Network security monitoring device data processing system and processing method based on plug-in framework, and network security monitoring device

Abstract

The invention relates to the technical field of power systems, and provides a network security monitoring device data processing system and method based on a plug-in framework and a network security monitoring device.The processing system comprises a master station platform, the network security monitoring device and heterogeneous equipment; the network security monitoring device comprises a core framework layer and a plug-in layer. The core framework layer comprises a first plug-in engine and a second plug-in engine; the plug-in layer comprises at least one acquisition and analysis plug-in and at least one uploading adaptive plug-in, the acquisition and analysis plug-in and the uploading adaptive plug-in are configured to be loaded and managed by the first plug-in engine, and functions of the plug-in layer are completed by calling a capability interface provided by the second plug-in engine; and the master station platform is connected with the network security monitoring device and is used for receiving the uploaded security data. According to the method, monitored equipment of different manufacturers and different formats can be dynamically adapted through a modularized plug-in, and the method can be flexibly adapted to superior master station platforms of different versions and different specifications.

Description

Technical Field

[0001] This invention relates to the field of power system technology, and in particular to a data processing system, processing method, and network security monitoring device based on a plug-in framework. Background Technology

[0002] In power monitoring systems, network security monitoring devices are core security equipment deployed at the local area network (LAN) level. They collect real-time security information data from various network devices, including servers, workstations, switches, routers, firewalls, intrusion detection systems, and encryption devices, through methods such as host proxy, network traffic mirroring, SNMP, and Syslog. This data is used to analyze network topology, detect suspicious behavior, and exchange data with the higher-level network security monitoring platform.

[0003] Currently, power monitoring systems face the challenge of highly heterogeneous equipment, mainly in two aspects: First, there is the diversity of equipment: equipment from different manufacturers varies significantly in hardware architecture, operating system, resource performance, and communication protocols. Secondly, there is data heterogeneity: different devices support different data acquisition methods (such as SNMP Trap, Syslog, CLI command line, NetFlow, etc.), and the data formats, field definitions, and encoding methods also vary greatly. Although there are international standards or industry specifications that recommend (such as a unified Syslog format and the use of standard OIDs for SNMP), in actual applications, there are many proprietary extensions and differences in the implementations of different vendors.

[0004] The current mainstream technical solution is to establish a unified data collection standard, requiring equipment manufacturers to output standard data that conforms to this standard. However, this solution has significant drawbacks: (Drawback 1) Poor compatibility. Legacy equipment and equipment from most small and medium-sized manufacturers are difficult to meet the new standard, resulting in numerous blind spots in the monitoring scope and hindering the effectiveness of network security monitoring. (Drawback 2) Difficulty in upgrading and maintenance. When the data collection standard changes or is upgraded, all equipment manufacturers need to be coordinated to make simultaneous modifications, resulting in a large workload, long cycle, high cost, and difficult implementation. (Drawback 3) Rigid master station adaptation. After data processing, it needs to be sent to higher-level master station platforms with different versions and standards. Existing devices usually use hard coding to adapt to a single master station standard, making it difficult to flexibly respond to the needs of master station platform upgrades or simultaneous connection to multiple differentiated master stations.

[0005] Therefore, there is an urgent need for a technical solution that can flexibly and efficiently solve the problems of multi-source heterogeneous data acquisition and multi-master station adaptation. Summary of the Invention

[0006] In response to the technical problems mentioned above regarding how to flexibly and efficiently solve the problems of multi-source heterogeneous data acquisition and multi-master station adaptation, this invention provides a network security monitoring device data processing system, processing method, and network security monitoring device based on a plug-in framework.

[0007] In a first aspect, the present invention proposes a network security monitoring device data processing system based on a plug-in framework, characterized in that it includes: a main station platform 10, a network security monitoring device 20, and heterogeneous devices 30; The network security monitoring device 20 includes a core framework layer and a plug-in layer; The core framework layer includes a first plug-in engine 21 and a second plug-in engine 22; The plugin layer includes at least one data acquisition and parsing plugin and at least one data upload and adaptation plugin. The data acquisition and parsing plugin and the data upload and adaptation plugin are configured to be loaded and managed by the first plugin engine 21 and to perform their functions by calling the capability interfaces provided by the second plugin engine 22. The heterogeneous devices 30 include host devices 31, security devices 32 and network devices 33, and are respectively connected to the network security monitoring device 20 through the network; The main station platform 10 is connected to the network security monitoring device 20 via a network and is used to receive the transmitted security data.

[0008] This application defines the physical components and logical modules required for data acquisition and analysis at the system architecture level, clarifies the connection relationship between the network security monitoring device and heterogeneous devices and the main station platform, as well as the collaboration mechanism between the core framework and plug-ins within the device, providing a structural foundation for the entire technical solution.

[0009] In some embodiments, the first plugin engine 21 is used to provide plugin lifecycle management, including loading, initialization, execution and unloading; the second plugin engine 22 is used to provide common basic services, including data caching, task scheduling, communication bus and capability execution interface.

[0010] This embodiment refines the key service functions of the core framework layer, ensuring that plugins can execute in a stable, efficient, and unified runtime environment, thus guaranteeing the overall reliability and performance of the system.

