A network security platform collaborative protection system and method

Abstract

The present application relates to the technical field of network security, and provides a network security platform cooperative protection system and method. Through the log audit module, when log collection is incomplete, data gap notification is sent to the situation awareness module, the situation awareness module increases the flow collection frequency and generates risk alarm through correlation analysis accordingly; the security management module generates disposal instructions and disposal correlation information; the log audit module extracts evidence logs according to the disposal correlation information. The problems of independent operation, no data communication and no closed loop of security operation of the existing network security platform are solved, cross-platform data compensation and accurate evidence closed loop are realized, and the efficiency and effect of the whole network security operation are improved.

Description

Technical Field

[0001] This invention relates to the field of network security technology, and more specifically, to a collaborative protection system and method for network security platforms. Background Technology

[0002] With the increasing complexity of cybersecurity threats, situational awareness platforms, log auditing systems, and security management platforms have become core infrastructures for enterprise cybersecurity protection. In this scenario, challenges arise from the heterogeneity of the technical systems of these platforms, inconsistent data formats, and fragmented security operation processes. Currently, these three platforms often operate independently: log auditing systems only collect and audit logs without deep integration with the situational awareness platform, resulting in a lack of comprehensive data support for risk detection; risk alerts from the situational awareness platform are handled independently without coordination with the security management platform's handling processes, leading to low efficiency and a lack of standardized procedures in security incident handling; and the security policies of the three platforms are configured separately, lacking a unified asset baseline and protection standards, resulting in vulnerabilities in protection, missed detections, and blind spots in auditing.

[0003] Furthermore, when log auditing systems experience incomplete log collection, existing technologies lack a mechanism for the log auditing side to proactively report data gaps to the situational awareness side and drive traffic compensation; the lack of precise mapping between security incident handling and evidence collection logs leads to an excessively broad scope of evidence collection or omission of key evidence, making it difficult to achieve continuous iterative optimization.

[0004] To address the aforementioned issues, existing technologies urgently need improvement. Summary of the Invention

[0005] The purpose of this invention is to provide a collaborative protection system and method for network security platforms, which has the advantages of enabling data interoperability, event linkage and closed-loop iteration of the three major platforms of log auditing, situational awareness and security management, thereby improving the efficiency and effectiveness of network-wide security operations.

[0006] This invention provides a collaborative protection system for a network security platform, comprising: The log auditing module collects log data from network devices and generates structured logs, which are then sent to the situation awareness module. It also monitors whether the structured logs are collected completely, and if incomplete, sends a data gap notification to the situation awareness module. The situational awareness module receives the structured logs and the data gap notifications; when the data gap notification is received, it increases the network traffic data collection frequency of the corresponding network device; it performs correlation analysis between the network traffic data and the structured logs, generates risk alarm data, and sends it to the security management module. The security management module generates a handling instruction based on the risk alarm data and sends it to the situation awareness module, so that the situation awareness module can perform control operations according to the handling instruction; it generates handling-related information and sends it to the log auditing module, so that the log auditing module can extract log records from the original log data based on the handling-related information and generate evidence collection log data.

[0007] Furthermore, the data gap notification also includes the missing time period and the type of reason for the missing log; The types of reasons for missing logs include transmission interruption, format parsing failure, and storage queue overflow.

[0008] Furthermore, increasing the network traffic data collection frequency of the corresponding network device includes: Based on the log missing reason type in the data gap notification, determine the method for increasing the traffic data collection frequency; specifically, when the log missing reason type is transmission interruption, increase the data packet capture sampling rate; when the log missing reason type is format parsing failure, shorten the traffic statistics time window and increase the application layer protocol identification depth. The addition method is associated with the network device identifier and recorded. When the log audit module subsequently sends a log collection recovery notification for the network device identifier, the network traffic data collection frequency is restored to the baseline frequency before the addition.

[0009] Furthermore, the step of performing correlation analysis between the network traffic data and the structured logs includes: The source network address, destination network address, port number, and connection timestamp in the network traffic data are compared with the operation source address, operation target address, service port number, and log timestamp in the structured log, respectively. When the source network address is consistent with the operation source address, the destination network address is consistent with the operation target address, the port number is consistent with the service port number, and the connection timestamp and the log timestamp are in the same time window, the corresponding network traffic data is matched and associated with the structured log. When there is no corresponding structured log within the missing time period, the network traffic data records within the missing time period are used as risk association data to generate the risk alarm data.

