Distributed network security monitoring system and method

Abstract

The invention provides a distributed network security monitoring system and method, the system comprises a plurality of partition units associated with different user groups, one or more intermediate agent units are configured in each partition unit, and data packets from the outside and the inside are processed. Each user group is configured with a unique identification code and is allocated to the protection unit. When the system receives a domain name resolution request, a corresponding identification code is returned by identifying a group of a request user. The adjusting medium is used for coordinating resource distribution between the intermediate agent unit and the partition unit and optimizing flow management. The system can monitor and identify threats in real time and dynamically adjust security policies, and provides comprehensive and efficient network security protection.

Description

Technical Field

[0001] The present invention relates to the field of network security, and in particular to a distributed network security monitoring system and method. Background Art

[0002] With the rapid development of the Internet and information technology, network security issues have become increasingly prominent, and the forms and means of network attacks have continued to evolve. Traditional network security protection mechanisms usually rely on centralized security devices and firewalls. Although these devices can provide security protection to a certain extent, they are powerless in the face of increasingly complex and diverse network threats. Especially in large-scale distributed network environments, traditional centralized security mechanisms are difficult to effectively respond to traffic peaks and sudden security incidents, and are prone to become single-point bottlenecks, affecting the overall performance and reliability of the system.

[0003] As an emerging network security solution, distributed network security systems have gradually attracted the attention and importance of the industry. Distributed network security systems deploy security agents at various nodes in the network to achieve distributed management and monitoring of network traffic, thereby improving the security and reliability of the system. Distributed network security systems can work together between multiple network nodes, share security protection tasks, and avoid single point failure problems. However, existing distributed network security systems still face many challenges and problems in practical applications.

[0004] First, existing distributed network security systems often face performance bottlenecks and uneven resource allocation when processing complex traffic. Since different types of network traffic have different characteristics and requirements, a unified processing method is difficult to meet the requirements of all types of traffic. Especially when facing peak traffic, the system is prone to overload, resulting in some traffic not being processed in a timely and effective manner, which in turn affects the security and stability of the overall network.

[0005] Secondly, traditional distributed network security systems lack flexibility and adaptability. Existing systems usually use preset security policies and rules, which are difficult to cope with the ever-changing network threats and attack methods. With the continuous advancement and changes in network attack technology, fixed security policies and rules appear to be lagging and passive, and cannot detect and respond to new threats in a timely manner. In addition, traditional security policy adjustments usually require manual intervention, which is a complex and time-consuming process and difficult to respond to sudden security incidents in a timely manner.

[0006] In addition, the existing distributed network security system also has certain deficiencies in traffic management and resource allocation. Due to the differences in traffic load and resource requirements between different network nodes, a unified resource allocation method is difficult to meet the actual needs of each node. Especially when facing burst or abnormal traffic, it is difficult for the system to achieve dynamic adjustment and optimization, resulting in resource overload or idle resources in some nodes, thus affecting the overall performance and efficiency of the system.

[0007] In recent years, with the development of machine learning and artificial intelligence technologies, researchers have begun to try to introduce these new technologies into the field of network security to improve the system's adaptability and intelligence. By introducing a self-learning module and using machine learning algorithms to analyze and learn network traffic in real time, it is possible to automatically adjust and optimize security policies and improve the system's protection capabilities. However, how to effectively integrate these new technologies into distributed network security systems is still a technical problem that needs to be solved.