[0011] In some embodiments, the acquisition and parsing plugin internally encapsulates the acquisition instructions, data parsing rules, or data processing logic required to adapt to a specific manufacturer and model of device in the heterogeneous device 30. The acquisition instructions inside the acquisition and parsing plugin are implemented through the acquisition capabilities provided by the second plugin engine 22; The data parsing rules inside the acquisition and parsing plugin are implemented through the parsing capabilities provided by the second plugin engine 22; The data processing logic is implemented through the processing capabilities provided by the second plug-in engine 22.

[0012] This embodiment clarifies the internal structure and independence of the acquisition and parsing plugin, and emphasizes its characteristic of realizing specific device adaptation logic by combining basic capabilities. This is the key to achieving "plug and play" and reducing coupling.

[0013] In some embodiments, the upload adapter plugin internally encapsulates the logic for converting internal standard data formats into the data formats required by the main site platform and for uploading via a specific protocol; and the upload adapter plugin achieves its data conversion and upload functions by combining the processing and upload capabilities provided by the second plugin engine.

[0014] This embodiment clarifies the internal structure and independence of the upload adapter plugin, and emphasizes its characteristic of realizing specific master site adaptation logic by combining basic capabilities, which is the key to achieving flexible multi-master site docking.

[0015] Secondly, this invention also proposes a data processing method for a network security monitoring device based on a plug-in framework, comprising the following steps: Step S1: Load at least one data acquisition and parsing plugin and at least one data upload and adaptation plugin into the core framework layer of the network security monitoring device; the data acquisition and parsing plugin encapsulates the data acquisition and parsing capabilities for adapting to the heterogeneous devices being monitored; the data upload and adaptation plugin encapsulates the processing and data upload capabilities for adapting to the main station platform. Step S2: Collect or receive raw security data from the monitored heterogeneous device using the collection and parsing plugin. Step S3: Using the parsing capabilities of the acquisition and parsing plugin, the raw security data is parsed into standard data middleware that conforms to the set specifications; Step S4: The core framework layer performs unified security analysis and processing on the standard data middleware; Step S5: Using the processing and uploading capabilities of the upload adapter plugin, the standard data middleware after unified security analysis and processing is converted into a standard data middleware of the target data format, and the standard data middleware of the target data format is uploaded to the main station platform through the specified communication protocol; wherein, the target data format is the data format required by the main station platform.

[0016] This application can dynamically adapt to monitored devices of different manufacturers and formats through modular plugins, and can flexibly adapt to different versions and specifications of the superior master station platform, thereby avoiding the problem of global code changes caused by changes in equipment or master station.

[0017] In some embodiments, the acquisition and parsing plugin encapsulates the acquisition, parsing, and processing capabilities for adapting to the heterogeneous devices being monitored. The step of using the parsing capabilities of the acquisition and parsing plugin to parse and process the raw security data into standard data middleware that conforms to set specifications includes: The raw security data is parsed and processed into standard data middleware that conforms to the set specifications through the parsing and processing capabilities of the acquisition and parsing plugin. The processing capability of the acquisition and parsing plugin is used to perform one of the following processes on the data parsed by the acquisition and parsing plugin: standardization transformation, event level mapping, and data enrichment processing. In some embodiments, the acquisition and parsing plugin achieves adaptation to the monitored heterogeneous devices by combining at least one of the following capabilities: Capabilities include SNMP data collection, SSH data collection, Syslog monitoring, CLI command-line data collection, and NetFlow data collection. In addition, data can be parsed and processed by combining at least one of the following capabilities: It has capabilities for regular expression parsing, JSON parsing, XML parsing, custom parsing, IP address translation, timestamp standardization, event level mapping, and data enrichment.

[0018] This embodiment clarifies the specific composition of the plugin function. By breaking down the complex data acquisition and parsing process into independent and reusable basic capabilities, it achieves the refinement and feasibility of the technical solution, and ensures the flexibility and standardization of plugin development.

[0019] In some embodiments, the upload adaptation plugin achieves adaptation to the main site platform by combining at least one of the following capabilities: IP address translation capabilities, timestamp standardization capabilities, event level mapping capabilities, and data enrichment capabilities; In addition, data can be uploaded by combining at least one of the following capabilities: It has MQTT publishing capabilities, specific protocol message encapsulation capabilities, and private TCP protocol transmission capabilities.

[0020] This embodiment clarifies the specific composition of the upload function, ensuring that the device can flexibly cope with the differences in data format and transmission protocol between different master station platforms, and achieve parallel adaptation with multiple master stations.

[0021] In some embodiments, prior to the step of loading at least one data acquisition and parsing plugin and at least one data upload adapter plugin into the core framework layer of the network security monitoring device, the method further includes: The management interface of the network security monitoring device responds to the user-specified configuration of the corresponding data acquisition and parsing plugin for each monitored heterogeneous device, and configures the corresponding upload adaptation plugin for each master station platform connection specified by the user.

[0022] This embodiment enables flexible activation and combination of required plug-ins based on the actual equipment list on site and the requirements of the main station, thereby achieving on-demand empowerment and personalized deployment of the device.

