Unified engine management method, apparatus, device, and storage medium

Abstract

The application relates to the technical field of network security, in particular to a unified engine management method, device and equipment and a storage medium, the method comprises the following steps: receiving engine registration information, updating a bus message configuration table; loading the bus message table and establishing a stable communication link; obtaining accurate data source configuration from a data source configuration item; receiving data packet forwarding information, and differentiating offline data packets and online data packets; obtaining an engine scheduling strategy suitable for an adaptation scene, sending data packets through a message bus, triggering an alarm with details and caching in an abnormal state; receiving back-end multi-type detection result information, and providing visual display and multi-dimensional management; judging whether a custom alarm processing strategy is configured; the application realizes unified integrated management of multi-vendor and multi-functional network security detection engines, provides a unified engine integrated framework, supports unified integrated management of the engines, has good scalability and openness, and supports unified collection and management of state information reported by the engines.

Description

Technical Field

[0001] This invention relates to the field of network security technology, and in particular to a unified engine management method, apparatus, device, and storage medium. Background Technology

[0002] With the increasing prevalence of network applications, network worms, DoS / DDoS attacks, and other threats to normal network operations are becoming more and more prevalent. As a result, various engines for detecting abnormal behaviors that threaten network security have emerged in the industry. How to unify the management of these engines with different functions from different vendors has become an urgent problem to be solved, thus requiring a unified engine management method. Summary of the Invention

[0003] The purpose of this invention is to overcome the shortcomings of existing network security engine decentralized management, such as poor compatibility, inefficient scheduling, insufficient processing capacity, complex management, and delayed alarms. It provides a unified engine management method, device, equipment, and storage medium to achieve seamless integration and efficient management of multi-vendor, multi-functional engines, thereby improving the overall effectiveness and response speed of network security protection.

[0004] The first aspect of the present invention provides a unified engine management method, including receiving engine registration information, the engine registration information including but not limited to engine identifier, function type, communication protocol version, data interaction format and manufacturer information, updating a bus message configuration table according to the registration information, the bus message configuration table recording the communication parameters and registration status of each engine; Load bus messages and establish a communication link; Obtain the data source configuration from the data source configuration items, which include network interface card configuration and offline data source; The system receives data packet forwarding information and determines whether the forwarded data packet is offline information. If so, it verifies the integrity and legality of the data packet; otherwise, it performs fragmentation and reassembly, protocol parsing, and feature extraction on the data packet. Obtain the engine scheduling policy, and send data packets to the target engine through the message bus according to the scheduling policy; Receive result information sent from the backend, and store, visualize, and manage the result information in multiple dimensions; Determine whether a custom alarm handling strategy is configured; if yes, execute the alarm handling task and then end the process; otherwise, end the process directly.

[0005] As one technical solution of the present invention, the loading of bus messages and establishment of communication links includes: Send a connection request to the bus containing the engine identifier and the communication protocol version; The system receives a response from the bus, which includes a connection status identifier and link parameters. When the response indicates a successful connection, receive the bus message table sent by the bus. If the response indicates a connection failure, the connection request will be resent after an interval of n seconds, with a maximum of m retries. If a retry fails, a connection error message containing the reason for the failure will be output, and an error log will be recorded.

[0006] As a technical solution of the present invention, obtaining the data source configuration from the data source configuration item includes: Send query data source configuration information containing configuration item identifiers to the data source management node; Receive the response data source configuration information returned by the data source management node, and perform format verification and validity verification on the configuration information; If the configuration information is invalid, a configuration error alarm is triggered and the user is prompted to reconfigure; if the configuration information is valid, the data source configuration is stored and synchronized to the local configuration cache.

[0007] As a technical solution of the present invention, the data packet fragmentation and reassembly, protocol parsing, and feature extraction processing includes: The DPDK technology is used to process data packets. By using the polling mode provided by DPDK to bypass the operating system kernel, the network card hardware queue is directly accessed to receive and forward data packets at high speed. At the same time, invalid data packets are removed based on preset filtering rules, and valid data packets are parsed using TCP / UDP / IP protocols and key feature fields are extracted.