[0008] Therefore, it is necessary to propose a new distributed network security solution to improve the overall performance and security of the system by introducing a more flexible traffic management mechanism, an adaptive security policy adjustment method, and a dynamic resource allocation technology. Summary of the invention

[0009] In order to solve the above-mentioned deficiencies in the prior art, the present invention provides a distributed network security monitoring system and method:

[0010] The system comprises:

[0011] A plurality of partition units 10, each partition unit being associated with a different user group 20;

[0012] One or more intermediate proxy units 40 are configured in each partition unit, and the intermediate proxy units are used to act as an intermediary in the following two situations: first, processing data packets sent to users of the associated user community 20 and initiated from sources outside the distributed network; second, processing data packets sent to sources outside the distributed network and initiated from users of the associated user community 20;

[0013] Each user group 20 is provided with a unique identification code 60, which is not shared with other user groups and which is assigned to at least one protection unit 70 associated with the corresponding user group 20;

[0014] When the requesting user issues a domain name resolution request, the system receives the request and determines which user group 20 the requesting user belongs to; the system returns a unique identification code 60 configured based on the determined user group 20 to which the requesting user belongs;

[0015] A regulation medium 100 is provided between the intermediate agent unit 40 and the partition unit 10 , and the regulation medium 100 coordinates resource allocation between the intermediate agent unit 40 and the partition unit 10 .

[0016] Each partition unit is further divided into a plurality of sub-units, each of which is specialized in processing a specific type of traffic.

[0017] The protection unit 70 includes:

[0018] A traffic monitoring module 110, for monitoring the network traffic passing through the protection unit in real time, collecting the traffic data and transmitting it to the threat detection module;

[0019] Threat detection module 120, which uses predefined rules and machine learning algorithms to analyze traffic data, identify potential security threats, and transmit the corresponding information to the security policy adjustment module;

[0020] A security policy adjustment module 130 dynamically adjusts network security policies based on information provided by the threat detection module;

[0021] The self-learning module 80 identifies the difference between the normal traffic pattern and the abnormal traffic pattern by continuously learning and analyzing the traffic pattern, and updates the security policy of the system according to the difference.

[0022] The regulating medium 100 comprises:

[0023] The flow monitoring module 101 is used to monitor the flow conditions between each partition unit 10 and the intermediate proxy unit 40 in the system in real time;

[0024] The resource allocation module 102 is used to dynamically adjust the resource allocation between the intermediate proxy unit and the partition unit based on the data provided by the traffic monitoring module 101;

[0025] The load balancing module 103 is used to distribute the traffic to different intermediate proxy units and partition units during the peak period of system traffic;

[0026] A priority management module 104, for setting different processing priorities according to the security requirements and traffic types of different user groups;

[0027] The policy adjustment module 105 is used to dynamically adjust the security policy in conjunction with the self-learning module 80 in the protection unit 70 according to the changes in the real-time traffic pattern and the emerging security threats.

[0028] The monitoring method comprises the following steps:

[0029] (1) Divide the system into a plurality of partition units 10, each partition unit being associated with a different user group 20;

[0030] (2) configuring one or more intermediate proxy units 40 in each partition unit to process the ingress and egress of data packets;

[0031] (3) The regulating medium 100 coordinates the resource allocation between the intermediate agent unit 40 and the partition unit 10;

[0032] (4) Each user group 20 is configured with a unique identification code 60 and assigned to at least one protection unit 70 associated with the corresponding user group 20;

[0033] (5) When the requesting user issues a domain name resolution request, the system receives the request and determines the user group 20 to which the requesting user belongs, and returns a unique identification code 60 configured based on the determined user group 20 to which the requesting user belongs.

[0034] The operation steps of the protection unit include:

[0035] (1) The traffic monitoring module 110 monitors the network traffic passing through the protection unit 70 in real time and collects traffic data;

[0036] (2) The threat detection module 120 uses predefined rules and machine learning algorithms to analyze traffic data, identify potential security threats, and transmit the corresponding information to the security policy adjustment module 130;

[0037] (3) The security policy adjustment module 130 dynamically adjusts the network security policy based on the information provided by the threat detection module 120;

[0038] (4) The self-learning module 80 identifies the difference between normal traffic patterns and abnormal traffic patterns by continuously learning and analyzing traffic patterns, and updates the system's security policy based on the difference.