[0023] Thirdly, this application also provides a network security monitoring device, including: a hardware layer, an operating system layer, a core framework layer, and a plug-in layer; The hardware layer provides computing, storage, and network communication hardware resources for the network security monitoring device; the operating system layer runs on top of the hardware layer, manages the hardware resources, and provides a runtime environment for upper-layer applications; wherein, the upper-layer applications represent all components of the core framework layer and the plug-in layer. The core framework layer is used to provide plugin lifecycle management, common basic services, and standardized interface definitions; The plugin layer includes at least one data acquisition and parsing plugin and at least one data upload and adaptation plugin; the data acquisition and parsing plugin and the data upload and adaptation plugin are configured to be loaded and managed by the core framework layer, and to perform their functions by calling the standardized interfaces and capability execution interfaces provided by the core framework layer.

[0024] The network security monitoring device provided in this application defines the physical and logical components required to implement the method from the system architecture level, clarifies the relationship between the core framework and plug-ins in terms of management and being managed, and service provision and service use, and provides a structural foundation for the entire technical solution. Attached Figure Description

[0025] To more clearly illustrate the technical solutions in the embodiments of this application, the drawings used in the description of the embodiments or the prior art will be briefly introduced below. Obviously, the drawings described below are only some embodiments of this application. For those skilled in the art, other drawings can be obtained based on these drawings without creative effort.

[0026] Figure 1This is a schematic diagram of an embodiment of the network security monitoring device data processing system based on a plug-in framework provided by the present invention; Figure 2 This is a flowchart illustrating the data processing method of a network security monitoring device based on a plug-in framework provided in an embodiment of the present invention. Figure 3 This is a schematic diagram illustrating the combination of the data processing method and system for a network security monitoring device based on a plug-in framework, as proposed in an embodiment of the present invention. Figure 4 This is a schematic diagram illustrating a specific application scenario of the network security monitoring device data processing system based on a plug-in framework provided by the present invention.

[0027] The realization of the objective, functional features and advantages of the present invention will be further explained in conjunction with the embodiments and with reference to the accompanying drawings. Detailed Implementation

[0028] It should be understood that the specific embodiments described herein are merely illustrative of the invention and are not intended to limit the invention.

[0029] In the following description, specific details such as particular system architectures and techniques are set forth for illustrative purposes and not for limitation, in order to provide a thorough understanding of the embodiments of this application. However, those skilled in the art will understand that this application may also be implemented in other embodiments without these specific details. In other instances, detailed descriptions of well-known systems, apparatuses, and methods have been omitted so as not to obscure the description of this application with unnecessary detail.

[0030] It should be understood that, when used in this application specification and the appended claims, the term "comprising" indicates the presence of the described features, integrals, steps, operations, elements and / or components, but does not exclude the presence or addition of one or more other features, integrals, steps, operations, elements, components and / or a collection thereof.

[0031] It should also be understood that the term “and / or” as used in this application specification and the appended claims means any combination of one or more of the associated listed items and all possible combinations, and includes such combinations.

[0032] Furthermore, in the description of this application and the appended claims, the terms "first," "second," "third," etc., are used only to distinguish descriptions and should not be construed as indicating or implying relative importance.

[0033] References to "one embodiment" or "some embodiments" as described in this specification mean that one or more embodiments of this application include a specific feature, structure, or characteristic described in connection with that embodiment. Therefore, the phrases "in one embodiment," "in some embodiments," "in other embodiments," "in still other embodiments," etc., appearing in different parts of this specification do not necessarily refer to the same embodiment, but rather mean "one or more, but not all, embodiments," unless otherwise specifically emphasized. The terms "comprising," "including," "having," and variations thereof mean "including but not limited to," unless otherwise specifically emphasized.

[0034] Firstly, such as Figure 1 As shown, this application provides a network security monitoring device data processing system based on a plug-in framework, including: a main station platform (10), a network security monitoring device (20), and heterogeneous devices (30); the network security monitoring device (20) includes a hardware layer, an operating system layer, a core framework layer, and a plug-in layer; the core framework layer includes a first plug-in engine (21) and a second plug-in engine (22); the plug-in layer includes at least one data acquisition and parsing plug-in and at least one data upload and adaptation plug-in, the data acquisition and parsing plug-in and the data upload and adaptation plug-in are configured to be loaded and managed by the first plug-in engine block (21), and to complete their functions by calling the capability interface provided by the second plug-in engine (22); the heterogeneous devices (30) include host devices (31), security devices (32), and network devices (33), and are connected to the network security monitoring device (20) through a network; the main station platform (10) is connected to the network security monitoring device (20) through a network and is used to receive uploaded security data.

[0035] It should be noted that the network security monitoring device (20) of this application embodiment, the core processing unit of this system, adopts a layered design, including: Hardware layer and operating system layer: provide the device with basic computing, storage and network resources, as well as the system operating environment; The core framework layer is the "brain" and "skeleton" of the network security monitoring device (20). It further comprises two key modules: The first plugin engine 21 may include a plugin runtime management module: this module is used to provide plugin lifecycle management [Zhang Rui 1], and it is responsible for the loading, initialization, execution scheduling, and unloading of all plugins (collection and parsing plugins and upload and adaptation plugins). In step S1 of the method embodiment of the second aspect below, it is this module that completes the loading of the plugin.

