A network security protection method and device for a cross-module integrated system

Abstract

The application provides a network security protection method and device of a cross-module integrated system. The method comprises the following steps: receiving module data sent by a plurality of registered function modules; the module data comprises state data, security data and service data; obtaining module topology relationship data according to the attributes of the plurality of registered function modules; generating protection strategy data according to the module topology relationship data and a preset protection strategy mapping model; performing abnormal analysis processing on the module data to obtain abnormal data; obtaining an attack path atlas according to the abnormal data; and obtaining network security protection instruction data according to the attack path atlas and the protection strategy data. The application can improve the effect of network security protection and the security of application program use.

Description

Technical Field

[0001] This invention relates to the field of network security protection technology, and also to a network security protection method and apparatus for a cross-module integrated system. Background Technology

[0002] With the acceleration of digital transformation, cross-module integrated systems have become core infrastructure in many fields. These systems standardize the interfaces of dispersed local server modules, edge computing modules, and third-party service access modules to achieve data sharing and business collaboration among sensor acquisition modules, edge analysis modules, and cloud management modules, as well as cross-departmental collaboration among identity authentication modules, business processing modules, and data archiving modules within business systems. This significantly improves the system's functional scalability and business processing efficiency. When an application (APP) contains multiple functional modules (such as a "Look Around" module, a "Scan" module, and a payment module), the application belongs to a cross-module integrated system.

[0003] Currently, for network security protection of cross-module integrated systems, the industry mainly adopts a network security protection method of independent protection for each module and conventional boundary protection. This network security protection method deploys security components separately for each functional module, such as configuring antivirus software for the data processing module, deploying an intrusion detection system for the terminal access module, and enabling access control for the cloud storage module.

[0004] However, in this network security protection method, the security components of each module operate independently, without establishing a protection collaboration mechanism between modules. When attackers exploit vulnerabilities in the terminal access module to enter the system, they can inject malicious code into the data processing module through the inter-module data transmission channel and penetrate through the inter-module interaction interface. The security components of a single module can only identify abnormal behavior within its own module and cannot correlate attack traces with other modules. This results in cross-module attacks bypassing independent protection components, creating blind spots in protection, and leading to poor protection effectiveness. Summary of the Invention

[0005] The technical problem to be solved by the present invention is to provide a network security protection method and device for cross-module integrated systems, so as to improve the security of application use and the effectiveness of network protection.

[0006] To solve the above-mentioned technical problems, the technical solution of the present invention is as follows: A first aspect of the present invention provides a network security protection method for a cross-module integrated system, comprising: Receive module data sent by multiple registered functional modules; the module data includes status data, security data, and business data; Based on the attributes of the multiple registered functional modules, module topology relationship data is obtained; Based on the module topology relationship data and the preset protection strategy mapping model, protection strategy data is generated; The module data is subjected to anomaly parsing processing to obtain abnormal data; Based on the abnormal data, an attack path map is obtained; Based on the attack path map and the protection strategy data, network security protection instruction data is obtained.

[0007] Optionally, it can receive module data sent by multiple registered functional modules, including: Receive module registration request; The module registration request is verified, and after successful verification, a module identifier is assigned to obtain multiple registered functional modules. Receive module data sent by the multiple registered functional modules at a preset frequency.

[0008] Optionally, based on the attributes of the plurality of registered functional modules, module topology relationship data is obtained, including: Traverse the attribute data of the multiple registered functional modules to obtain adjacency relationship data; Based on the adjacency relationship data, the strength of the relationship between modules is obtained; Based on the collaborative relationship matrix constructed according to the relationship strength between the modules, the module topology relationship data is obtained.

[0009] Optionally, the module data is subjected to anomaly parsing processing to obtain abnormal data, including: The module data is subjected to time alignment processing to obtain time-aligned data; Interaction feature data is obtained by extracting interaction features from the time-series aligned data. The time-aligned data and the interaction feature data are quantized to obtain a feature vector; The association score is obtained based on the temporal alignment data, the interaction feature data, and the feature vector; Based on the correlation score and preset attack judgment conditions, the module data is used to trace the source of attacks and obtain abnormal data.

[0010] Optionally, an association score is obtained based on the temporal alignment data, the interaction feature data, and the feature vector, including: pass Obtain the first relevance score; Based on the second correlation model and the interaction feature data, a second correlation score is obtained; the second correlation model is that when the globally unique identifier SessionID is consistent and it is a standard interaction link, the second correlation score is 1, otherwise the second correlation score is 0. pass The third correlation score was obtained; pass Result in a correlation score; in, The first relevance score, This refers to the time when the anomaly occurred in the first registered module within the time-series alignment data. This refers to the time of an anomaly occurrence in the second registered module within the time-series alignment data. The time of occurrence of the anomaly in the third registered module in the time-series alignment data is represented by W, where W is the size of the time window, taking values ​​of 5s or 10s, and SessionID is a globally unique identifier in the interaction feature data. The third correlation score, The anomaly score for the first registered module in the feature vector. The anomaly score for the second registered module in the feature vector. The anomaly score for the third registered module in the feature vector. S represents the second correlation score, and S represents the correlation score.

[0011] Optionally, based on the abnormal data, an attack path map is obtained, including: The abnormal data is preprocessed to obtain preprocessed data; The preprocessed data is mapped to graph nodes to obtain graph node data; An attack path map is obtained based on the map node data and the anomaly data.

[0012] Optionally, based on the attack path map and the protection strategy data, protection instruction data is obtained, including: Attack data is extracted based on the attack path map; Based on the attack data and the protection strategy data, protection strategy matching is performed to obtain protection strategy matching data; Based on the attack data and the protection strategy matching data, the attack and defense level data is obtained; Based on the attack data, the protection strategy matching data, and the attack and defense level data, initial protection instruction data is obtained; When the compliance verification of the initial protection instruction data passes, the protection instruction data is obtained.

