resources between the intermediate agent module 40 and the domain module 10 through virtualization technology.
[0085] 6. Resource monitoring and analysis
[0086] a. The resource monitoring module monitors the resource usage and network traffic of each module in the system in real time.
[0087] b. The collected data includes CPU utilization, memory usage, storage read and write rates, and network bandwidth.
[0088] c. The monitoring data is transmitted to the virtualization management server through the interface module for comprehensive analysis.
[0089] 7. Dynamic resource allocation
[0090] a. The dynamic allocation engine uses intelligent algorithms to analyze and calculate the data provided by the resource monitoring module to determine the resource requirements of each intermediary agent module 40 and the sub-domain module 10.
[0091] b. When the network traffic of a certain domain module 10 increases, the dynamic allocation engine allocates more virtual CPU, virtual memory and bandwidth resources to the module from the virtual resource pool to ensure that its performance does not decrease.
[0092] c. When network traffic decreases, the dynamic allocation engine recycles excess resources into the virtual resource pool for use by other modules, thereby improving overall resource utilization efficiency.
[0093] 8. Transmission of resource allocation instructions
[0094] a. The virtualization management server sends resource allocation instructions to the intermediary agent module 40 and the domain module 10 through the interface module according to the decision of the dynamic allocation engine.
[0095] b. After receiving the instruction, each module adjusts its own resource usage status to meet the current performance requirements.
[0096] 9. Early warning mechanism and automatic adjustment strategy
[0097] a. The system has an early warning mechanism. When the monitoring data shows that the resource usage of a module is close to the upper limit, the system immediately triggers the resource allocation process to ensure stable performance.
[0098] b. The system regularly reviews and optimizes resource usage to adapt to the ever-changing network environment and usage requirements.
[0099] Through the above steps, the distributed network security monitoring device of the present invention can achieve efficient and flexible resource management in a complex network environment and provide stable and secure network activity support.
[0100] Specific application cases
[0101] Application Case 1: Internal Network Security Management
[0102] In a large enterprise internal network, there are multiple departments and different business applications, each department has independent network activity needs and security requirements. In order to ensure that the network activities between departments do not interfere with each other and ensure the security of the overall network, the enterprise decides to use the decentralized network security monitoring device of the present invention.
[0103] The specific implementation steps are as follows:
[0104] 1. Deployment of domain modules and user groups: The enterprise deploys independent domain modules 10 for each department (such as human resources department, finance department, R&D department, sales department, etc.). Each domain module 10 is associated with a corresponding user group 20 to ensure that network activities within the department are carried out in an independent environment.
[0105] 2. Configure the intermediary agent module: Configure one or more intermediary agent modules 40 in each domain module 10. The intermediary agent module 40 is responsible for processing data packet requests initiated within the department and data packet requests from external sources to ensure the security and integrity of the data packets. For example, the intermediary agent module 40 configured in the domain module 10 of the R&D department can process requests for accessing external databases initiated by R&D personnel, and can also process data packets sent from external partners.
[0106] 3. Assignment of unique identifiers and protection modules: Each user group 20 (i.e., each department) is assigned a unique identifier 60 and associated with one or more protection modules 70. The protection module 70 identifies and protects data and network activities within the department based on the unique identifier 60 to prevent data leakage and unauthorized access. For example, the protection module 70 of the finance department ensures that financial data can only be accessed by finance personnel.
[0107] 4. Deployment of virtualized resource management layer: A virtualized resource management layer 120 is set between the intermediary agent module 40 and the domain module 10. The virtualized resource management layer 120 dynamically allocates network resources of each department through virtualization technology. For example, during the peak sales season, the network traffic of the sales department surges, and the virtualized resource management layer 120 automatically allocates more virtual CPU, memory and bandwidth resources to the domain module 10 of the sales department to ensure that its network activities are carried out smoothly.
[0108] 5. Resource monitoring and dynamic allocation: The resource monitoring module monitors the resource usage of each department in real time. When the resource usage of a department approaches the upper limit, the system triggers the resource allocation process to allocate more resources to the department. For example, when the human resources department conducts large-scale data analysis, the virtualized resource management layer 120 will allocate more computing resources to support the analysis task.