[0036] The second plugin engine 22 may include a capability interface service module [Zhang Rui 2]. This module provides common basic services and standardized interface definitions. It provides public services such as data caching, task scheduling, and communication bus. More importantly, it defines various capability execution interfaces such as acquisition, parsing, processing, and uploading. Plugins obtain and execute specific capabilities by calling these standardized interfaces, thereby achieving decoupling.

[0037] The plugin layer consists of multiple independent plugin packages, each of which is an independent functional module. For example, the plugin layer may include acquisition and parsing plugins such as Plugin_FW_VendorC_ModelY, and upload adaptation plugins such as Plugin_Master_Provincial_V2.1. They are managed by the plugin engine - plugin runtime management module (21) and perform their functions by calling the capability interfaces provided by the plugin engine - capability interface service module (22).

[0038] In some embodiments [D3], the acquisition and parsing plugin is an independent functional module that encapsulates the acquisition instructions, communication parameters, data parsing rules, and data processing logic required to adapt to a specific manufacturer's model device. It is implemented by combining the acquisition capabilities, parsing capabilities, and optional processing capabilities provided by the plugin engine-capability interface service module (22). This embodiment clarifies the internal structure and independence of the acquisition and parsing plugin, emphasizing its characteristic of implementing specific device adaptation logic through the combination of basic capabilities. This is key to achieving "plug and play" and reducing coupling.

[0039] In some embodiments, the upload adapter plugin [D4] is an independent functional module that encapsulates the logic for converting internal standard data formats into the data formats required by a specific master station platform and uploading them via a specific protocol. This is achieved by combining the processing and upload capabilities provided by the plugin engine-capability interface service module (22). This embodiment clarifies the internal structure and independence of the upload adapter plugin and emphasizes its characteristic of achieving specific master station adaptation logic through the combination of basic capabilities. This is the key to achieving flexible multi-master station integration.

[0040] It should be noted that the main station platform 10 in this embodiment belongs to the superior monitoring center and is the destination of security data. In specific implementations, there may be multiple main stations with different versions and specifications. (See appendix...) Figure 1 The image shows main station platform 1 and main station platform 2. They are connected to the network security monitoring device (20) via the network and receive security data processed and uploaded by the upload adapter plugin.

[0041] It is understood that the main station platform 10 in this application embodiment is a center for receiving, analyzing and displaying network security monitoring data. It is responsible for collecting security information from various network security monitoring devices 20, performing advanced analysis, and may issue security alarms or instructions.

[0042] The main station platform 10 communicates with the network security monitoring device 20 via a data upload protocol, receiving standard-format security data from the monitoring device. The main station platform 10 may send configuration commands or query requests to the monitoring device 20.

[0043] As a key security device at the local area network level, the network security monitoring device 20 is responsible for collecting security information data of various heterogeneous devices 30 in the network in real time, performing preliminary analysis, and sending the processed data to the main station platform. For example, the network security monitoring device 20 communicates with the heterogeneous devices 30 through various data acquisition methods (such as SNMP Trap, Syslog, CLI command line, NetFlow, etc.) to receive security logs and operational status information generated by these devices. It then uploads the processed security data in a standard format according to the specifications and requirements of the main platform.

[0044] It should be noted that the heterogeneous device 30 in this application embodiment refers to devices of different manufacturers, types, and formats in the network, including but not limited to servers, workstations, switches, routers, firewalls, intrusion detection systems, etc. Heterogeneous devices 30 are used to generate various security logs and operational status information, and send this information to network security monitoring device 20 for collection and analysis through their respective communication protocols and interfaces; In this embodiment, the heterogeneous device 30 may include host devices (such as servers and workstations), security devices (such as firewalls and intrusion detection systems), and network devices (such as firewalls and intrusion detection systems). Understandably, host devices 31 can be servers or workstations. Since host devices are core computing resources in the network, storing and processing large amounts of sensitive data, they are easily targeted by attacks. Therefore, monitoring their security status is crucial for ensuring overall network security. For example, host devices 31 can send security logs and operational status information to the network security monitoring device by installing proxy software or utilizing the operating system's log interface (such as Syslog). After collecting this information, the monitoring device 20 performs preliminary analysis to identify potential security threats.

[0045] Understandably, security device 32 can be a firewall or intrusion detection system. Since security device 32 is the first line of defense for network security, capable of directly detecting and defending against external attacks, monitoring its operational status and security events is crucial for timely detection and response to security threats. For example, security device 32 can send security events and log information to network security monitoring device 20 via Syslog, SNMP Trap, or other methods. Monitoring device 20 receives and parses this information, combining it with other data sources for comprehensive analysis to improve the accuracy and timeliness of security detection.

[0046] Understandably, network device class 33 can include switches and routers; since network device class 33 is a key component in building network infrastructure, its configuration and operational status directly affect the stability and security of the network; therefore, monitoring the security status of these network devices helps to promptly detect network faults and potential security risks. For example, network device class 33 can provide configuration and operational status information via SNMP, CLI command line, etc.; the network security monitoring device 20 acquires this information through SNMP or CLI command line acquisition capabilities, performs standardized processing and analysis, and provides a basis for network management and security policy adjustments.