[0013] A second aspect of the present invention provides a network security protection device for a cross-module integrated system, comprising: The acquisition module is used to receive module data sent by multiple registered functional modules; the module data includes status data, security data, and business data. The processing module is used to obtain module topology relationship data based on the attributes of the plurality of registered functional modules; generate protection strategy data based on the module topology relationship data and a preset protection strategy mapping model; perform anomaly parsing processing on the module data to obtain anomaly data; obtain an attack path graph based on the anomaly data; and obtain network security protection instruction data based on the attack path graph and the protection strategy data.

[0014] A third aspect of the present invention provides a computing device, comprising: a processor and a memory storing a computer program, wherein the computer program, when executed by the processor, performs the method described in the first aspect.

[0015] A fourth aspect of the present invention provides a computer-readable storage medium storing instructions that, when executed on a computer, cause the computer to perform the method as described in the first aspect.

[0016] The above-described solution of the present invention has at least the following beneficial effects: The above-described solution of the present invention receives module data sent by multiple registered functional modules; the module data includes status data, security data, and business data; module topology relationship data is obtained based on the attributes of the multiple registered functional modules; protection strategy data is generated based on the module topology relationship data and a preset protection strategy mapping model; anomaly analysis is performed on the module data to obtain anomaly data; an attack path graph is obtained based on the anomaly data; and network security protection instruction data is obtained based on the attack path graph and the protection strategy data. By sharing information and conducting collaborative analysis among the registered functional modules in the application, single-module protection is upgraded to system-wide protection, effectively improving the threat identification rate and enhancing the security and efficiency of application use. Attached Figure Description

[0017] Figure 1 This is a flowchart illustrating the cross-module-based network security protection method in an embodiment of the present invention. Figure 2 This is a schematic diagram of the attack path map in an embodiment of the present invention; Figure 3 This is an architecture diagram of a cross-module-based network security protection method according to an embodiment of the present invention; Figure 4 This is a schematic diagram of the structure of a cross-module-based network security protection device in an embodiment of the present invention. Detailed Implementation

[0018] Exemplary embodiments of the invention will now be described in more detail with reference to the accompanying drawings. While exemplary embodiments of the invention are shown in the drawings, it should be understood that the invention may be implemented in various forms and should not be limited to the embodiments set forth herein. Rather, these embodiments are provided so that this invention will be thorough and complete, and will fully convey the scope of the invention to those skilled in the art.

[0019] like Figure 1 As shown, an embodiment of the present invention proposes a network security protection method for a cross-module integrated system, comprising the following steps: Step 101: Receive module data sent by multiple registered functional modules; the module data includes status data, security data, and business data; Step 102: Obtain module topology relationship data based on the attributes of the multiple registered functional modules; Step 103: Generate protection strategy data based on the module topology relationship data and the preset protection strategy mapping model; Step 104: Perform anomaly parsing on the module data to obtain abnormal data; Step 105: Obtain the attack path map based on the abnormal data; Step 106: Obtain network security protection instruction data based on the attack path map and the protection strategy data.

[0020] This invention discloses a network security protection method for a cross-module integrated system. The method involves receiving module data from multiple registered functional modules, including status data, security data, and business data. Based on the attributes of the registered functional modules, module topology data is obtained. Protection strategy data is generated based on the module topology data and a preset protection strategy mapping model. Anomaly analysis is performed on the module data to obtain anomaly data. An attack path graph is obtained based on the anomaly data. Finally, network security protection command data is obtained based on the attack path graph and the protection strategy data. Through information sharing and collaborative analysis among functional modules within the application, single-module protection is upgraded to system-wide protection, effectively improving threat identification rates and enhancing the security and efficiency of application usage. In an optional embodiment of the present invention, step 101 involves receiving module data sent by multiple registered functional modules; the module data includes status data, security data, and business data, including: Step 1011: Receive module registration request; Specifically, after each functional module in the application starts, its corresponding agent process automatically starts, loads the module's exclusive security certificate (including public / private keys for encrypted communication), collects the module's basic information, integrates it into a registration request data packet, and sends it out to prevent registration information from being tampered with or stolen. It also receives encrypted registration request data packets sent in parallel by the agents of each module, each request carrying the module type, security certificate, and communication port.

[0021] Step 1012: Verify the module registration request. After successful verification, assign module identifiers to obtain multiple registered functional modules. Specifically, after receiving registration requests from multiple modules, the system sorts them in the order they are received to avoid verification conflicts caused by concurrent requests. It also records the request initiation time and temporary module identifier. After decrypting the module registration requests, it verifies the legality of the security certificate, the legality of the module, and the normality of the communication link for each module agent. If the verification passes, a unique identifier (ID) is assigned to all verified module agents, establishing a module-agent-ID mapping relationship to ensure that subsequent protection commands can be accurately sent to the corresponding modules. The module bound to the identifier is then designated as a registered functional module.

[0022] Step 1013: Receive module data sent by the multiple registered functional modules at a preset frequency.

[0023] Specifically, registered module data can include: Status data: Module running status: running / fault / offline / restarting / upgrading; CPU utilization, memory utilization, disk utilization; process PID, startup time, runtime, number of threads; network: packet sending and receiving volume, packet loss rate, latency, bandwidth usage, number of connections; collection frequency: current configured frequency, whether there are abnormal jumps; synchronization status: local cache queue length, upload success rate, number of retransmissions, etc.

[0024] Security data: number of unauthorized access attempts, abnormal IPs, blacklist / whitelist hits; key status: valid / expired / tampered, certificate validity period; permission violation attempts, unauthorized access, port scanning; login logs: account, time, IP, result; number of data tampering verification failures, number of encryption failures, etc.