[0008] As a technical solution of the present invention, the step of obtaining the engine scheduling strategy and sending data packets to the target engine through the message bus according to the scheduling strategy includes: The system monitors the data packet sending status in real time. If a data packet is detected as not being delivered after a timeout, not receiving an acknowledgment response after delivery, or being lost during transmission, it is determined to be a sending anomaly. Send alarm information, which includes the anomaly type, data packet identifier, sending time, target engine identifier, and preliminary analysis of the anomaly cause; According to the scheduling policy, abnormal data packets are cached in the local distributed cache node, and a cache validity period is set. Once communication is restored, they are resent according to priority. If communication is not restored during the cache validity period, the data packets are archived to persistent storage media.

[0009] As a technical solution of the present invention, the result information sent by the receiving backend includes encryption feature detection result information, encryption traffic intelligent detection result information, mobile application encryption traffic intelligent detection result information, VPN encryption traffic intelligent detection result information, intelligent semantic analysis threat detection result information, intelligent malicious file detection result information, threat intelligence detection result information, malicious code detection result information, network popular behavior detection and analysis result information, threat analysis result information, high-sensitivity data anomaly detection result information, probe comprehensive management result information, scalable model management result information, offline data packet technology detection and analysis result information, network full traffic efficient backtracking analysis result information, visualization modeling information, algorithm component information, deep learning module information, visual intelligent analysis module information, algorithm market module information, and model online prediction module information; The results are stored in JSON format and include result identifier, detection engine identifier, detection time, confidence score, and detailed detection conclusion.

[0010] As one technical solution of the present invention, the alarm processing task includes access blacklist management or network hierarchical blocking: The access blacklist management includes manually adding blacklist entries, automatically synchronizing the threat intelligence blacklist, and periodically cleaning up expired blacklist entries. Blacklist entries include IP addresses, domain names, port numbers, or application identifiers. The network hierarchical blocking includes port-level blocking, IP-level blocking, and application-layer blocking. Alarm information is pushed to preset recipients via email, SMS or system pop-up, and alarm processing logs are recorded at the same time.

[0011] A second aspect of the present invention provides a unified engine management device, comprising: The engine registration information module is used to receive engine registration information, which includes, but is not limited to, engine identifier, function type, communication protocol version, data interaction format and manufacturer information. The module updates the bus message configuration table according to the registration information. The bus message configuration table records the communication parameters and registration status of each engine. The communication link establishment module is used to load bus messages and establish a communication link; The data configuration module is used to obtain data source configuration from data source configuration items, which include network card configuration and offline data source; The data packet judgment module receives data packet forwarding information and determines whether the forwarded data packet is offline information. If so, it verifies the integrity and legality of the data packet; otherwise, it performs fragmentation and reassembly, protocol parsing, and feature extraction processing on the data packet. The scheduling strategy acquisition and sending module is used to acquire the engine scheduling strategy and send data packets to the target engine through the message bus according to the scheduling strategy. The result information display and management module is used to receive result information sent from the backend, and to store, visualize, and manage the result information in multiple dimensions. The alarm handling strategy judgment module is used to determine whether a custom alarm handling strategy is configured; if yes, the alarm handling task is executed and the process ends; otherwise, the process ends directly.

[0012] A third aspect of the present invention provides an electronic device, including a memory, at least one processor, and a communication interface, wherein the memory, at least one processor, and communication interface are interconnected via bus lines; The memory stores instructions, including an engine registration management program, a communication link control program, a data source configuration program, a data packet processing program, a scheduling and sending program, a result management program, and an alarm processing program. The at least one processor invokes the instructions in the memory to cause the electronic device to execute the various steps of the unified engine management method described above. The communication interface is used to enable communication and interaction between the electronic device and the engine, bus, data source management node, and alarm receiving terminal.

[0013] A fourth aspect of the present invention provides a computer-readable storage medium storing instructions that, when executed by a processor, implement the steps of the aforementioned unified engine management method.