[0039] The medium adjustment operation steps include:

[0040] (1) The traffic monitoring module 101 monitors the traffic between each partition unit 10 and the intermediate proxy unit 40 in the system in real time;

[0041] (2) Based on the data provided by the traffic monitoring module 101, the resource allocation module 102 dynamically adjusts the resource allocation between the intermediate proxy unit and the partition unit;

[0042] (3) During the peak period of system traffic, the load balancing module 103 is activated to distribute the traffic to different intermediate proxy units and partition units, and intelligently allocate traffic paths according to the real-time traffic load situation;

[0043] (4) The priority management module 104 sets different processing priorities according to the security requirements and traffic types of different user groups;

[0044] (5) The policy adjustment module 105 is combined with the self-learning module 80 in the protection unit 70 to dynamically adjust the security policy according to the changes in real-time traffic patterns and emerging security threats.

[0045] The electronic device comprises a memory, a processor and a program stored in the memory and executable on the processor. When the program is executed by the processor, the distributed network security monitoring method is implemented.

[0046] A computer-readable storage medium stores a program, which implements the distributed network security monitoring method when executed by a processor.

[0047] Beneficial effects:

[0048] By dividing the system into multiple partition units, and further dividing them into sub-units that specialize in handling specific types of traffic, refined traffic management is achieved, significantly improving network security. The intermediate proxy unit acts as an intermediary when data packets enter and exit, effectively preventing external threats from entering and internal threats from spreading. Unique identification codes ensure the independence and security of different user groups. Adjusting the media dynamically allocates resources, optimizes traffic management, and improves system performance and stability. The system can monitor and identify threats in real time and dynamically adjust security policies to provide comprehensive and efficient network security protection. BRIEF DESCRIPTION OF THE DRAWINGS

[0049] The drawings described herein are used to provide a further understanding of the present invention and constitute a part of the present application, but do not constitute an improper limitation of the present invention. In the drawings:

[0050] Figure 1 is a structural diagram of a distributed network security monitoring system of the present invention;

[0051] Figure 2 is the internal structure of the protection unit of the present invention;

[0052] Figure 3 It is a diagram of the main components of the regulating medium of the present invention;

[0053] Figure 4 The invention discloses a distributed network security monitoring method. DETAILED DESCRIPTION

[0054] The present invention will be described in detail below in conjunction with the accompanying drawings and specific embodiments, wherein the illustrative embodiments and descriptions are only used to explain the present invention but are not intended to limit the present invention.

[0055] Example 1

[0056] See attached Figure 1, illustrates a structural diagram of a distributed network security monitoring system. The system includes a plurality of partition units 10, each of which is associated with a different user group 20. Each partition unit is further divided into a plurality of sub-units, each of which is specialized in processing a specific type of traffic, such as HTTP traffic, FTP traffic, email traffic, etc.

[0057] In each partition unit, one or more intermediate proxy units 40 are configured. These intermediate proxy units are configured to act as intermediaries in the following two situations: first, to process data packets sent to users associated with the user community 20 and initiated from sources outside the distributed network; second, to process data packets sent to sources outside the distributed network and initiated from users associated with the user community 20. These intermediate proxy units can effectively manage and filter traffic, thereby providing a secure network environment.

[0058] Each user group 20 is configured with a unique identification code 60, which is not shared with other user groups. The unique identification code is assigned to at least one protection unit 70 associated with the corresponding user group 20. The protection unit 70 is integrated with a self-learning module 80, which uses a machine learning algorithm to analyze traffic patterns and automatically adjust security policies based on emerging threats. This configuration enables the system to adaptively improve security and reduce the burden on administrators.

[0059] When a requesting user issues a domain name resolution request, the system receives the request and determines which user group 20 the requesting user belongs to. The system returns a unique identification code 60 configured based on the determined user group 20 to which the requesting user belongs. This process is coordinated between the intermediate proxy unit 40 and the partition unit 10 through the adjustment medium 100. The adjustment medium dynamically allocates resources according to the real-time traffic load, thereby optimizing traffic management and improving system performance.