[0025] Business data: number of connected terminals, number of online terminals, number of new connections, number of disconnections; data processing volume: number of records / byte, processing latency, success rate; cloud upload: upload volume, latency, failure retries, backlog; protocol type; alarms: timeout, packet loss, verification error, format error, etc. The content of the module data can also be adjusted according to actual needs.

[0026] It should be noted that the module data can be adjusted depending on the different functional modules; the above is just an example.

[0027] In an optional embodiment of the present invention, step 102, obtaining module topology relationship data based on the attributes of the plurality of registered functional modules, may include: Step 1021: Traverse the attribute data of the multiple registered functional modules to obtain adjacency relationship data; Specifically, the attribute data of registered functional modules includes type, port, protocol, process, and resources; it also includes the function of the registered functional modules, such as producer / consumer / forwarder / storage / management; and it includes sensitive data: whether it carries keys, ciphertext, user identifiers, configurations, etc. By traversing multiple registered functional modules, the attribute data of the modules can be obtained, and then the adjacency relationship data can be determined. Specifically, the adjacency relationship data is determined in the following ways: if the data dependency list of module 1 contains module 2, then module 1 and module 2 have an adjacency relationship, recorded as an adjacency link; or, if the resource dependency list of module 1 contains module 2, then module 1 and module 2 have an adjacency relationship, recorded as an adjacency link. The adjacency links between registered functional modules are determined as the adjacency relationship data.

[0028] Here, when a new module is registered or an already registered module is deleted, the attribute data of the registered functional modules in real time is re-traversed to determine the adjacency relationship data before subsequent processing. In another specific embodiment, the attribute data of multiple registered functional modules can be traversed according to a preset traversal frequency, and the adjacency relationship data can be updated to add new registered modules or delete old registered modules, thereby improving the adaptability and real-time performance of the method.

[0029] Step 1022: Obtain the inter-module relationship strength based on the adjacency relationship data; Specifically, the strength of the relationship between modules is obtained by A=0.3C+0.3D+0.2P+0.2B, where A is the strength of the relationship between modules, C is the connectivity of the adjacent link (0 or 1), D is the data interaction between the registered functional modules at both ends of the adjacent link (0 or 1), P is the interaction permission (0 to 1), and B is the data sensitivity level (1 to 4).

[0030] Step 1023: Obtain module topology relationship data based on the collaborative relationship matrix constructed according to the relationship strength between the modules.

[0031] Specifically, a collaborative relationship matrix is ​​obtained based on the strength of relationships between modules and a preset dependency judgment standard. Here, the preset dependency judgment standard includes: A < 0.6 indicates no relationship, 0.6 ≤ A < 1.2 indicates a weak dependency, and A ≥ 1.2 indicates a strong dependency. Based on the strength of relationships between modules and the preset dependency judgment standard, the dependency relationship between any two modules can be obtained, thus forming a collaborative relationship matrix. The collaborative relationship matrix includes the dependency relationships between any two modules. According to the collaborative relationship matrix, the uplink or downlink relationships between modules can be obtained. For example, if the first registered module strongly depends on the second registered module, then the first registered module is located downstream of the second registered module; if the third registered module strongly depends on the first registered module, then the third registered module is located downstream of the first registered module. The final module topology relationship data includes: Nodes: First registered module, second registered module, and third registered module; Directed edge: First registered module - Second registered module, Second registered module - Third registered module; Edge attributes: sensitivity level and permissions.

[0032] In an optional embodiment of the present invention, step 103, generating protection strategy data based on the module topology relationship data and the preset protection strategy mapping model, may include: Based on the module topology relationship data and the preset protection strategy mapping model, protection strategy data is generated.

[0033] Specifically, protection strategy data is generated through a protection strategy mapping model and module topology relationship data. The protection strategy mapping model is defined as MapModel=(M,R,L,F), where M represents registered modules, R represents module interaction relationships, L represents data sensitivity levels, and F is the strategy mapping function (which takes module interaction relationships R and data sensitivity levels L as input to obtain the protection strategy). The formula for the strategy mapping function is as follows: ,in, The protection strategy for a single interaction link between registered module s and registered module t includes: access control rules (such as allowing or denying interaction between registered module s and registered module t), data transmission encryption method (the higher the sensitivity level, the higher the encryption level), rate limiting threshold (controlling the data transmission rate of interaction to prevent overload attacks), intrusion detection rules (anomaly detection strategy for the interaction link between registered module s and registered module t), auditing rules (recording interaction data and protection action logs), and isolation switch (whether to block the interaction between registered module s and registered module t in case of anomalies). This represents the interaction relationship between registered module s and registered module t. The module interaction relationship R is the dependency relationship in the module topology relationship data. The protection strategy data includes the protection strategy for all individual interaction links.

[0034] In an optional embodiment of the present invention, step 104, which involves performing anomaly parsing processing on the module data to obtain abnormal data, may include: Step 1041: Perform time alignment processing on the module data to obtain time-aligned data; Specifically, the module data is time-aligned according to the preset time window size (5s or 10s) and preset alignment rules to obtain time-aligned data. Here, the preset alignment rule is to group all module data within the same window together to ensure that abnormal data within the same time window belongs to the same potential session.

[0035] Step 1042: Extract interaction features based on the time-series aligned data to obtain interaction feature data; Specifically, based on the data flow direction in the module topology data above: terminal access module - data processing module - cloud storage module, flow direction data is obtained; latency (data transmission latency from the terminal access module to the data processing module, and data transmission latency from the data processing module to the cloud storage module) is extracted from the time-series aligned data; packet ID / session ID is extracted from the time-series aligned data: a globally unique identifier SessionID (used to associate cross-module data of the same business session, generated by the terminal access module, synchronously transmitted to the data processing and cloud storage modules along with data transmission; each business session corresponds to a unique SessionID, derived from the session identifier field in the business data). Interaction feature data includes flow direction data, latency, and packet ID / session ID.