[0014] Compared with the prior art, the present invention has the following significant advantages: By adopting a unified engine registration mechanism and standardized communication protocol adaptation, seamless integration of multi-vendor and multi-functional engines is achieved, solving the technical pain point of inconsistent interfaces between different engines and reducing the complexity of system integration. The DPDK technology is used to optimize online packet processing, bypassing the kernel to directly access the hardware; offline packets are subject to targeted integrity and validity checks to ensure data reliability and achieve differentiated and efficient processing. It provides three scheduling strategies: load balancing, priority, and data type matching, which can be dynamically switched according to the actual scenario to achieve optimal allocation of engine resources; It supports custom alarm policies, provides multi-channel alarm push and tiered blocking measures, and combines a dynamic blacklist update mechanism to achieve rapid threat identification, alarm and containment, thereby improving the initiative and flexibility of network security protection. The bus message configuration table, scheduling strategy, and result information types can all be flexibly expanded, supporting the addition of new engine types, data source types, and alarm methods to adapt to the future development needs of network security engines. Attached Figure Description

[0015] The present invention will be further described below with reference to the accompanying drawings and embodiments; Figure 1 This is a flowchart of a unified engine management method proposed in one embodiment of the present invention; Figure 2 This is a flowchart of loading bus messages and establishing a communication link in one embodiment of the present invention; Figure 3 This is a flowchart illustrating the process of obtaining data source configuration from data source configuration items in one embodiment of the present invention. Figure 4 This is a schematic diagram of the structure of a unified engine management device proposed in one embodiment of the present invention; Figure 5 This is a schematic diagram of the structure of an electronic device proposed in one embodiment of the present invention. Detailed Implementation

[0016] This section will describe in detail specific embodiments of the present invention. Preferred embodiments of the present invention are shown in the accompanying drawings. The purpose of the drawings is to supplement the textual description with graphics, so that people can intuitively and vividly understand each technical feature and overall technical solution of the present invention, but they should not be construed as limiting the scope of protection of the present invention.

[0017] Reference Figure 1 The first aspect of this invention proposes a unified engine management method, including step S001: receiving engine registration information. The registration information must include a unique engine identifier, function type (e.g., malicious code detection, VPN traffic analysis), communication protocol version (e.g., TCP / IP v4, UDP), data interaction format (e.g., JSON, Protobuf), and vendor information, ensuring the integrity and uniqueness of the registration information. The registration information is then validated for format, such as protocol version validity and identifier uniqueness. Upon successful validation, the bus message configuration table is updated. This configuration table stores the communication parameters, registration status, function description, and last online time of each engine, providing basic data for subsequent communication and scheduling.

[0018] Reference Figure 2Step S002: Load bus messages and establish a communication link. Send a connection request containing the engine identifier and communication protocol version to the bus; receive the response result returned by the bus, which includes a connection status identifier and link parameters; when the response result is a successful connection, receive the bus message table sent by the bus; if the response result is a connection failure, resend the connection request after an interval of n seconds, with a maximum of m retries; if a retry fails, output a connection exception prompt containing the reason for the failure and record the exception log.

[0019] Specifically, a connection request containing the engine identifier and communication protocol version is sent to the bus. The bus performs compatibility verification based on the parameters in the request and returns a response result (success / failure and link parameters). If the response result indicates a successful connection, a stable TCP / IP or UDP communication link is established based on the link parameters, and the bus message table sent by the bus is received, containing bus node information, data transmission rules, etc. If the connection fails, a retry mechanism is initiated. For example, retrying every 30 seconds, up to 3 times, will be performed. If a retry fails, a connection error message will be output and logged for easy troubleshooting by maintenance personnel.

[0020] Reference Figure 3 Step S003: Obtain the data source configuration from the data source configuration items, which include network interface card configuration and offline data source. Send a query for data source configuration information containing configuration item identifiers to the data source management node; receive the response data source configuration information returned by the data source management node, and perform format verification and validity verification on the configuration information; if the configuration information is invalid, trigger a configuration exception alarm and prompt the user to reconfigure; if the configuration information is valid, store the data source configuration and synchronize it to the local configuration cache.