[0060] Example 2

[0061] See attached Figure 2 , which illustrates the internal structure of a protection unit in a distributed network security monitoring system. The protection unit 70 is composed of multiple modules, including a traffic monitoring module 110 , a threat detection module 120 , a security policy adjustment module 130 and a self-learning module 80 .

[0062] The traffic monitoring module 110 is used to monitor the network traffic passing through the protection unit 70 in real time. The module collects traffic data and transmits it to the threat detection module 120. The threat detection module 120 uses predefined rules and machine learning algorithms to analyze traffic data and identify potential security threats. After identifying a threat, the threat detection module 120 transmits the corresponding information to the security policy adjustment module 130.

[0063] The security policy adjustment module 130 dynamically adjusts network security policies based on the information provided by the threat detection module 120. These policies may include firewall rules, intrusion detection system (IDS) configuration, access control list (ACL), etc. The security policy adjustment module 130 can quickly respond to emerging threats to protect network security.

[0064] The self-learning module 80 further enhances the accuracy and efficiency of threat detection and security policy adjustment by continuously learning and analyzing traffic patterns. The self-learning module 80 can identify the differences between normal traffic patterns and abnormal traffic patterns and update the system's security policies based on these differences. The machine learning algorithms used by this module include but are not limited to supervised learning, unsupervised learning, and reinforcement learning.

[0065] Example 3

[0066] See attached Figure 3 , which illustrates the internal structure of a regulation medium in a distributed network security monitoring system. The regulation medium 100 plays a key coordination and optimization role in the distributed network security monitoring system of the present invention. It is located between the intermediate proxy unit 40 and the partition unit 10, and is mainly responsible for the dynamic allocation of resources, real-time monitoring of traffic, and optimization of system performance. Through the regulation medium, the system can remain stable during peak traffic periods while ensuring that the security needs of each user group 20 are met.

[0067] The adjustment medium 100 is a key component of the distributed network security monitoring system of the present invention, and is mainly responsible for the dynamic allocation of resources, real-time monitoring of traffic, and optimization of system performance. The adjustment medium includes five main components: a traffic monitoring module 101, a resource allocation module 102, a load balancing module 103, a priority management module 104, and a policy adjustment module 105.

[0068] The traffic monitoring module 101 is used to monitor the traffic conditions between each partition unit 10 and the intermediate proxy unit 40 in the system in real time. When the requesting user issues a domain name resolution request, the traffic monitoring module immediately starts to monitor the traffic conditions of the request. Through real-time analysis of the request data packet, the user group 20 to which the requesting user belongs is determined, and the current traffic status of the user group is recorded. Based on the data provided by the traffic monitoring module, the resource allocation module 102 dynamically adjusts the resource allocation between the intermediate proxy unit and the partition unit. For example, when the traffic of a user group increases, the resource allocation module will increase the resources allocated to the group to ensure smooth handling of the traffic.

[0069] During the peak period of system traffic, the load balancing module 103 is activated to distribute traffic to different intermediate proxy units and partition units to avoid overloading any single unit. The load balancing module intelligently allocates traffic paths according to the real-time traffic load to ensure the optimization of the overall system performance. The priority management module 104 sets different processing priorities according to the security requirements and traffic types of different user groups.

[0070] The policy adjustment module 105, in conjunction with the self-learning module 80 in the protection unit 70, dynamically adjusts the security policy based on changes in real-time traffic patterns and emerging security threats. For example, when the self-learning module detects a new attack pattern, the policy adjustment module immediately updates the firewall rules and access control lists to respond to the new threat. Through these coordination and optimization measures, the adjustment medium plays an important role in ensuring system security and stable performance.