[0036] Step 1043: Quantize the time-series alignment data and the interaction feature data to obtain a feature vector; Specifically, based on time-series aligned data and interaction feature data, the status, security, and business data of each module are quantitatively extracted, transforming anomalies into calculable feature values, providing quantitative data input for subsequent calculation of correlation scores. Specific steps include: The terminal anomaly score is obtained by dividing the sum of the login anomaly score, the number of illegal attempts, the connection establishment delay, and the abnormal IP tag by 4. Here, the login anomaly score is calculated based on the number of failed login attempts and the proportion of login attempts by abnormal IPs, and then normalized. The number of illegal attempts is the normalized value of the number of illegal login attempts within a unit time window. The connection establishment delay is the ratio of the connection establishment delay to the historical average, and then normalized. The abnormal IP tag is 1 if there is an abnormal IP access, and 0 if there is none.

[0037] The transmission anomaly score is obtained by dividing the sum of the transmission packet loss rate, latency jitter, decryption / verification failures, and queue backlog by 4. Here, the transmission packet loss rate is the number of data packets lost within the window / the total number of transmissions; latency jitter is the ratio of the fluctuation value of transmission latency to the historical average, which is obtained after normalization; decryption / verification failures are the normalized value of the number of decryption or data verification failures within the window; and queue backlog is the ratio of the buffer queue length to the queue threshold, which is obtained after normalization.

[0038] The storage anomaly score is obtained by dividing the sum of abnormal writes, unauthorized modifications, verification mismatches, and concurrency surges by 4. Here, abnormal writes are the number of abnormal writes within the window divided by the total number of writes; unauthorized modifications are 1 if there is unauthorized modification behavior, and 0 if there is no unauthorized modification behavior; verification mismatches are the normalized value of the number of data verification mismatches; and concurrency surges are the ratio of concurrent accesses to the historical average, which is obtained after normalization.

[0039] The feature vector is obtained based on the terminal anomaly score, transmission anomaly score, and storage anomaly score. That is, the feature vector includes the terminal anomaly score, transmission anomaly score, and storage anomaly score.

[0040] It should be noted that when calculating the terminal anomaly score, transmission anomaly score, and storage anomaly score, the input data all come from time-aligned data and interaction feature data. That is, the input data must meet the following requirements: for terminal access anomalies and data processing anomalies, the time difference must not be greater than W, and the globally unique identifier SessionID must be consistent, and the data flow must conform to the terminal access module - data processing module - cloud storage module.

[0041] Step 1044: Obtain the association score based on the temporal alignment data, the interaction feature data, and the feature vector; In an optional embodiment of the present invention, step 1044 includes: Step 10441, through Obtain the first relevance score; Step 10442: Based on the second correlation model and the interaction feature data, obtain the second correlation score; the second correlation model is that when the globally unique identifier SessionID is consistent and it is a standard interaction link, the second correlation score is 1, otherwise the second correlation score is 0. Step 10443, through The third correlation score was obtained; Step 10444, through Result in a correlation score; in, The first relevance score, This refers to the time when the anomaly occurred in the first registered module within the time-series alignment data. This refers to the time of an anomaly occurrence in the second registered module within the time-series alignment data. The time of occurrence of the anomaly in the third registered module in the time-series alignment data is represented by W, where W is the size of the time window, taking values ​​of 5s or 10s, and SessionID is a globally unique identifier in the interaction feature data. The third correlation score, The anomaly score for the first registered module in the feature vector. For the anomaly score of the registered module in the feature vector, The anomaly score for the third registered module in the feature vector. S represents the second correlation score, and S represents the correlation score.

[0042] Step 1045: Based on the association score and preset attack judgment conditions, perform attack tracing on the module data to obtain abnormal data.

[0043] Specifically, the preset attack judgment conditions include: a correlation score S greater than or equal to 0.7 indicates a cross-module attack; a correlation score 0.4 ≤ S < 0.7 indicates abnormal linkage; and a correlation score S less than 0.4 indicates a single point of failure. The correlation score is compared with the preset attack judgment conditions. When a cross-module attack or abnormal linkage is found, the module data needs to be traced to identify the attack path and key nodes to output alarm information and trigger protection strategies. The tracing steps may include: finding the session identifier associated with the abnormality based on the interaction chain in the interaction feature data and tracing the complete operation record of that session; identifying the specific time range of the abnormality based on the time-series slices in the time-series aligned data for log backtracking; and identifying the attack transmission path (e.g., from terminal access to data processing to cloud storage) based on the standard links in the interaction feature data to locate the attack entry point and registered modules. Abnormal data includes: complete operation records, time range, and attack transmission path, etc.

[0044] In an optional embodiment of the present invention, step 105, obtaining the attack path map based on the abnormal data, may include: Step 1051: Preprocess the abnormal data to obtain preprocessed data; Specifically, the abnormal data is preprocessed according to the following steps to obtain preprocessed data: Under the same SessionID, only one abnormal data of the same module and type is retained (the record with the highest abnormal value is taken) to obtain deduplicated data; the deduplicated data is sorted according to the time of occurrence of the abnormality to obtain the time-series abnormal sequence, i.e., the preprocessed data.

[0045] Step 1052: Map the preprocessed data to graph nodes to obtain graph node data; Specifically, preprocessed data is mapped to graph nodes, clarifying the module affiliation, anomaly type, and anomaly severity of each node. This provides a node foundation for subsequent attack path mapping, realizing the transformation of anomalous data into graph nodes. The specific steps include: each preprocessed data point corresponds to one anomalous node, with the node's module clearly labeled; each anomalous node includes its module affixed, anomaly type (e.g., login anomaly, packet loss anomaly), anomaly node score, and anomaly occurrence time; the nodes are sorted in descending order of their scores, with higher scores indicating higher priority. These sorted nodes are then used as graph node data.