[0021] Specifically, the data source configuration items include network interface card (NIC) configuration and offline data source. NIC configuration includes IP address, port number, data transfer rate, and filtering rules, such as accepting only packets from specific ports. Offline data source configuration includes storage path, file format, and data update cycle. A configuration query request is sent to the data source management node. After receiving the response configuration information, format validation is performed, such as IP address validity, path validity, and validity verification, such as whether the NIC is online and whether the offline file exists. Valid configurations are stored in the local cache and updated synchronously; invalid configurations trigger alarms and prompt the user to reconfigure.

[0022] Step S004: Receive data packet forwarding information and determine whether the forwarded data packet is offline information. If so, verify the integrity and validity of the data packet; otherwise, perform fragmentation and reassembly, protocol parsing, and feature extraction on the data packet. DPDK technology is used to process the data packets. The polling mode provided by DPDK bypasses the operating system kernel and directly accesses the network card hardware queue for high-speed reception and forwarding of data packets. Simultaneously, invalid data packets are removed based on preset filtering rules, and valid data packets undergo TCP / UDP / IP protocol parsing and key feature field extraction.

[0023] Specifically, after receiving data packet forwarding information, the first step is to determine the data packet type (offline / online). For offline data packets, the focus is on verifying their integrity, which can be achieved using the CRC32 algorithm to verify that the data has not been tampered with and is legitimate. For example, verifying the access permissions and data signature of the data source can prevent illegal data injection. For online data packets, DPDK technology is used for optimized processing: by using a polling mode to bypass the operating system kernel and directly access the network card hardware queue, high-speed reception and forwarding of data packets are achieved. At the same time, invalid data packets, such as empty packets and packets with incorrect formats, are removed based on preset filtering rules. Valid data packets undergo TCP / UDP / IP protocol parsing and key feature field extraction, significantly reducing the latency of online data packet processing.

[0024] Step S005: Obtain the engine scheduling policy and send data packets to the target engine via the message bus according to the scheduling policy. Monitor the data packet sending status in real time. If a data packet times out, fails to receive an acknowledgment response after delivery, or is lost during transmission, it is determined to be a sending anomaly. Send alarm information, which includes the anomaly type, data packet identifier, sending time, target engine identifier, and preliminary analysis of the anomaly cause. Cache the abnormal data packet to a local distributed cache node according to the scheduling policy and set a cache validity period. Resend the packet according to priority after communication is restored. If communication is not restored during the cache validity period, archive the data packet to persistent storage media.

[0025] Specifically, an engine scheduling strategy adapted to the actual application scenario is obtained, and the scheduling strategy includes three core types: First, a load balancing strategy: Real-time monitoring of CPU utilization, memory usage, and task queue length for each engine ensures data packets are allocated to the engine with the lowest load, preventing overload on any single engine. Second, a priority strategy: Data packets are allocated to engines with matching priorities based on their threat level (e.g., high, medium, low) or business importance (e.g., high-risk packets are prioritized for the fastest processing engine). Third, a data type matching strategy: Data packets are allocated to engines with corresponding detection capabilities based on their type, improving detection accuracy. Data packets are sent to the target engine via the message bus according to the selected scheduling strategy. The sending status is monitored in real-time. If anomalies occur, such as timeout, lack of acknowledgment, or data loss, an alarm message containing anomaly details (type, identifier, time, reason) is immediately sent, and the abnormal data packet is cached in a local distributed cache node. For example, the cache validity period is 1 hour. Once communication is restored, the packet is resent according to priority; otherwise, it is archived to persistent storage.

[0026] Step S006: Receive the result information sent by the backend, and store, visualize, and manage the result information in multiple dimensions. The result information received from the backend includes encrypted feature detection result information, encrypted traffic intelligent detection result information, mobile application encrypted traffic intelligent detection result information, VPN encrypted traffic intelligent detection result information, intelligent semantic analysis threat detection result information, intelligent malicious file detection result information, threat intelligence detection result information, malicious code detection result information, network popular behavior detection and analysis result information, threat analysis result information, high-sensitivity data anomaly detection result information, probe comprehensive management result information, scalable model management result information, offline data packet technology detection and analysis result information, efficient backtracking analysis result information of full network traffic, visualization modeling information, algorithm component information, deep learning module information, visual intelligent analysis module information, algorithm market module information, and online model prediction module information. The result information is stored in JSON format and includes result identifier, detection engine identifier, detection time, confidence score, and detailed detection conclusions.