[0010] Furthermore, the processing association information includes the network address of the operation object, the operation timestamp, the operation type, and the alarm identifier of the processing instruction; The log auditing module extracts log records from the original log data based on the network address of the operation object and the operation timestamp; The log auditing module further determines the storage retention period of the evidence collection log data based on the alarm level in the risk alarm data; wherein, when the alarm level is high-risk, a first retention period is determined; when the alarm level is low-risk, a second retention period is determined; the first retention period is longer than the second retention period.

[0011] Furthermore, the step of extracting log records from the original log data based on the processing association information includes: The time window length is determined based on the operation type: when the operation type is a blocking operation, a first time length is determined; when the operation type is an isolation operation, a second time length is determined. Based on the network address of the operation object, the operation timestamp, and the time window length, extract log records within the time window length before and after the operation timestamp from the original log data.

[0012] Furthermore, the generation of forensic log data includes: The extracted log records are sorted according to the operation timestamp to generate evidence log data containing the log segment before the operation, the log segment at the time of the operation, and the log segment after the operation. Calculate a hash check value for the evidence collection log data, and bind and store the hash check value with the alarm identifier in the handling association information; The evidence collection log data is written to the tamper-proof storage area and stored for the specified retention period. Deletion and modification of the evidence collection log data in the tamper-proof storage area are prohibited.

[0013] Furthermore, after increasing the network traffic data collection frequency of the corresponding network devices, the situational awareness module also performs the following: The collected network traffic data is processed according to a preset log format, and supplementary log data is generated and sent to the log audit module. The log auditing module merges the supplementary log data with the structured log to generate merged log data; when the log collection integrity rate corresponding to the merged log data is higher than a preset threshold, a log collection recovery notification is sent to the situation awareness module.

[0014] Furthermore, when multiple network devices simultaneously send data gap notifications, the situational awareness module also performs the following: Obtain the asset security level of each network device, and the type of log missing reason in the corresponding data gap notification for each network device; Based on the asset security level and the type of log missing reason, the priority for increasing the traffic data collection frequency of each network device is determined as follows: when the asset security level is higher than the level threshold and the log missing reason type is transmission interruption, it is determined as the first priority; when the asset security level is lower than or equal to the level threshold, it is determined as the second priority. Network traffic data collection bandwidth is allocated sequentially according to the increasing priority. When the total bandwidth is insufficient, the increased traffic data collection frequency requirement of the network device corresponding to the first priority is given priority, and the increase in traffic data collection frequency of the network device corresponding to the second priority is reduced by a preset ratio.

[0015] Secondly, the present invention also proposes a collaborative protection method for network security platforms, applied to the collaborative protection system for network security platforms described in the first aspect, the method comprising: Collect log data from network devices and generate structured logs; Monitor whether the structured logs are collected completely; if incomplete, generate a data gap notification. Based on the data gap notification, increase the frequency of network traffic data collection for the corresponding network devices; The network traffic data is correlated and analyzed with the structured logs to generate risk alert data; Generate a response instruction based on the risk alarm data, and execute control operations based on the response instruction; Based on the disposal instructions, disposal-related information is generated; based on the disposal-related information, log records are extracted from the original log data to generate evidence collection log data.

[0016] Thirdly, the present invention also proposes an electronic device comprising: one or more processors, and a memory for storing one or more computer programs; the computer programs are configured to be executed by the one or more processors, and the programs include steps for performing the network security platform collaborative protection method as described in the second aspect.

[0017] As can be seen from the above, the collaborative protection method and system for network security platforms provided by the present invention solves the problems of independent operation, data disconnection, and lack of closed-loop security operation of existing network security platforms by constructing a traffic compensation mechanism driven by data gap notification, a precise evidence collection mechanism driven by handling related information, and a cross-platform strategy iteration closed loop. It has the advantages of being able to realize data interoperability, event linkage, and closed-loop iteration of the three major platforms of log auditing, situational awareness, and security management, thereby improving the efficiency and effectiveness of network security operation. Attached Figure Description

[0018] To more clearly illustrate the technical solutions of the embodiments of the present invention, the accompanying drawings used in the embodiments will be briefly introduced below. It should be understood that the following drawings only show some embodiments of the present invention and should not be regarded as a limitation on the scope. For those skilled in the art, other related drawings can be obtained based on these drawings without creative effort.