[0046] Step 1053: Obtain the attack path map based on the map node data and the anomaly data.

[0047] Specifically, based on preprocessed data and node attributes, the node with the earliest occurrence time and highest priority is taken as the starting point of the attack path graph, thus clarifying the initial source of the attack. Based on the data interaction (or data interaction flow) in the module topology relationship data and the time-series anomaly sequence of preprocessed data, the flow process of the attack from the initial source of the attack to the target attack module can be traced, thereby constructing the flow relationship between nodes (the edges of the total path) and clarifying the transmission path of the attack. Based on node priority and the degree of anomaly impact, the target attack module that the attack ultimately targets is determined (the module that meets the highest anomaly score and whose attack stops propagating is taken as the target attack module), which serves as the endpoint of the attack path graph, thus clarifying the ultimate purpose of the attack. The attack path graph is obtained by identifying the starting point, the propagation path of the attack, and the ending point of the attack path graph. For example... Figure 2 As shown in the figure, all modules are registered modules.

[0048] The attack path graph uses a directed graph layout, with nodes arranged from left to right according to the time of anomaly occurrence. The attack entry point is on the far left, the target attack module is on the far right, and the flow nodes are in the middle. Edges are drawn from left to right according to the flow direction. Here, the attack path graph includes clear labels for the attack entry point, flow nodes, and target attack module, as well as supplementary explanations such as flow relationships and anomaly information.

[0049] In an optional embodiment of the present invention, step 106, obtaining network security protection instruction data based on the attack path map and the protection strategy data, may include: Step 1061: Extract attack data based on the attack path map; Specifically, core attack features are extracted from the attack path graph as attack data to identify the attack entry point (the functional module / node the attack first enters (such as the gateway or social networking module), and the source module of the corresponding functional module interaction link), the flow path (all propagation links of the attack from the entry node to the target node), the target module (the module that the attack ultimately targets, such as the core data storage module or payment module, and the target module of the corresponding module interaction link), the attack features (including attack type, such as distributed denial-of-service attack, injection, vulnerability exploitation, etc., and attack intensity, such as high / medium / low), and the scope of impact (such as the number of core modules and the number of links involved), providing a basis for subsequent matching of protection strategies.

[0050] Step 1062: Perform protection strategy matching based on the attack data and the protection strategy data to obtain protection strategy matching data; Specifically, for each interaction link in the attack flow path, the intersection of its corresponding basic protection policy and the attack characteristics corresponding to that link is taken to obtain the link-specific matching protection policy. That is, only the protection policy content that can deal with the current attack characteristics is retained. Each interaction link in the attack flow path is traversed, and the corresponding protection policy is matched in the above way. Finally, all the matched protection policies are summarized to form a set of attack path-specific protection policies, which serves as the protection policy matching data.

[0051] Step 1063: Obtain attack and defense level data based on the attack data and the protection strategy matching data; Specifically, based on the attack intensity and scope of impact in the attack data, an overall attack impact level is assigned. For example, if the attack intensity is low and affects one ordinary module, the overall attack impact level is 1; if the attack intensity is high and affects at least two core modules, the overall attack impact level is 5. Based on the security level in the protection strategy matching data, a basic attack impact level is assigned. For example, if the attack affects an ordinary module and low-sensitivity data, the basic attack impact level is 2; if the attack affects a core module and high-sensitivity data, the basic attack impact level is 5. according to The attack and defense levels are calculated, where S is the attack and defense level. , These are the weighting coefficients. , To determine the overall impact level of the attack, The level of impact on the base attack.

[0052] Step 1064: Obtain initial protection instruction data based on the attack data, the protection strategy matching data, and the attack and defense level data; Specifically, based on the comparison between the specific attack and defense level values ​​in the attack and defense level data and the preset protection threshold, and combined with the attack entry module / node, flow module / node, and target module / node in the attack data, the corresponding initial protection instructions are determined from the protection policy matching data. For example, when the attack and defense level is greater than or equal to 4, for the attack entry module / node, the corresponding initial protection instructions determined from the protection policy matching data are "block attackers (e.g., blacklist malicious IPs), freeze illegal accounts, close abnormal interfaces, and start rate limiting"; the initial protection instructions for the flow module / node are "close abnormal interfaces, back up core data, start advanced encryption, and increase intrusion detection frequency"; and the initial protection instructions for the target module / node are "start read-only mode, encrypt sensitive data, block interaction with the attack link (turn on the isolation switch), and back up core business data." The above is only an example.

[0053] Step 1065: When the compliance verification of the initial protection instruction data passes, the protection instruction data is obtained.

[0054] Specifically, the initial protection instruction data is checked to see if the instructions violate business rules. For example, if the business rule requires that "the payment module must remain writable," then the instruction should be modified to "encrypt sensitive data and restrict non-core operations." The instructions are also checked to see if they match attack characteristics and protection strategies. For example, if the attack is a distributed denial-of-service attack, and the initial instructions do not contain "rate limiting" or "blocking" related content, then the corresponding instructions should be added. The instructions of different modules / nodes are checked to see if they contradict each other. For example, if "functional module 1 issues an access permission instruction" and "functional module 2 issues an access blocking instruction," the blocking instruction should be retained, and the instruction of functional module 1 should be adjusted to "block malicious requests and allow normal requests." Instructions that fail the verification are modified, supplemented, or deleted to ensure compliance verification, thus forming the final set of protection instructions, i.e., protection instruction data.

[0055] It should be noted that the instructions in the protection command data are sent to the agent of the corresponding module to execute the protection operation, thereby improving the accuracy of network security protection.