[0071] Overall, the mediation media ensures the efficient operation of the system under various circumstances through the coordinated work of multiple functional modules such as traffic monitoring, dynamic resource allocation, load balancing, priority management and policy adjustment. Its real-time monitoring and dynamic adjustment capabilities enable the system to maintain a stable and secure operating state when dealing with peak traffic and new security threats, thereby providing comprehensive and effective network security protection.

[0072] By introducing the adjustment medium 100, the distributed network security monitoring system of the present invention can ensure the efficiency and stability of the system on the basis of real-time monitoring and dynamic resource allocation. The adjustment medium optimizes traffic management and improves system performance through functional modules such as traffic monitoring, resource allocation, load balancing, priority management and policy adjustment, thereby providing comprehensive and effective network security protection. The application of the adjustment medium not only improves the security and scalability of the system, but also significantly improves the user experience, and has broad application prospects and practical value.

[0073] Example 4 Monitoring method of distributed network security system

[0074] See attached Figure 4 , a monitoring method for a distributed network security monitoring system is illustrated.

[0075] Example 4-1: System structure and operation flow

[0076] 1. System initialization:

[0077] The system is divided into a plurality of partition units 10 , each of which is associated with a different user community 20 .

[0078] In each partition unit, it is further divided into multiple sub-units, each of which specializes in handling a specific type of traffic, such as HTTP traffic, FTP traffic, email traffic, etc.

[0079] 2. Intermediate proxy unit configuration:

[0080] One or more intermediate agent units 40 are configured in each partition unit to process the entry and exit of data packets.

[0081] The intermediate proxy unit acts as an intermediary in processing data packets sent to users associated with the user community 20 and originating from sources external to the distributed network.

[0082] The intermediate proxy unit acts as an intermediary in processing data packets sent to sources external to the distributed network and data packets initiated from users of the associated user community 20.

[0083] 3. Unique Identification Code Allocation:

[0084] Each user group 20 is provided with a unique identification code 60 for identification and is not shared with other user groups.

[0085] A unique identification code is assigned to at least one security unit 70 associated with a corresponding user community 20 .

[0086] 4. Protection unit and self-learning module integration:

[0087] A self-learning module 80 is integrated into the protection unit 70 to analyze traffic patterns using machine learning algorithms and automatically adjust security policies based on emerging threats.

[0088] 5. Domain name resolution request processing:

[0089] When a requesting user sends a domain name resolution request, the system receives the request and determines to which user group 20 the requesting user belongs.

[0090] The system returns a unique identification code 60 configured based on the user community 20 to which the requesting user is determined to belong.

[0091] 6. Traffic management and resource allocation:

[0092] The mediation agent 100 coordinates resource allocation between the intermediate agent unit 40 and the partition unit 10 .

[0093] The throttling agent dynamically allocates resources based on real-time traffic load to optimize traffic management and improve system performance.

[0094] Example 4-2: Operation process of the protection unit

[0095] 1. Traffic monitoring:

[0096] The traffic monitoring module 110 monitors the network traffic passing through the protection unit 70 in real time and collects traffic data.

[0097] 2. Threat Detection:

[0098] The threat detection module 120 uses predefined rules and machine learning algorithms to analyze traffic data and identify potential security threats.

[0099] After a threat is identified, the corresponding information is transmitted to the security policy adjustment module 130 .

[0100] 3. Security policy adjustment:

[0101] The security policy adjustment module 130 dynamically adjusts the network security policy based on the information provided by the threat detection module 120 .

[0102] These policies can include firewall rules, intrusion detection system (IDS) configuration, access control lists (ACLs), etc.

[0103] 4. Self-learning and strategy optimization:

[0104] The self-learning module 80 enhances the accuracy and efficiency of threat detection and security policy adjustment by continuously learning and analyzing traffic patterns.

[0105] Identify differences between normal and abnormal traffic patterns and update the system's security policies based on these differences.