[0109] Use Case 2: Multi-tenant Environment Management for Cloud Service Providers
[0110] A cloud service provider provides virtualized computing resources and network security services to multiple tenants. In order to ensure resource optimization among tenants, the cloud service provider adopts the distributed network security monitoring device of the present invention.
[0111] The specific implementation steps are as follows:
[0112] 1. Tenant domain module deployment: Deploy an independent domain module 10 for each tenant (such as Company A, Company B, Company C, etc.), and each domain module 10 is associated with a corresponding tenant user group 20 to ensure that network activities between tenants do not interfere with each other.
[0113] 2. Intermediary agent module configuration: one or more intermediary agent modules 40 are configured in each tenant's domain module 10. The intermediary agent module 40 is responsible for processing external access requests initiated by tenants and data packet requests from outside to ensure the security and integrity of data packets.
[0114] 3. Unique identifier and protection module: Each tenant is assigned a unique identifier 60 and configured with a corresponding protection module 70 to ensure the security of tenant data and network activities. For example, the protection module 70 of Company A will protect its sensitive business data from being accessed by other tenants.
[0115] 4. Virtualization resource management layer deployment: A virtualization resource management layer 120 is set between the intermediary agent module 40 and the domain module 10 to dynamically allocate tenant resources through virtualization technology. For example, when the resource demand of Company B increases within a certain period of time, the virtualization resource management layer 120 will automatically allocate more computing and network resources to the domain module 10 of Company B.
[0116] 5. Resource monitoring and dynamic allocation: The resource monitoring module monitors the resource usage of each tenant in real time and allocates resources through the dynamic allocation engine. For example, when Company C performs high-load computing tasks, the system will detect the increase in its resource demand and automatically allocate additional computing resources to meet the demand.
[0117] Use Case 3: Network Security Monitoring for Government Agencies
[0118] The network system of a certain government agency needs to process a large amount of sensitive data, and strict network security protection is required between various departments (such as public security, taxation, transportation, etc.). The agency decides to use the decentralized network security monitoring device of the present invention for management.
[0119] The specific implementation steps are as follows:
[0120] 1. Deployment of departmental domain modules: Deploy an independent domain module 10 for each government department. Each domain module 10 is associated with a corresponding department user group 20 to ensure that network activities between departments do not interfere with each other.
[0121] 2. Intermediary agent module configuration: one or more intermediary agent modules 40 are configured in each domain module 10. The intermediary agent module 40 is responsible for processing external access requests initiated by departments and data packet requests from outside to ensure the security and integrity of data packets.
[0122] 3. Unique identifier and protection module: Each department is assigned a unique identifier 60 and configured with a corresponding protection module 70 to ensure the security of department data and network activities. For example, the protection module 70 of the public security department protects its confidential data from being accessed by other departments.
[0123] 4. Virtualized resource management layer deployment: A virtualized resource management layer 120 is set between the intermediary agent module 40 and the domain module 10 to dynamically allocate departmental resources through virtualization technology. For example, when the tax department processes a large amount of tax return data in a certain quarter, the virtualized resource management layer 120 will automatically allocate more computing and network resources to the domain module 10 of the tax department.
[0124] 5. Resource monitoring and dynamic allocation: The resource monitoring module monitors the resource usage of each department in real time and allocates resources through the dynamic allocation engine. For example, when the transportation department conducts large-scale traffic data analysis, the system will detect the increase in its resource demand and automatically allocate additional computing resources to meet the demand.
[0125] Through these specific application cases, the distributed network security monitoring device of the present invention demonstrates its high efficiency and flexibility in various complex network environments, and can meet diverse network security needs.
[0126] Through the above implementation, the distributed network security monitoring device of the present invention can achieve efficient and flexible resource management, ensure that the system can operate stably in various complex network environments, and provide reliable security protection. The design and implementation method of the virtualized resource management layer 120 provides an innovative and effective solution for the network security field, which can cope with the increasingly complex and changing network security challenges.
[0127] The above description is only a preferred embodiment of the present invention, so all equivalent changes or modifications made according to the structure, characteristics and principles described in the scope of the patent application of the present invention are included in the scope of the patent application of the present invention.