[0027] Step S007: Determine whether a custom alarm handling policy is configured; if yes, execute the alarm handling task and end the process; if no, end the process directly. The alarm handling task includes access blacklist management or network hierarchical blocking: access blacklist management includes manually adding blacklist entries, automatically synchronizing threat intelligence blacklists, and periodically cleaning up expired blacklist entries; blacklist entries include IP addresses, domain names, port numbers, or application identifiers; network hierarchical blocking includes port-level blocking, IP-level blocking, and application-layer blocking; alarm information is pushed to preset recipients via email, SMS, or system pop-ups, and alarm handling logs are recorded simultaneously.

[0028] It should be noted that the aforementioned data packets refer to data units carrying network security detection-related information that need to be scheduled to the target security engine for detection and analysis through a unified management platform. Based on the data source configuration of this invention, data packets are divided into two categories: Online data packets: obtained from the real-time network link corresponding to the network card configuration, such as real-time network traffic data (TCP / UDP protocol data, encrypted traffic data), network device / terminal behavior log data, and real-time transmitted file fragment data. Offline data packets: obtained from offline data sources (such as local storage media, offline servers), such as historical network traffic archive files, offline stored suspicious files, and batch-exported log data. Both types of data packets need to enter the processing flow through the forwarding mechanism of the unified management platform. Different processing logic is adopted only due to differences in "real-time requirements" and "storage format," with offline packet verification and online packet DPDK high-speed processing. Data packets must contain key information supporting security detection and management scheduling.

[0029] refer to Figure 4 The second aspect of this invention proposes a unified engine management device in which the modules cooperate according to the following logic: an engine registration information module 201, used to receive engine registration information, including but not limited to engine identifier, function type, communication protocol version, data interaction format, and manufacturer information, and update the bus message configuration table according to the registration information, the bus message configuration table recording the communication parameters and registration status of each engine; a communication link establishment module 202, used to load bus messages and establish a communication link; a data configuration module 203, used to obtain data source configuration from data source configuration items, the data source configuration items including network card configuration and offline data source; and a data packet judgment module 204, which receives data... Based on packet forwarding information, it is determined whether the forwarded data packet is offline information. If so, the integrity and legality of the data packet are verified; otherwise, the data packet is fragmented and reassembled, parsed, and its features are extracted. The scheduling strategy acquisition and sending module 205 is used to acquire the engine scheduling strategy and send data packets to the target engine through the message bus according to the scheduling strategy. The result information display and management module 206 is used to receive the result information sent by the backend, store the result information, display it visually, and manage it in multiple dimensions. The alarm processing strategy judgment module 207 is used to determine whether a custom alarm processing strategy is configured. If so, the alarm processing task is executed and the process ends; otherwise, the process ends directly.

[0030] A third aspect of the present invention provides an electronic device comprising a memory, at least one processor, and a communication interface, wherein the memory, at least one processor, and communication interface are interconnected via a bus line; the memory stores instructions, including an engine registration management program, a communication link control program, a data source configuration program, a data packet processing program, a scheduling and sending program, a result management program, and an alarm processing program; the at least one processor invokes the instructions in the memory to cause the electronic device to execute the various steps of the aforementioned unified engine management method.

[0031] The electronic device 700 can vary considerably depending on its configuration or performance, and may include one or more central processing units (CPUs) 710 (e.g., one or more processors) and memory 720, and one or more storage media 730 (e.g., one or more mass storage devices) for storing application programs 733 or data 732. The memory 720 and storage media 730 can be temporary or persistent storage. The program stored in the storage media 730 may include one or more modules (not shown in the figure), each module including a series of instruction operations on the electronic device 700. Furthermore, the processor 710 may be configured to communicate with the storage media 730 and execute the series of instruction operations in the storage media 730 on the electronic device 700.