[0106] Example 4-3: Operational process of adjusting medium

[0107] 1. Traffic monitoring:

[0108] The traffic monitoring module 101 monitors the traffic conditions between each partition unit 10 and the intermediate agent unit 40 in the system in real time.

[0109] When the requesting user sends a domain name resolution request, the traffic monitoring module starts to monitor the traffic situation of the request.

[0110] 2. Dynamic allocation of resources:

[0111] Based on the data provided by the traffic monitoring module 101 , the resource allocation module 102 dynamically adjusts the resource allocation between the intermediate agent units and the partition units.

[0112] For example, when the traffic of a certain user group increases, the resource allocation module increases the resources allocated to the group.

[0113] 3. Load balancing:

[0114] During the peak period of system traffic, the load balancing module 103 is started to distribute the traffic to different intermediate proxy units and partition units to avoid overloading of a single unit.

[0115] Intelligently allocate traffic paths based on real-time traffic load conditions to ensure overall system performance optimization.

[0116] 4. Priority Management:

[0117] The priority management module 104 sets different processing priorities according to the security requirements and traffic types of different user groups.

[0118] For example, the transaction flow of the finance department is given the highest priority to ensure that key data is processed first.

[0119] 5. Strategy Adjustment:

[0120] The policy adjustment module 105 is combined with the self-learning module 80 in the protection unit 70 to dynamically adjust the security policy according to the changes in real-time traffic patterns and emerging security threats.

[0121] When the self-learning module detects new attack patterns, the policy adjustment module updates the firewall rules and access control lists to respond to the new threats.

[0122] Through the above method, the distributed network security monitoring system of the present invention ensures the efficient operation of the system in various situations through various technical means such as traffic monitoring, dynamic resource allocation, load balancing, priority management and policy adjustment in actual application. The real-time monitoring and dynamic adjustment capabilities of the system enable it to maintain a stable and safe operating state when dealing with peak traffic and new security threats, thereby providing comprehensive and effective network security protection.

[0123] Example 5 Application of distributed network security monitoring system in e-commerce platform

[0124] Example 5-1 System structure and function

[0125] In a large e-commerce platform, the number of users visiting is huge and widely distributed. In order to ensure the stability and security of the platform, the distributed network security monitoring system of the present invention is adopted.

[0126] Partition unit 10: Different functional modules of the platform are configured as independent partition units, such as user management module, commodity display module, transaction processing module, etc. Each unit is associated with a corresponding user group 20. This isolation improves security and management efficiency.

[0127] Subunit: Each partition unit is further divided into multiple subunits. For example, the product display module is divided into a subunit for processing image traffic, a subunit for processing text traffic, and a subunit for processing video traffic. This refined traffic management ensures the security and effective management of various types of traffic.

[0128] Intermediate proxy units 40: These units are configured in each partition unit to handle the transmission of data packets between internal users and external networks. For example, when a user visits a product page or conducts a transaction, the intermediate proxy unit will manage and filter it to prevent potential security threats from entering the platform.

[0129] Unique Identifier 60: Each user group has a unique identifier to distinguish different modules. For example, the identifier of the user management module is different from that of the transaction processing module, so that specific security policies and resources can be allocated according to their respective security needs.

[0130] Protection unit 70 and self-learning module 80: The protection unit is installed in each partition unit and integrates a self-learning module. The self-learning module continuously adjusts and optimizes security policies by analyzing the traffic patterns of each module. For example, when abnormal traffic is detected in a module, the system automatically adjusts the firewall rules to prevent the spread of potential threats.

[0131] Requesting user and mediation medium 100: When a user requests to access platform resources, the mediation medium dynamically allocates resources according to the real-time traffic load to ensure fast processing of the request and stable operation of the network.

[0132] Example 5-2 Internal structure and function of the protection unit:

[0133] Traffic monitoring module 110: monitors the network traffic passing through the protection unit in real time, for example, monitoring users browsing product pages, placing orders, making payments, etc., to ensure the security of each operation.