Claims
1. A distributed network security monitoring device, characterized in that: The device comprises: A plurality of domain modules (10), each domain module being associated with a different user group (20); One or more intermediary proxy modules (40) are configured in each domain module, and the intermediary proxy modules are used to act as intermediaries in the following two situations: first, processing data packets sent to users of the associated user group (20) and initiated from external sources (50) of the decentralized network; second, processing data packets sent to external sources (50) of the decentralized network and data packets initiated from users of the associated user group (20); Each user group (20) is provided with a unique identifier (60), the unique identifier is not shared with other user groups, and the unique identifier is assigned to at least one protection module (70) associated with the corresponding user group (20); When a requesting user (90) issues a domain name resolution request, the system receives the request and determines which user group (20) the requesting user (90) belongs to; the system returns a unique identifier (60) configured based on the determined user group (20) to which the requesting user (90) belongs; The device further comprises a virtualized resource management layer (120), and the virtualized resource management layer (120) performs dynamic allocation of resources between the intermediate agent module (40) and the domain module (10).
2. A distributed network security monitoring device as claimed in claim 1, characterized in that: The virtualization resource management layer (120) includes: Virtualization management server, used to manage and schedule virtualization resources; Virtual resource pool, including virtual CPU, virtual memory and virtual storage; Resource monitoring module, used to monitor resource usage and network traffic in the system in real time; Dynamic allocation engine, which adjusts the allocation of virtual resources in real time based on the data provided by the resource monitoring module; The interface module provides a communication interface between the intermediate agent module (40) and the domain module (10).
3. A distributed network security monitoring device as claimed in claim 2, characterized in that: The resource monitoring module collects resource usage and network traffic data of each module in the system, including CPU utilization, memory utilization, storage read and write rates, and network bandwidth.
4. A distributed network security monitoring device as claimed in claim 2, characterized in that: The dynamic allocation engine uses an intelligent algorithm to perform analysis and calculation to determine the resource requirements of each intermediate proxy module (40) and the domain module (10), and the intelligent algorithm includes a load balancing algorithm and a resource prediction algorithm.
5. A decentralized network security monitoring method, characterized in that: The supervision method comprises the following steps: a. deploying a plurality of domain modules, each domain module being associated with a different user group; b. configuring one or more intermediary proxy modules in each domain module, the intermediary proxy module is used to process packets sent to users of the associated user group and initiated from external sources of the decentralized network, as well as packets sent to external sources of the decentralized network and packets initiated from users of the associated user group; c. Each user group is configured with a unique identifier, the unique identifier is assigned to at least one protection module associated with the corresponding user group; d. When the requesting user issues a domain name resolution request, the system receives the request and determines which user group the requesting user belongs to, and the system returns a unique identifier configured based on the user group to which the requesting user belongs; e. A virtualized resource management layer is set between the intermediary agent module and the domain module, and dynamic allocation of resources between the intermediary agent module and the domain module is realized through virtualization technology.
6. A distributed network security monitoring method as claimed in claim 5, characterized in that: The virtualization resource management layer performs resource monitoring and analysis, and uses the resource monitoring module to monitor the resource usage and network traffic of each module in the system in real time; the collected data includes CPU utilization, memory utilization, storage read and write rates, and network bandwidth; the monitoring data is transmitted to the virtualization management server through the interface module for comprehensive analysis.
7. A distributed network security monitoring method as claimed in claim 5, characterized in that: The virtualized resource management layer performs dynamic resource allocation, and the dynamic allocation engine determines the resource requirements of each intermediate agent module (40) and the domain module (10) based on the data provided by the resource monitoring module; when the network traffic of a domain module (10) increases, the dynamic allocation engine allocates more virtual CPU, virtual memory and bandwidth resources to the module from the virtual resource pool, and when the network traffic decreases, the dynamic allocation engine recycles the excess resources into the virtual resource pool.
8. An electronic device, characterized in that: The electronic device includes a memory, a processor, and a program stored in the memory and executable on the processor. When the program is executed by the processor, the distributed network security supervision method described in any one of claims 5 to 7 is implemented.