[0032] Electronic device 700 may also include one or more power supplies 740, one or more wired or wireless network interfaces 750, one or more input / output interfaces 760, and / or one or more operating systems 731, such as Windows Server, Mac OS X, Unix, Linux, FreeBSD, etc. Those skilled in the art will understand that... Figure 5 The illustrated electronic device structure does not constitute a limitation on electronic devices and may include more or fewer components than illustrated, or combine certain components, or have different component arrangements.

[0033] The communication interface is used to enable communication and interaction between electronic devices and engines, buses, data source management nodes, and alarm receiving terminals.

[0034] The fourth aspect of this invention provides a computer-readable storage medium storing instructions that, when executed by a processor, implement the various steps of the aforementioned unified engine management method.

[0035] Those skilled in the art will clearly understand that, for the sake of convenience and brevity, the specific working process of the system, device, or unit described above can be referred to the corresponding process in the foregoing method embodiments, and will not be repeated here.

[0036] If the integrated unit is implemented as a software functional unit and sold or used as an independent product, it can be stored in a computer-readable storage medium. Based on this understanding, the technical solution of the present invention, in essence, or the part that contributes to the prior art, or all or part of the technical solution, can be embodied in the form of a software product. This computer software product is stored in a storage medium and includes several instructions to cause a computer device (which may be a personal computer, server, or network device, etc.) to execute all or part of the steps of the methods described in the various embodiments of the present invention. The aforementioned storage medium includes various media capable of storing program code, such as USB flash drives, portable hard drives, read-only memory (ROM), random access memory (RAM), magnetic disks, or optical disks.

[0037] The embodiments of the present invention have been described in detail above with reference to the accompanying drawings. However, the present invention is not limited to the above embodiments. Within the scope of knowledge possessed by those skilled in the art, various changes can be made without departing from the spirit of the present invention.

Claims

1. A unified engine management method, characterized in that, include: Receive engine registration information, including but not limited to engine identifier, function type, communication protocol version, data interaction format and manufacturer information; update the bus message configuration table according to the registration information, the bus message configuration table records the communication parameters and registration status of each engine; Load bus messages and establish a communication link; Obtain the data source configuration from the data source configuration items, which include network interface card configuration and offline data source; The system receives data packet forwarding information and determines whether the forwarded data packet is offline information. If so, it verifies the integrity and legality of the data packet; otherwise, it performs fragmentation and reassembly, protocol parsing, and feature extraction on the data packet. Obtain the engine scheduling policy, and send data packets to the target engine through the message bus according to the scheduling policy; Receive result information sent from the backend, and store, visualize, and manage the result information in multiple dimensions; Determine whether a custom alarm handling strategy is configured; If yes, the alarm handling task will be executed and the process will end; otherwise, the process will end directly.

2. The unified engine management method according to claim 1, characterized in that, The loading of bus messages and establishment of communication links includes: Send a connection request to the bus containing the engine identifier and the communication protocol version; The system receives a response from the bus, which includes a connection status identifier and link parameters. When the response indicates a successful connection, receive the bus message table sent by the bus. If the response indicates a connection failure, the connection request will be resent after an interval of n seconds, with a maximum of m retries. If a retry fails, a connection error message containing the reason for the failure will be output, and an error log will be recorded.

3. The unified engine management method according to claim 1, characterized in that, The step of obtaining the data source configuration from the data source configuration item includes: Send query data source configuration information containing configuration item identifiers to the data source management node; Receive the response data source configuration information returned by the data source management node, and perform format verification and validity verification on the configuration information; If the configuration information is invalid, a configuration error alarm is triggered and the user is prompted to reconfigure; if the configuration information is valid, the data source configuration is stored and synchronized to the local configuration cache.

4. The unified engine management method according to claim 1, characterized in that, The data packet fragmentation and reassembly, protocol parsing, and feature extraction processes include: The DPDK technology is used to process data packets. By using the polling mode provided by DPDK to bypass the operating system kernel, the network card hardware queue is directly accessed to receive and forward data packets at high speed. At the same time, invalid data packets are removed based on preset filtering rules, and valid data packets are parsed using TCP / UDP / IP protocols and key feature fields are extracted.