[0019] Figure 1 This is a schematic diagram of the collaborative protection system structure of the network security platform disclosed in an embodiment of the present invention; Figure 2 This is the step flow of the network security platform collaborative protection method disclosed in the embodiments of the present invention. Detailed Implementation

[0020] Unless otherwise defined, all technical and scientific terms used herein have the same meaning as commonly understood by one of ordinary skill in the art to which these embodiments belong; the terminology used herein and in the specification of the application is for the purpose of describing particular embodiments only and is not intended to limit these embodiments; the terms "comprising" and "having," and any variations thereof, in the specification of these embodiments and the foregoing drawings, are intended to cover non-exclusive inclusion. The terms "first," "second," etc., in the specification of these embodiments and the foregoing drawings are used to distinguish different objects, not to describe a particular order.

[0021] The implementation details of the technical solution in this embodiment are described in detail below: This invention proposes a collaborative protection system for network security platforms, such as... Figure 1 As shown, it includes: a log auditing module 101 and a situational awareness module 102. The security management module generates a response instruction based on the risk alarm data and sends it to the situation awareness module, so that the situation awareness module can perform control operations according to the response instruction; it also generates response-related information and sends it to the log auditing module. The log auditing module 101 collects log data from network devices and generates structured logs, then sends the structured logs to the situation awareness module 102; it monitors whether the structured logs are collected completely, and if they are incomplete, it sends a data gap notification to the situation awareness module 102. Furthermore, the data gap notification also includes the missing time period and the type of log missing reason; the type of log missing reason includes transmission interruption, format parsing failure, and storage queue overflow.

[0022] Specifically, in this embodiment, the log auditing module 101 receives raw log streams reported by various network devices in real time via a collection agent deployed in the network area, using the Syslog protocol or SNMP Trap method. For example, for core switch devices, raw log records are continuously generated at a certain rate under normal operating conditions. The log auditing module 101 performs field parsing and format conversion on the raw log streams to generate structured logs in a unified format. The structured logs include at least a timestamp field, a source network address field, an event type field, and a log level field. For example, the raw Syslog text is parsed into a JSON-formatted structured log, where the timestamp records the time of the event, the source network address records the network device that generated the log, the event type records interface status changes or access control events, and the log level records information or alarm levels.

[0023] The log auditing module 101 monitors whether structured logs have been collected completely. Specifically, it determines the expected number of log entries to be collected within the current collection period based on the historical log generation rate of each network device. The expected number of log entries, Nexp, is determined by the following formula: Nexp = Ravg × Tcycle In the formula, Ravg is the historical average log generation rate, measured in logs per minute, which is obtained by averaging the actual log generation of the network device over multiple collection cycles by the log audit module 101; Tcycle is the duration of the current collection cycle, measured in minutes, which is preset by the system based on network scale and processing performance. For example, if the historical average generation rate of a core switch is Ravg and the collection cycle is set to Tcycle, then the expected number of logs to be collected, Nexp, is the product of the two.

[0024] The log auditing module 101 counts the number of structured log entries successfully parsed within the current collection period, denoted as Nact. This value is accumulated by the parsing engine after field extraction and format validation. The log auditing module 101 compares the number of successfully parsed log entries with the expected number of log entries to be collected, generating the log collection completeness rate P. The formula for calculating the log collection completeness rate P is: P = Nact / Nexp × 100% In the formula, Nact represents the number of log entries successfully parsed in the current period, and Nexp represents the expected number of log entries to be collected in the current period. When Nact is less than Nexp, P is below 100%, indicating that there are missing log entries in this period.

[0025] The log auditing module 101 compares the log collection integrity rate P with a preset integrity rate threshold Pth. Pth is set by the system administrator based on business continuity and compliance audit requirements. When P is lower than Pth, the structured log collection is deemed incomplete. For example, if Pth is set to 95%, and the calculated P is lower than this threshold, a data gap determination is triggered. When the log auditing module 101 determines that the structured log collection is incomplete, it sends a data gap notification to the situational awareness module 102. The data gap notification includes at least the network device identifier, the missing time period, and the log gap cause type. The network device identifier uniquely identifies the physical or virtual device causing the log gap; the missing time period records the time interval from the start to the end of the collection cycle where logs were not fully covered; and the log gap cause type indicates the technical root cause of the log gap.

[0026] The type of log missing is determined by the log audit module 101 based on the internal collection status code and anomaly detection logic, including three situations: transmission interruption, format parsing failure, and storage queue overflow.