[0047] The interactions between these heterogeneous devices and network security monitoring devices described in this example together constitute a network security monitoring system for power monitoring systems or other critical infrastructure industries, ensuring the overall security and stability of the network.

[0048] In practical applications, Figure 4 The provincial and regional dispatch master stations in the embodiments are specific application scenario examples; taking the collection of a non-standard Syslog format firewall log and its uploading to two different master stations as an example: (1) The network security monitoring device is deployed in the network center and connected to the Y-type firewall of manufacturer C. It needs to upload data to the provincial dispatch master station (V2.1 version) and the regional dispatch master station (V1.5 version) at the same time. (2) Load and enable a collection and parsing plugin and two upload adaptation plugins.

[0049] The beneficial effects of the system in this application embodiment are as follows: through the above system architecture, the adaptation logic for specific devices and specific master stations is separated into independent plugins, while the core framework focuses on general management and scheduling, thereby achieving extremely high system compatibility, scalability and maintenance convenience.

[0050] This application defines the physical components and logical modules required for data acquisition and analysis at the system architecture level, clarifies the connection relationship between the network security monitoring device and heterogeneous devices and the main station platform, as well as the collaboration mechanism between the core framework and plug-ins within the device, providing a structural foundation for the entire technical solution.

[0051] Furthermore, it should be noted that this application is mainly applied to the field of substation automation in power systems, but the invention as a whole can also be applied in multiple fields and products: In some embodiments, this system can be applied to power industry network monitoring systems: Application scenarios can include: power plants, substations, and power distribution networks.

[0052] Application Method: Within the local area networks of monitoring systems (such as SCADA systems and DCS systems) at various stages of power production, transmission, and distribution. It adapts to and collects security logs, operational status, performance indicators, and network traffic metadata from various manufacturers' power-specific equipment (such as protection and control devices, smart meters, and power-specific communication gateways), general network equipment (switches, routers), security equipment (firewalls, intrusion detection systems), and host servers (Unix / Linux / Windows workstations, servers). Simultaneously, or as needed, it adapts to the network security monitoring platforms of different provincial grid companies and different batches of dispatch master stations to ensure compliant data transmission.

[0053] In other embodiments, this system can be applied to industrial control systems (ICS) and industrial internet: Application scenarios can include key infrastructure industries such as oil and petrochemicals, rail transportation, water conservancy and water affairs, intelligent manufacturing, and tobacco.

[0054] Application Method: By developing dedicated plugins, safety data from industrial control equipment such as PLCs (Programmable Logic Controllers), RTUs (Remote Terminal Units), DCSs (Distributed Control Systems), and CNCs (CNC Machine Tools) is collected. These devices typically use industrial protocols such as Modbus, OPC UA, Profinet, and EtherNet / IP, and their data collection methods differ significantly from traditional IT equipment. Processed industrial control security incidents are then uploaded to the enterprise's unified security operations center (SOC) platform or industry monitoring platform.

[0055] In other embodiments, this system can be applied to Internet of Things (IoT) security monitoring: Application scenarios can include: smart cities, smart buildings, smart healthcare, connected vehicles, and other IoT application scenarios.

[0056] Application method: Develop plugins to adapt to various IoT protocols (such as MQTT, CoAP, ZigBee, LoRaWAN) and sensor devices, collecting security information such as device connection behavior, abnormal commands, and data traffic. Report IoT security threat incidents to the IoT security operations platform.

[0057] Secondly, such as Figure 2As shown, this application provides a data processing method for a network security monitoring device based on a plug-in framework, including the following steps S1-S5: Step S1: Load at least one data acquisition and parsing plugin and at least one data upload and adaptation plugin into the core framework layer of the network security monitoring device; the data acquisition and parsing plugin encapsulates the data acquisition capabilities, parsing capabilities, and optional processing capabilities for adapting to the heterogeneous devices being monitored; the data upload and adaptation plugin encapsulates the processing capabilities and data upload capabilities for adapting to the main station platform. Understandably, this step is a core prerequisite for implementing plug-in functionality; in some embodiments, as shown in the appendix... Figure 3 As shown in the initial configuration phase (A10), it may include: developing / acquiring functional capabilities → combining capabilities to build plugins → loading plugins into the network security monitoring device → configuring the mapping relationship between the device / main station and the plugins.

[0058] The core framework layer of the network security monitoring device (specifically managed by its first plug-in engine 21 - plug-in operation management module) is configured to dynamically load and manage plug-ins. For example, the core framework layer can load a data acquisition and parsing plugin Plugin_FW_VendorC_ModelY and two upload adapter plugins Plugin_Master_Provincial_V2.1 and Plugin_Master_Local_V1.5.

[0059] In practical applications, refer to Figure 4 This embodiment encapsulates the acquisition and parsing plugin as follows: A acquisition and parsing plugin is a combination of acquisition capabilities, parsing capabilities, and (optionally) processing capabilities: See reference Figure 4 The data acquisition and parsing plugin, Plugin_FW_VendorC_ModelY, encapsulates Syslog listening capabilities, dedicated regular expression parsing capabilities, and event level mapping capabilities. Internally, it contains all the instructions, parameters, and logic required to adapt to "Vendor C's Y-type firewall."