5. The unified engine management method according to claim 1, characterized in that, The step of obtaining the engine scheduling policy and sending data packets to the target engine via the message bus according to the scheduling policy includes: The system monitors the data packet sending status in real time. If a data packet is detected as not being delivered after a timeout, not receiving an acknowledgment response after delivery, or being lost during transmission, it is determined to be a sending anomaly. Send alarm information, which includes the anomaly type, data packet identifier, sending time, target engine identifier, and preliminary analysis of the anomaly cause; According to the scheduling policy, abnormal data packets are cached in the local distributed cache node, and a cache validity period is set. Once communication is restored, they are resent according to priority. If communication is not restored during the cache validity period, the data packets are archived to persistent storage media.

6. The unified engine management method according to claim 1, characterized in that, The result information sent by the receiving backend includes encryption feature detection result information, encrypted traffic intelligent detection result information, mobile application encrypted traffic intelligent detection result information, VPN encrypted traffic intelligent detection result information, intelligent semantic analysis threat detection result information, intelligent malicious file detection result information, threat intelligence detection result information, malicious code detection result information, network popular behavior detection and analysis result information, threat analysis result information, high-sensitivity data anomaly detection result information, probe comprehensive management result information, scalable model management result information, offline data packet technology detection and analysis result information, network full traffic efficient backtracking analysis result information, visualization modeling information, algorithm component information, deep learning module information, visual intelligent analysis module information, algorithm market module information, and model online prediction module information; The results are stored in JSON format and include result identifier, detection engine identifier, detection time, confidence score, and detailed detection conclusion.

7. The unified engine management method according to claim 1, characterized in that, The alarm handling tasks include access blacklist management or network tiered blocking: The access blacklist management includes manually adding blacklist entries, automatically synchronizing the threat intelligence blacklist, and periodically cleaning up expired blacklist entries. Blacklist entries include IP addresses, domain names, port numbers, or application identifiers. The network hierarchical blocking includes port-level blocking, IP-level blocking, and application-layer blocking. Alarm information is pushed to preset recipients via email, SMS or system pop-up, and alarm processing logs are recorded at the same time.

8. A unified engine management device, characterized in that, include: The engine registration information module is used to receive engine registration information, which includes, but is not limited to, engine identifier, function type, communication protocol version, data interaction format and manufacturer information. The module updates the bus message configuration table according to the registration information. The bus message configuration table records the communication parameters and registration status of each engine. The communication link establishment module is used to load bus messages and establish a communication link; The data configuration module is used to obtain data source configuration from data source configuration items, which include network card configuration and offline data source; The data packet judgment module receives data packet forwarding information and determines whether the forwarded data packet is offline information. If so, it verifies the integrity and legality of the data packet; otherwise, it performs fragmentation and reassembly, protocol parsing, and feature extraction processing on the data packet. The scheduling strategy acquisition and sending module is used to acquire the engine scheduling strategy and send data packets to the target engine through the message bus according to the scheduling strategy. The result information display and management module is used to receive result information sent from the backend, and to store, visualize, and manage the result information in multiple dimensions. The alarm handling strategy judgment module is used to determine whether a custom alarm handling strategy is configured. If yes, the alarm handling task will be executed and the process will end; otherwise, the process will end directly.

9. An electronic device, characterized in that, It includes a memory, at least one processor, and a communication interface, wherein the memory, at least one processor, and communication interface are interconnected via bus lines; The memory stores instructions, including an engine registration management program, a communication link control program, a data source configuration program, a data packet processing program, a scheduling and sending program, a result management program, and an alarm processing program. The at least one processor invokes the instructions in the memory to cause the electronic device to perform the steps of the unified engine management method as described in any one of claims 1-7; The communication interface is used to enable communication and interaction between the electronic device and the engine, bus, data source management node, and alarm receiving terminal.

10. A computer-readable storage medium, characterized in that, The computer-readable storage medium stores instructions that, when executed by a processor, implement the steps of the unified engine management method as described in any one of claims 1-7.

Images