[0027] Specifically, transmission interruption refers to an abnormal disconnection or increased packet loss rate in the network connection between the log auditing module 101 and the network device, resulting in the raw log stream failing to reach the collection agent completely. For example, a momentary jitter in the network link may cause the TCP connection to be reset, resulting in the raw logs failing to reach the log auditing module 101 for some periods of time.

[0028] Format parsing failure refers to a situation where a network device upgrades its firmware or modifies its configuration, changing the log output format. The existing parsing rules in the log auditing module 101 cannot match the new format, causing the corresponding log entries to fail to be parsed and discarded. For example, if a firewall upgrade changes the keyword descriptions for access control logs, the existing regular expressions may fail to match the new keywords, preventing the logs of this type from being correctly parsed into structured data. Storage queue overflow occurs in high-concurrency scenarios when the amount of raw logs arriving per unit time exceeds the capacity limit of the internal memory queue of the log auditing module 101. Subsequent logs are discarded due to the queue being full. For example, during a sudden traffic attack, multiple devices simultaneously report a large number of logs. Once the memory queue depth reaches its limit, newly arriving logs are directly overflowed and discarded, unable to enter the subsequent parsing process.

[0029] The solution of this invention calculates the log collection integrity rate and subdivides the types of log missing reasons, so that the data gap notification not only carries the determination result of whether it is missing, but also the specific time period of the missing data and the root cause classification. Because the missing time period can accurately locate the blank log interval, and the log missing reason type can indicate the technical root cause of the missing data, the situational awareness module 102, upon receiving the data gap notification, can adopt differentiated traffic data collection frequency increase strategies based on different reasons such as transmission interruption, format parsing failure, or storage queue overflow, thereby achieving targeted data compensation.

[0030] The situation awareness module 102 receives the structured log and the data gap notification; when the data gap notification is received, it increases the network traffic data collection frequency of the corresponding network device; it performs correlation analysis between the network traffic data and the structured log, generates risk alarm data, and sends it to the security management module 103.

[0031] Furthermore, in the situational awareness module 102, increasing the network traffic data collection frequency for the corresponding network device includes: determining the method for increasing the traffic data collection frequency based on the log missing reason type in the data gap notification; wherein, when the log missing reason type is transmission interruption, the packet capture sampling rate is increased; when the log missing reason type is format parsing failure, the traffic statistics time window is shortened and the application layer protocol identification depth is increased; the method of increase is associated with the network device identifier and recorded; when the log audit module subsequently sends a log collection recovery notification for the network device identifier, the network traffic data collection frequency is restored to the baseline frequency before the increase.

[0032] Furthermore, in the situational awareness module 102, the step of performing correlation analysis between the network traffic data and the structured log includes: comparing the source network address, destination network address, port number, and connection timestamp in the network traffic data with the operation source address, operation target address, service port number, and log timestamp in the structured log; when the source network address matches the operation source address, the destination network address matches the operation target address, the port number matches the service port number, and the connection timestamp and the log timestamp are in the same time window, the corresponding network traffic data is matched and associated with the structured log; when there is no corresponding structured log in the missing time period, the records of the network traffic data in the missing time period are used as risk association data to generate the risk alarm data.

[0033] Specifically, in this embodiment, the situational awareness module 102 receives structured logs sent by the log auditing module 101 through an internal data interface, and simultaneously receives a data gap notification. This notification includes the network device identifier, the time period of the missing log, and the type of reason for the missing log. After parsing the notification, the situational awareness module 102 determines the target network device for which data collection needs to be compensated and the root cause of the missing log.

[0034] The situational awareness module 102 determines how to increase the traffic data collection frequency based on the type of log missing cause. When the log missing cause is transmission interruption, the packet capture sampling rate is increased. Let the baseline sampling rate be Sbase, and the increased sampling rate be Sinc. Then the increase method satisfies: Sinc = Sbase × (1 + k) In the formula, Sbase is the baseline packet capture sampling rate preset by the situational awareness module 102 for the network device, which is pre-configured by network bandwidth and storage capacity; k is the sampling rate increase coefficient, which is determined by the severity of transmission interruption and is greater than zero. When a data gap notification indicates that a transmission interruption has caused the log collection integrity rate to be significantly lower than the threshold, k takes a larger value, which greatly increases the sampling rate to capture more traffic details.