[0060] In practical applications, this embodiment encapsulates the upload adapter plugin as follows: an upload adapter plugin is a combination of processing capability and upload capability: see reference Figure 4 The first upload adapter plugin, Plugin_Master_Provincial_V2.1, encapsulates the processing capability of message encapsulation according to the provincial dispatch V2.1 specification and the private TCP protocol transmission capability; the second upload adapter plugin, Plugin_Master_Local_V1.5, encapsulates the processing capability of generating CSV format and the SFTP transmission capability.

[0061] Step S2: Collect or receive raw security data from the corresponding monitored heterogeneous devices using the collection and parsing plugin. It is understood that this step is the data entry point; in some embodiments, as shown in the appendix... Figure 3 The data acquisition (A20 start section) "Listening or requesting data → Receiving raw heterogeneous data" shows that the core framework schedules the enabled acquisition and parsing plugin Plugin_FW_VendorC_ModelY. This acquisition and parsing plugin calls its encapsulated acquisition capabilities (e.g., Syslog listening capability, which continuously listens on UDP port 514). When a specific monitored heterogeneous device (e.g., "Vendor C's Y-type firewall") belongs to the attached... Figure 1 Security equipment 32 of heterogeneous device 30 generates a security event log (e.g.: <134> When the message "2023-10-27T10:00:01 FW-ModelY Critical: TCP deny from 192.168.1.100 to 10.0.0.5" was sent using the Syslog protocol, the acquisition and parsing plugin successfully received this raw security data.

[0062] Step S3: Using the parsing capabilities and optional processing capabilities in the acquisition and parsing plugin, the raw security data is parsed and processed into standard data middleware that conforms to the set specifications; Understandably, this step standardizes the data; following step S2, corresponding to... Figure 3 Step A20 (parsing stage): Call the corresponding acquisition and parsing plugin → output intermediate format data.

[0063] Upon receiving the raw data, the acquisition and parsing plugin immediately invokes its encapsulated parsing and / or processing capabilities. For example, by invoking regular expression parsing capabilities and applying a pre-configured pattern (\d+\.\d+\.\d+\.\d+).*?deny.*?dst=(\d+\.\d+\.\d+\.\d+), key fields are extracted from the raw logs of the original security data. For instance, the source IP address (192.168.1.100) and destination IP address (10.0.0.5) are extracted from the raw logs.

[0064] It should be noted that the "processing capability" of the data acquisition and parsing plugin is optional; removing it will not prevent the core functionality of this application from being implemented. This is because the core task of the data acquisition and parsing plugin is to convert raw heterogeneous data into standard data middleware. The acquisition capability of the data acquisition and parsing plugin, responsible for acquiring data, is essential. The parsing capability of the data acquisition and parsing plugin, responsible for extracting meaningful fields from the raw data, is also essential.

[0065] The data acquisition and parsing plugin's processing capabilities include secondary processing of the extracted fields (such as format conversion, level mapping, and data enrichment). In some implementation scenarios, the parsed fields may already conform to internal standards and require no further processing.

[0066] For example, consider a firewall log level of "Critical" that needs to be mapped to the standard number "5". In this case, event level mapping capability (a processing capability) is necessary. By invoking the event level mapping capability, the firewall's private level "Critical" is mapped to the device's internally defined standard level "5". After processing by the acquisition and parsing plugin's parsing and processing capabilities, the raw heterogeneous data is transformed into a standardized data middleware with a unified format and standardized fields. For examples where the data acquisition and parsing plugin does not require processing capabilities, such as a device directly outputting a standard OID value via SNMP, the value itself is already a number with a clear meaning. After parsing, it can be used as part of standard data middleware without any conversion. In this case, the data acquisition and parsing plugin may only consist of SNMP acquisition capabilities and JSON parsing capabilities, and can complete the task without "processing capabilities".

[0067] Step S4: The core framework layer performs unified security analysis and processing on the standard data middleware; It is understood that this step is a core security function; in some embodiments, this step may be as shown in the appendix. Figure 3 As shown in the core data processing stage (A30), the process involves receiving intermediate format data → unified data security analysis (event correlation, aggregation, judgment, etc.) → generating standardized security events / data. The core framework layer (mainly supported by the second plug-in engine - capability interface service module 22, providing computing, storage, and other services) receives the standard data middleware generated in step S3. Since the data is already in a standard format, the core framework layer can perform efficient and unified security analysis and processing on it. For example, these security analyses and processes may include operations such as event correlation (e.g., associating multiple login failures with brute-force attacks), log aggregation, and data enrichment (e.g., using this step to query the built-in asset library and enrich the source IP address 192.168.1.100 as "a certain business server"), ultimately generating enhanced, standardized security events to be submitted.

[0068] Step S5: Using the processing and uploading capabilities of the upload adapter plugin, the standard data middleware after unified security analysis and processing is converted into a standard data middleware of the target data format, and the standard data middleware of the target data format is uploaded to the main station platform through the specified communication protocol; wherein, the target data format is the data format required by the main station platform.