[0056] A specific embodiment of the cross-module-based network security protection method of the present invention includes: Step 111: Receive module data sent by multiple registered functional modules; the module data includes status data, security data, and business data; The application verifies the registration requests of multiple functional modules. After successful verification, module identifiers are assigned to obtain multiple registered functional modules. Then, the application receives module data sent by multiple registered functional modules at a preset frequency for subsequent determination of whether there are any attacks or anomalies.

[0057] By deploying a central server and installing four engines (a strategy decision engine with built-in module collaboration relationships and protection strategy mapping models, which can automatically generate global protection policies such as interface access permissions and data monitoring rules based on the topology of functional modules, and support dynamic adjustments to prioritize core module interactions during peak business periods); a threat analysis engine using a three-dimensional correlation algorithm based on time, interaction, and features, which can identify cross-module attacks in real time from abnormal data of multiple modules, such as abnormal terminal login, abnormal data transmission, and abnormal storage modification; a log correlation engine supporting unified parsing of log formats from multiple modules, automatically establishing attack behavior, module nodes, timelines, and correlation indexes for source tracing; and a linkage response engine with preset multi-level response templates such as early warning, blocking, isolation, recovery, and hardening, which can issue collaborative commands to multiple module agents) and a visualization module, and configuring IP addresses, encryption certificates, and storage unit connection parameters, registered functional modules can transmit data to the central server through deployed hardware agents. The hardware agents are connected to the central server through the serial port and network port of the adapter unit.

[0058] After the agent starts, it automatically identifies the module's technology stack through the adaptation unit and generates a module information report. The agent initiates a registration request to the central server. After the central server verifies the registration, it assigns a unique ID to the agent, completing the connection between each functional module and the central server. Each agent collects the module's status, security, and business data at the configured frequency. Non-standard data is converted by the adaptation unit, encrypted, and then uploaded to the central server.

[0059] Step 112: Obtain module topology relationship data based on the attributes of the multiple registered functional modules; By traversing multiple registered functional modules and the collaboration relationship matrix between construction modules, the module topology relationship data is obtained.

[0060] When an application adds or removes functional modules, the agent automatically reports the topology change event to the central control. The central policy decision engine re-analyzes the module collaboration relationships, generates updated protection policies, and synchronizes them to the relevant agents in real time, without manual intervention.

[0061] Step 113: Generate protection strategy data based on the module topology relationship data and the preset protection strategy mapping model; Protection strategy data is generated by mapping the protection strategy model and module topology relationship data.

[0062] The central system scans the interaction relationships of all registered modules, automatically generates an initial global protection policy that allows communication between business-related modules and synchronizes it to each agent.

[0063] Step 114: Perform anomaly parsing on the module data to obtain abnormal data; The central threat analysis engine analyzes the uploaded module data in real time. Minor anomalies in a single module are only logged, while warnings are triggered for suspected cross-module threats.

[0064] Step 115: Obtain the attack path map based on the abnormal data; By preprocessing the abnormal data and mapping the graph nodes, an attack path graph is obtained.

[0065] The central processing unit uses a three-dimensional correlation algorithm to identify cross-module attacks and automatically generate an attack path map, marking the attack entry point, flow nodes, and target modules.

[0066] Step 116: Obtain network security protection instruction data based on the attack path map and the protection strategy data.

[0067] By matching attack data in the attack path graph with protection strategy data, network security protection instruction data is obtained.

[0068] In one specific embodiment, commands to block attackers and freeze accounts are issued to the agents of the attack entry module. Commands to close abnormal interfaces and back up core data are issued to the agents of the transfer nodes, and commands to start read-only mode and encrypt sensitive data are issued to the agents of the target module. If the attack affects multiple core modules, commands to update the threat signature database and increase the monitoring frequency are issued to all agents.

[0069] In addition, the central log association engine automatically aggregates attack-related logs, generating a threat attribution report containing the attack source, path, behavior, and scope of impact. This report is then pushed to the visualization management module for operations and maintenance personnel to view. Based on the attribution report, operations and maintenance personnel can manually adjust protection strategies in the central visualization interface, and the adjustments are automatically synchronized to all agents. Logs are automatically stored in hierarchical categories according to their lifecycle, and operations and maintenance personnel can query historical logs and export compliance reports through the central system.

[0070] The network security protection method for a cross-module integrated system in this invention upgrades single-module protection to system-wide protection through information sharing and collaborative analysis between modules, improving the cross-module threat identification rate. Furthermore, it can integrate abnormal data, attack path graph data, and protection command data for visualization, facilitating viewing and processing by operations and maintenance personnel.

[0071] A specific application embodiment of the network security protection method for cross-module integrated systems according to the present invention includes: like Figure 3As shown, by independently deploying a central server (which is a core service node independent of the terminal and specifically responsible for cross-module collaborative management), the central server connects with multiple functional modules of the application installed on the terminal (such as functional module 1 and functional module 2) through module proxies (such as module proxy 1 and module proxy 2). The central server uniformly manages multiple module proxies, responsible for registration and verification, identifier allocation, instruction issuance, and status monitoring, acting as an independently deployed server node. The network security protection method of the cross-module integration system in this embodiment of the invention can be applied to the central server.

[0072] like Figure 4 As shown, an embodiment of the present invention proposes a network security protection device 400 for a cross-module integrated system, comprising: Module 401 is used to receive module data sent by multiple registered functional modules; the module data includes status data, security data, and business data; registered Processing module 402 is configured to: obtain module topology relationship data based on the attributes of the plurality of registered functional modules; generate protection strategy data based on the module topology relationship data and a preset protection strategy mapping model; perform anomaly analysis on the module data to obtain anomaly data; obtain an attack path graph based on the anomaly data; and obtain network security protection instruction data based on the attack path graph and the protection strategy data. (Registered) Optionally, it can receive module data sent by multiple registered functional modules, including: Receive module registration request; The module registration request is verified, and after successful verification, a module identifier is assigned to obtain multiple registered functional modules. Receive module data sent by the multiple registered functional modules at a preset frequency.