[0134] Threat detection module 120: uses machine learning algorithms to analyze traffic data and identify potential security threats. For example, when abnormal purchase behavior or suspicious login attempts are detected, they are immediately marked and reported.

[0135] Security policy adjustment module 130: dynamically adjusts network security policies based on information provided by the threat detection module, for example, updating firewall rules to block access from suspicious IP addresses and adjusting intrusion detection system (IDS) configuration to respond to new threats.

[0136] Self-learning module 80: By analyzing normal user behavior and abnormal behavior, the self-learning module continuously optimizes threat detection and security strategies. For example, when a new fraud behavior pattern is discovered, the self-learning module automatically adjusts the system strategy to more effectively defend against this new threat.

[0137] Example 5-3 Coordination and optimization of regulatory media:

[0138] Traffic monitoring module 101: monitors user access and transaction traffic in real time, for example, monitoring users browsing product pages, placing orders, making payments, etc., to ensure the security of each operation.

[0139] Resource allocation module 102: dynamically adjusts resource allocation between the intermediate proxy unit and the partition unit according to real-time traffic conditions. For example, when a certain product promotion activity triggers a large number of visits, increase the resources allocated to the module to ensure smooth access.

[0140] Load balancing module 103: During peak traffic periods, traffic is dispersed to different intermediate proxy units and partition units to avoid overloading of a single unit. For example, during large-scale promotional activities, traffic paths are intelligently allocated to ensure stable operation of the platform.

[0141] Priority management module 104: Set different processing priorities according to the needs of different modules and traffic types. For example, payment and transaction traffic are processed first to ensure the smooth progress of the user's payment process.

[0142] Policy adjustment module 105: In combination with the self-learning module, the security policy is dynamically adjusted according to the changes in real-time traffic patterns and emerging security threats. For example, when a new network attack pattern is detected, the security policy is immediately updated to prevent the attack from affecting the platform.

[0143] Through its application in e-commerce platforms, the distributed network security monitoring system of the present invention demonstrates its powerful functions in ensuring network security, improving system performance and user experience. The system provides comprehensive and efficient network security protection through the division of partition units, fine management of traffic, coordination of intermediate proxy units, optimization of self-learning modules, and dynamic deployment of adjustment media.

[0144] The above description is only a preferred embodiment of the present invention, so all equivalent changes or modifications made according to the structure, characteristics and principles described in the scope of the patent application of the present invention are included in the scope of the patent application of the present invention.

Claims

1. A distributed network security monitoring system, characterized in that: The system comprises: A plurality of partition units (10), each partition unit being associated with a different user group (20); One or more intermediate proxy units (40) are configured in each partition unit, and the intermediate proxy units are used to act as intermediaries in the following two situations: first, processing data packets sent to users of the associated user group (20) and initiated from sources outside the distributed network; second, processing data packets sent to sources outside the distributed network and initiated from users of the associated user group (20); Each user group (20) is provided with a unique identification code (60), the unique identification code is not shared with other user groups, and the unique identification code is assigned to at least one protection unit (70) associated with the corresponding user group (20); When a requesting user issues a domain name resolution request, the system receives the request and determines which user group (20) the requesting user belongs to; the system returns a unique identification code (60) configured based on the determined user group (20) to which the requesting user belongs; A regulating medium (100) is provided between the intermediate agent unit (40) and the partition unit (10), and the regulating medium (100) coordinates resource allocation between the intermediate agent unit (40) and the partition unit (10).

2. A distributed network security monitoring system as claimed in claim 1, characterized in that: Each partition unit is further divided into a plurality of sub-units, each of which is specialized in processing a specific type of traffic.