[0069] This step enables data export, as shown in the attached document. Figure 2 As shown in the data upload stage (A40), the target main site calls the corresponding upload plugin → executes the logic within the plugin (format conversion + protocol encapsulation) → uploads data conforming to the specifications to the main site: In practical applications, the core framework routes the same standard security event processed in step S4 to two upload adapter plugins configured for the user: refer to Figure 4 For the first upload adapter plugin, Plugin_Master_Provincial_V2.1: it utilizes its processing capabilities (such as encapsulating data into a specific JSON structure according to the provincial V2.1 specification) and upload capabilities (private TCP protocol transmission capabilities) to upload the data. Figure 4 The provincial main station (belonging to the attached station) Figure 1 One of the 10 main platforms in China.

[0070] For the second upload adapter plugin, Plugin_Master_Local_V1.5: it utilizes its different processing capabilities (converting data to CSV format) and upload capabilities (SFTP transfer capability) to upload the same data to the main dispatch station (belonging to the auxiliary station). Figure 1 (Part 2 of 10 of the main platform). This achieves the technical effect of "one set of data, multiple adaptations", solving the problem of flexible connection between multiple main platforms.

[0071] The technical effect of this embodiment is that it can solve the problem of how to dynamically adapt to monitored devices of different manufacturers and formats through modular plug-ins, and how to flexibly adapt to upper-level main station platforms of different versions and specifications, avoiding the problem of global code modification caused by changes in devices or main station.

[0072] In some embodiments, for step S1 above, the acquisition and parsing plugin adapts to the monitored heterogeneous device by combining at least one of the following capabilities: SNMP data collection capabilities, SSH data collection capabilities, Syslog monitoring capabilities, CLI command-line data collection capabilities, and NetFlow data collection capabilities; In addition, data can be parsed and processed by combining at least one of the following capabilities: It has capabilities for regular expression parsing, JSON parsing, XML parsing, custom parsing, IP address conversion, timestamp standardization, event level mapping, and data enrichment.

[0073] This example clarifies the specific components of a plugin's functionality. By breaking down the complex data acquisition and parsing process into independent, reusable basic capabilities, it achieves a refined and feasible technical solution, ensuring the flexibility and standardization of plugin development.

[0074] In some embodiments, for step S1 above, the upload adaptation plugin achieves adaptation to the main site platform by combining at least one of the following capabilities: IP address translation capability, timestamp standardization capability, event level mapping capability, and data enrichment capability; In addition, data can be uploaded by combining at least one of the following capabilities: It has MQTT publishing capabilities, specific protocol message encapsulation capabilities, and private TCP protocol transmission capabilities.

[0075] This example clarifies the specific components of the upload function, ensuring that the device can flexibly cope with the differences in data format and transmission protocol between different master station platforms, and achieve parallel adaptation with multiple master stations.

[0076] In some embodiments, prior to step S1, the method further includes: Step S0: Through the management interface of the network security monitoring device, configure the corresponding acquisition and parsing plugin for each monitored heterogeneous device specified by the user, and configure the corresponding upload adapter plugin for each master station platform connection specified by the user.

[0077] This example demonstrates how to flexibly enable and combine required plugins based on the actual equipment list and master station requirements on-site, thereby enabling on-demand empowerment and personalized deployment of the device.

[0078] Thirdly, this application also provides a network security monitoring device, including: a hardware layer, an operating system layer, a core framework layer, and a plug-in layer; The hardware layer provides computing, storage, and network communication hardware resources for the network security monitoring device; the operating system layer runs on top of the hardware layer, manages the hardware resources, and provides a runtime environment for upper-layer applications; wherein, the upper-layer applications represent all components of the core framework layer and the plug-in layer. The core framework layer is used to provide plugin lifecycle management, common basic services, and standardized interface definitions; The plugin layer includes at least one data acquisition and parsing plugin and at least one data upload and adaptation plugin; the data acquisition and parsing plugin and the data upload and adaptation plugin are configured to be loaded and managed by the core framework layer, and to perform their functions by calling the standardized interfaces and capability execution interfaces provided by the core framework layer.

[0079] This embodiment of the network security monitoring device defines the physical and logical components required to implement the method from the system architecture level, clarifies the relationship between the core framework and plug-ins in terms of management and being managed, and service provision and service use, and provides a structural foundation for the entire technical solution.

[0080] The above description, in conjunction with specific preferred embodiments, provides a further detailed explanation of the present invention and should not be construed as limiting the specific implementation of the invention to these descriptions. For those skilled in the art, various simple deductions or substitutions can be made without departing from the inventive concept, and all such modifications and substitutions should be considered within the scope of protection of the present invention. That is, the processing control optimization method for intelligent manufacturing proposed in this invention can be applied to other intelligent manufacturing processes. In any scenario involving limited computing power and storage memory, the neural network architecture search method mentioned in this invention can be used to construct parameter prediction models that run on computing devices that meet these constraints.

Claims

1. A data processing system for a network security monitoring device based on a plug-in framework, characterized in that, include: The main station platform (10), network security monitoring device (20), and heterogeneous equipment (30); The network security monitoring device (20) includes a core framework layer and a plug-in layer; The core framework layer includes a first plug-in engine (21) and a second plug-in engine (22); The plugin layer includes at least one acquisition and parsing plugin and at least one upload and adaptation plugin. The acquisition and parsing plugin and the upload and adaptation plugin are configured to be loaded and managed by the first plugin engine (21) and to perform their functions by calling the capability interface provided by the second plugin engine (22). The heterogeneous devices (30) include host devices (31), security devices (32) and network devices (33), and are respectively connected to the network security monitoring device (20) through the network; The main station platform (10) is connected to the network security monitoring device (20) via the network to receive the transmitted security data.