[0073] Optionally, based on the attributes of the plurality of registered functional modules, module topology relationship data is obtained, including: Traverse the attribute data of the multiple registered functional modules to obtain adjacency relationship data; Based on the adjacency relationship data, the strength of the relationship between modules is obtained; Based on the collaborative relationship matrix constructed according to the relationship strength between the modules, the module topology relationship data is obtained.

[0074] Optionally, the module data is subjected to anomaly parsing processing to obtain abnormal data, including: The module data is subjected to time alignment processing to obtain time-aligned data; Interaction feature data is obtained by extracting interaction features from the time-series aligned data. The time-aligned data and the interaction feature data are quantized to obtain a feature vector; The association score is obtained based on the temporal alignment data, the interaction feature data, and the feature vector; Based on the correlation score and preset attack judgment conditions, the module data is used to trace the source of attacks and obtain abnormal data.

[0075] Optionally, an association score is obtained based on the temporal alignment data, the interaction feature data, and the feature vector, including: pass Obtain the first relevance score; Based on the second correlation model and the interaction feature data, a second correlation score is obtained; the second correlation model is that when the globally unique identifier SessionID is consistent and it is a standard interaction link, the second correlation score is 1, otherwise the second correlation score is 0. pass The third correlation score was obtained; pass Result in a correlation score; in, The first relevance score, This refers to the time when the anomaly occurred in the first registered module within the time-series alignment data. This refers to the time of an anomaly occurrence in the second registered module within the time-series alignment data. The time of occurrence of the anomaly in the third registered module in the time-series alignment data is represented by W, where W is the size of the time window, taking values ​​of 5s or 10s, and SessionID is a globally unique identifier in the interaction feature data. The third correlation score, The anomaly score for the first registered module in the feature vector. The anomaly score for the second registered module in the feature vector. The anomaly score for the third registered module in the feature vector. S represents the second correlation score, and S represents the correlation score.

[0076] Optionally, based on the abnormal data, an attack path map is obtained, including: The abnormal data is preprocessed to obtain preprocessed data; The preprocessed data is mapped to graph nodes to obtain graph node data; An attack path map is obtained based on the map node data and the anomaly data.

[0077] Optionally, based on the attack path map and the protection strategy data, protection instruction data is obtained, including: Attack data is extracted based on the attack path map; Based on the attack data and the protection strategy data, protection strategy matching is performed to obtain protection strategy matching data; Based on the attack data and the protection strategy matching data, the attack and defense level data is obtained; Based on the attack data, the protection strategy matching data, and the attack and defense level data, initial protection instruction data is obtained; When the compliance verification of the initial protection instruction data passes, the protection instruction data is obtained.

[0078] The network security protection device of the cross-module integrated system in this invention receives module data sent by multiple registered functional modules. The module data includes status data, security data, and business data. Based on the attributes of the multiple registered functional modules, module topology relationship data is obtained. Based on the module topology relationship data and a preset protection strategy mapping model, protection strategy data is generated. Anomaly parsing processing is performed on the module data to obtain anomaly data. Based on the anomaly data, an attack path graph is obtained. Based on the attack path graph and the protection strategy data, network security protection instruction data is obtained. Through information sharing and collaborative analysis among the functional modules in the application, single-module protection is upgraded to system-wide protection, effectively improving threat identification rate and enhancing the security and efficiency of application use.

[0079] It should be noted that this device corresponds to the method described above, and all implementations in the method embodiments described above are applicable to the embodiments of this device and can achieve the same technical effect. Further details are omitted in this embodiment.

[0080] This invention also provides a computing device, including: a processor and a memory storing a computer program, wherein the computer program, when executed by the processor, performs the method as described in any of the above embodiments. All implementations in the above method embodiments are applicable to the embodiments of this device and can achieve the same technical effects. Further details are omitted in this embodiment.

[0081] This invention also provides a computer-readable storage medium storing instructions that, when executed on a computer, cause the computer to perform the method as described in any of the above embodiments. All implementations in the above method embodiments are applicable to the embodiments of this device and can achieve the same technical effects. Further details are omitted in this embodiment.

[0082] It should be noted that in the apparatus and method of the present invention, the components or steps can obviously be decomposed and / or recombined. These decompositions and / or recombinations should be considered equivalent solutions of the present invention. Furthermore, the steps for performing the above series of processes can naturally be performed in the order described and in chronological order, but are not necessarily required to be performed in chronological order. Some steps can be performed in parallel, overlapping, or independently of each other.

[0083] It should be noted that in the above embodiments, the terms "comprising," "including," or any other variations thereof are intended to cover non-exclusive inclusion, such that a process, method, article, or apparatus that comprises a list of elements includes not only those elements but also other elements not expressly listed, or elements inherent to such a process, method, article, or apparatus. Without further limitations, an element defined by the phrase "comprising one..." does not exclude the presence of other identical elements in the process, method, article, or apparatus that includes that element. Furthermore, it should be noted that the scope of the methods and apparatuses in the embodiments described above is not limited to performing functions in the order shown or discussed, but may also include performing functions substantially simultaneously or in the reverse order, depending on the functions involved. For example, the described methods may be performed in a different order than described, and various steps may be added, omitted, or combined. Additionally, features described with reference to certain examples may be combined in other examples.

[0084] The above description represents the preferred embodiments of the present invention. It should be noted that those skilled in the art can make various improvements and modifications without departing from the principles of the present invention, and these improvements and modifications should also be considered within the scope of protection of the present invention.