3. A distributed network security monitoring system as claimed in claim 1, characterized in that: The protection unit (70) comprises: A traffic monitoring module (110), used to monitor the network traffic passing through the protection unit in real time, collect traffic data and transmit it to the threat detection module; A threat detection module (120) analyzes traffic data using predefined rules and machine learning algorithms, identifies potential security threats, and transmits corresponding information to a security policy adjustment module; A security policy adjustment module (130) dynamically adjusts network security policies based on information provided by the threat detection module; The self-learning module (80) identifies the difference between the normal traffic pattern and the abnormal traffic pattern by continuously learning and analyzing the traffic pattern, and updates the security policy of the system according to the difference.

4. A distributed network security monitoring system as claimed in claim 1, characterized in that: The regulating medium (100) comprises: A flow monitoring module (101) is used to monitor the flow conditions between each partition unit (10) and the intermediate proxy unit (40) in the system in real time; A resource allocation module (102), used for dynamically adjusting resource allocation between the intermediate proxy unit and the partition unit based on data provided by the traffic monitoring module (101); A load balancing module (103) is used to distribute the traffic to different intermediate proxy units and partition units during the peak period of system traffic; A priority management module (104) is used to set different processing priorities according to the security requirements and traffic types of different user groups; The policy adjustment module (105) is used to dynamically adjust the security policy according to the changes in real-time traffic patterns and emerging security threats in combination with the self-learning module (80) in the protection unit (70).

5. A distributed network security monitoring method, characterized in that: The monitoring method comprises the following steps: (1) dividing the system into a plurality of partition units (10), each partition unit being associated with a different user group (20); (2) configuring one or more intermediate proxy units (40) in each partition unit to process the ingress and egress of data packets; (3) the regulating medium (100) coordinates the resource allocation between the intermediate agent unit (40) and the partition unit (10); (4) each user group (20) is provided with a unique identification code (60) and assigned to at least one protection unit (70) associated with the corresponding user group (20); (5) When the requesting user issues a domain name resolution request, the system receives the request and determines the user group (20) to which the requesting user belongs, and returns a unique identification code (60) configured based on the determined user group (20) to which the requesting user belongs.

6. A distributed network security monitoring method as claimed in claim 5, characterized in that: The operation steps of the protection unit include: (1) The traffic monitoring module (110) monitors the network traffic passing through the protection unit (70) in real time and collects traffic data; (2) the threat detection module (120) uses predefined rules and machine learning algorithms to analyze traffic data, identify potential security threats, and transmit the corresponding information to the security policy adjustment module (130); (3) the security policy adjustment module (130) dynamically adjusts the network security policy based on the information provided by the threat detection module (120); (4) The self-learning module (80) identifies the difference between normal traffic patterns and abnormal traffic patterns by continuously learning and analyzing traffic patterns, and updates the security policy of the system based on the difference.

7. A distributed network security monitoring method as claimed in claim 5, characterized in that: The medium adjustment operation steps include: (1) The traffic monitoring module (101) monitors the traffic conditions between each partition unit (10) and the intermediate proxy unit (40) in the system in real time; (2) Based on the data provided by the traffic monitoring module (101), the resource allocation module (102) dynamically adjusts the resource allocation between the intermediate proxy unit and the partition unit; (3) During the peak period of system traffic, the load balancing module (103) is activated to distribute the traffic to different intermediate proxy units and partition units, and intelligently allocate traffic paths according to the real-time traffic load situation; (4) a priority management module (104) sets different processing priorities according to the security requirements and traffic types of different user groups; (5) The policy adjustment module (105) is combined with the self-learning module (80) in the protection unit (70) to dynamically adjust the security policy according to the changes in real-time traffic patterns and emerging security threats.

8. An electronic device, characterized in that: The electronic device includes a memory, a processor, and a program stored in the memory and executable on the processor. When the program is executed by the processor, the distributed network security monitoring method described in any one of claims 5 to 7 is implemented.

9. A computer-readable storage medium having a program stored thereon, wherein when the program is executed by a processor, the distributed network security monitoring method according to any one of claims 5 to 7 is implemented.

Images