2. The system according to claim 1, characterized in that, The first plugin engine (21) is used to provide plugin lifecycle management, including loading, initialization, execution and unloading; the second plugin engine (22) is used to provide common basic services, including data caching, task scheduling, communication bus and capability execution interface.

3. The system according to claim 1, characterized in that, The acquisition and parsing plugin internally encapsulates the acquisition instructions, data parsing rules, or data processing logic required to adapt to a specific model of device in the heterogeneous device (30); The acquisition instructions inside the acquisition and parsing plugin are implemented through the acquisition capabilities provided by the second plugin engine (22); The data parsing rules inside the acquisition and parsing plugin are implemented through the parsing capabilities provided by the second plugin engine (22); The data processing logic is implemented through the processing capabilities provided by the second plug-in engine (22).

4. The system according to claim 1, characterized in that, The upload adapter plugin internally encapsulates the logic for converting internal standard data formats into the data formats required by the main site platform and uploading them through a specific protocol; and the upload adapter plugin achieves its data conversion and upload functions by combining the processing and upload capabilities provided by the second plugin engine.

5. A data processing method for a network security monitoring device based on a plug-in framework, characterized in that, Includes the following steps: At least one data acquisition and parsing plugin and at least one data upload and adaptation plugin are loaded into the core framework layer of the network security monitoring device; the data acquisition and parsing plugin encapsulates the data acquisition and parsing capabilities for adapting to the heterogeneous devices being monitored; the data upload and adaptation plugin encapsulates the processing and data upload capabilities for adapting to the main station platform. Raw security data is collected or received from the monitored heterogeneous devices using the collection and parsing plugin. The raw security data is parsed into standard data middleware that conforms to the set specifications through the parsing capabilities of the acquisition and parsing plugin. The core framework layer performs unified security analysis and processing on the standard data middleware. Through the processing and uploading capabilities of the aforementioned upload adapter plugin, the standard data middleware, after unified security analysis and processing, is converted into a standard data middleware in the target data format, and then uploaded to the main station platform via a specified communication protocol; wherein, the target data format is the data format required by the main station platform.

6. The method according to claim 5, characterized in that, The acquisition and parsing plugin encapsulates the acquisition, parsing, and processing capabilities for adapting to the heterogeneous devices being monitored. The step of using the parsing capabilities of the acquisition and parsing plugin to parse and process the raw security data into standard data middleware that conforms to set specifications includes: The raw security data is parsed and processed into standard data middleware that conforms to the set specifications through the parsing and processing capabilities of the acquisition and parsing plugin. The processing capability of the acquisition and parsing plugin is used to perform one of the following processes on the data parsed by the acquisition and parsing plugin: standardization transformation, event level mapping, and data enrichment processing.

7. The method according to claim 5 or 6, characterized in that, The acquisition and parsing plugin achieves adaptation to the monitored heterogeneous devices by combining at least one of the following capabilities: Capabilities include SNMP data collection, SSH data collection, Syslog monitoring, CLI command-line data collection, and NetFlow data collection. In addition, data can be parsed and processed by combining at least one of the following capabilities: It has capabilities for regular expression parsing, JSON parsing, XML parsing, custom parsing, IP address translation, timestamp standardization, event level mapping, and data enrichment.

8. The method according to claim 5 or 6, characterized in that, The upload adaptation plugin achieves adaptation to the main site platform by combining at least one of the following capabilities: IP address translation capabilities, timestamp standardization capabilities, event level mapping capabilities, and data enrichment capabilities; In addition, data can be uploaded by combining at least one of the following capabilities: It has MQTT publishing capabilities, specific protocol message encapsulation capabilities, and private TCP protocol transmission capabilities.

9. The method according to claim 5 or 6, characterized in that, Before the step of loading at least one data acquisition and parsing plugin and at least one data upload adapter plugin into the core framework layer of the network security monitoring device, the method further includes: The management interface of the network security monitoring device responds to the user-specified configuration of the corresponding data acquisition and parsing plugin for each monitored heterogeneous device, and configures the corresponding upload adaptation plugin for each master station platform connection specified by the user.

10. A network security monitoring device, characterized in that, include: Hardware layer, operating system layer, core framework layer, and plugin layer; The hardware layer is used to provide computing, storage, and network communication hardware resources for the network security monitoring device; The operating system layer runs on top of the hardware layer and is used to manage the hardware resources and provide a runtime environment for upper-layer applications; wherein, the upper-layer applications represent all components of the core framework layer and the plug-in layer; The core framework layer is used to provide plugin lifecycle management, common basic services, and standardized interface definitions; The plugin layer includes at least one data acquisition and parsing plugin and at least one data upload and adaptation plugin; the data acquisition and parsing plugin and the data upload and adaptation plugin are configured to be loaded and managed by the core framework layer, and to perform their functions by calling the standardized interfaces and capability execution interfaces provided by the core framework layer.

Images