Claims

1. A network security protection method for a cross-module integrated system, characterized in that, include: Receive module data sent by multiple registered functional modules; the module data includes status data, security data, and business data; Based on the attributes of the multiple registered functional modules, module topology relationship data is obtained; Based on the module topology relationship data and the preset protection strategy mapping model, protection strategy data is generated; The module data is subjected to anomaly parsing processing to obtain abnormal data; Based on the abnormal data, an attack path map is obtained; Based on the attack path map and the protection strategy data, network security protection instruction data is obtained; The abnormal data obtained by performing anomaly analysis on the module data includes: The module data is subjected to time alignment processing to obtain time-aligned data; Interaction feature data is obtained by extracting interaction features from the time-series aligned data. The time-aligned data and the interaction feature data are quantized to obtain a feature vector; The association score is obtained based on the temporal alignment data, the interaction feature data, and the feature vector; Based on the association score and preset attack judgment conditions, the module data is used to trace the source of attacks and obtain abnormal data. The association score is obtained based on the temporal alignment data, the interaction feature data, and the feature vector, including: pass Obtain the first relevance score; Based on the second correlation model and the interaction feature data, a second correlation score is obtained; the second correlation model is that when the globally unique identifier SessionID is consistent and it is a standard interaction link, the second correlation score is 1, otherwise the second correlation score is 0. pass The third correlation score was obtained; pass Result in a correlation score; in, The first relevance score, This refers to the time when the anomaly occurred in the first registered module within the time-series alignment data. This refers to the time of an anomaly occurrence in the second registered module within the time-series alignment data. The time of occurrence of the anomaly in the third registered module in the time-series alignment data is represented by W, where W is the size of the time window, taking values ​​of 5s or 10s, and SessionID is a globally unique identifier in the interaction feature data. The third correlation score, The anomaly score for the first registered module in the feature vector. The anomaly score for the second registered module in the feature vector. The anomaly score for the third registered module in the feature vector. S represents the second correlation score, and S represents the correlation score.

2. The network security protection method for a cross-module integrated system according to claim 1, characterized in that, Receive module data from multiple registered functional modules, including: Receive module registration request; The module registration request is verified, and after successful verification, a module identifier is assigned to obtain multiple registered functional modules. Receive module data sent by the multiple registered functional modules at a preset frequency.

3. The network security protection method for a cross-module integrated system according to claim 1, characterized in that, Based on the attributes of the multiple registered functional modules, module topology relationship data is obtained, including: Traverse the attribute data of the multiple registered functional modules to obtain adjacency relationship data; Based on the adjacency relationship data, the strength of the relationship between modules is obtained; Based on the collaborative relationship matrix constructed according to the relationship strength between the modules, the module topology relationship data is obtained.

4. The network security protection method for a cross-module integrated system according to claim 1, characterized in that, Based on the abnormal data, an attack path map is obtained, including: The abnormal data is preprocessed to obtain preprocessed data; The preprocessed data is mapped to graph nodes to obtain graph node data; An attack path map is obtained based on the map node data and the anomaly data.

5. The network security protection method for a cross-module integrated system according to claim 1, characterized in that, Based on the attack path map and the protection strategy data, protection instruction data is obtained, including: Attack data is extracted based on the attack path map; Based on the attack data and the protection strategy data, protection strategy matching is performed to obtain protection strategy matching data; Based on the attack data and the protection strategy matching data, the attack and defense level data is obtained; Based on the attack data, the protection strategy matching data, and the attack and defense level data, initial protection instruction data is obtained; When the compliance verification of the initial protection instruction data passes, the protection instruction data is obtained.

6. A network security protection device for a cross-module integrated system, characterized in that, include: The acquisition module is used to receive module data sent by multiple registered functional modules; the module data includes status data, security data, and business data. The processing module is used to obtain module topology relationship data based on the attributes of the plurality of registered functional modules; Based on the module topology relationship data and the preset protection strategy mapping model, protection strategy data is generated; the module data is subjected to anomaly parsing processing to obtain anomaly data; based on the anomaly data, an attack path map is obtained; based on the attack path map and the protection strategy data, network security protection instruction data is obtained. The abnormal data obtained by performing anomaly analysis on the module data includes: The module data is subjected to time alignment processing to obtain time-aligned data; Interaction feature data is obtained by extracting interaction features from the time-series aligned data. The time-aligned data and the interaction feature data are quantized to obtain a feature vector; The association score is obtained based on the temporal alignment data, the interaction feature data, and the feature vector; Based on the association score and preset attack judgment conditions, the module data is used to trace the source of attacks and obtain abnormal data. The association score is obtained based on the temporal alignment data, the interaction feature data, and the feature vector, including: pass Obtain the first relevance score; Based on the second correlation model and the interaction feature data, a second correlation score is obtained; the second correlation model is that when the globally unique identifier SessionID is consistent and it is a standard interaction link, the second correlation score is 1, otherwise the second correlation score is 0. pass The third correlation score was obtained; pass Result in a correlation score; in, The first relevance score, This refers to the time when the anomaly occurred in the first registered module within the time-series alignment data. This refers to the time of an anomaly occurrence in the second registered module within the time-series alignment data. The time of occurrence of the anomaly in the third registered module in the time-series alignment data is represented by W, where W is the size of the time window, taking values ​​of 5s or 10s, and SessionID is a globally unique identifier in the interaction feature data. The third correlation score, The anomaly score for the first registered module in the feature vector. The anomaly score for the second registered module in the feature vector. The anomaly score for the third registered module in the feature vector. S represents the second correlation score, and S represents the correlation score.

7. A computing device, characterized in that, include: A processor, a memory storing a computer program, wherein the computer program, when executed by the processor, performs the method as described in any one of claims 1 to 5.

8. A computer-readable storage medium, characterized in that, It stores instructions that, when executed on a computer, cause the computer to perform the method as described in any one of claims 1 to 5.

Images