[0035] When the log loss is attributed to format parsing failure, the traffic statistics time window is shortened and the application layer protocol identification depth is increased. Let the baseline statistics time window be Wbase, and the shortened time window be Wdec, then: Wdec = Wbase / m In the formula, Wbase is the preset baseline traffic statistics time window of the situation awareness module 102, in seconds; m is the window reduction factor, determined by the proportion of log entries that failed to be parsed, and its value is greater than 1. Simultaneously, the application layer protocol identification depth increases from the baseline depth Dbase to Dinc, where Dinc = Dbase + ΔD, and ΔD is the increment of the protocol decoding layer, determined by the number of protocol types that the log audit module 101 cannot parse.

[0036] The situational awareness module 102 associates the above-mentioned addition method with the network device identifier and records it to generate a traffic compensation status entry. This entry includes at least the network device identifier, the current sampling rate, the current statistical time window, the current protocol identification depth, and the time when compensation takes effect.

[0037] When the log auditing module 101 subsequently sends a log collection recovery notification for the network device identifier, the situational awareness module 102 queries the above-mentioned traffic compensation status entries, restores the packet capture sampling rate to the baseline sampling rate Sbase, restores the traffic statistics time window to the baseline time window Wbase, and restores the application layer protocol identification depth to the baseline depth Dbase, thereby ending the temporary traffic compensation for the network device.

[0038] The situational awareness module 102 performs correlation analysis between network traffic data and structured logs. It extracts connection records from the network traffic data, which include the source network address, destination network address, port number, and connection timestamp; and extracts behavior records from the structured logs, which include the operation source address, operation target address, service port number, and log timestamp.

[0039] The situational awareness module 102 compares the connection records and behavior records by field. When the source network address matches the operation source address, the destination network address matches the operation target address, the port number matches the service port number, and the connection timestamp and log timestamp meet the time window constraint, the corresponding network traffic data is matched and associated with the structured log. The time window constraint is determined by the following relationship: |Tc - Tl| ≤ ΔT In the formula, Tc is the connection timestamp in the connection record, Tl is the log timestamp in the behavior record, and ΔT is the preset time window width in seconds. This constraint ensures that traffic events and log events are causally related in time, avoiding mismatches caused by clock drift or transmission delay.

[0040] The situational awareness module 102 detects the coverage of structured logs within the missing time period. When no structured logs matching the connection records exist within the missing time period, it indicates that the data gap in the log audit module 101 for that period has not yet been filled. In this case, the network traffic data records within the missing time period are directly used as risk correlation data. Based on this risk correlation data, the situational awareness module 102 generates risk alarm data, which includes at least the suspected attack source address, target network device identifier, abnormal behavior type, and missing time period, and sends it to the security management module 103.

[0041] This invention distinguishes between two root causes: transmission interruption and format parsing failure. It employs different methods—increasing the sampling rate and shortening the statistical window, while also deepening protocol identification—to achieve differentiated traffic data compensation. Transmission interruption leads to packet loss at the data link layer, requiring increased sampling density to fill in communication details. Format parsing failure, on the other hand, results in application-level information loss, necessitating refined time granularity and in-depth protocol parsing to reconstruct behavioral semantics. This allows the situational awareness module 102 to adopt the most suitable compensation strategy for different types of log gaps, avoiding the waste of bandwidth and storage resources caused by blindly increasing the collection frequency. Simultaneously, by performing multi-field comparison and correlation between network traffic data and structured logs, and directly using traffic records as risk correlation data during periods of log gaps, it ensures that even when the log audit module 101 experiences data gaps, the situational awareness module 102 can still generate continuous risk alarms based on traffic-side information, providing uninterrupted data support for the subsequent handling by the security management module 103.

[0042] The security management module 103 generates a handling instruction based on the risk alarm data and sends it to the situation awareness module 102, so that the situation awareness module 102 can perform control operations according to the handling instruction; it generates handling-related information and sends it to the log audit module 101, so that the log audit module 101 can extract log records from the original log data based on the handling-related information and generate evidence collection log data.

[0043] Furthermore, in the security management module 103, the disposal association information includes the network address of the operation object, the operation timestamp, the operation type, and the alarm identifier of the disposal instruction; the log audit module extracts log records from the original log data based on the network address of the operation object and the operation timestamp; the log audit module also determines the storage retention time of the evidence collection log data based on the alarm level in the risk alarm data; wherein, when the alarm level is high-risk, a first retention time is determined; when the alarm level is low-risk, a second retention time is determined; the first retention time is longer than the second retention time.

[0044] Specifically, the security management module 103 receives risk alarm data sent by the situational awareness module 102. This data includes the suspected attack source address, target network device identifier, abnormal behavior type, missing time period, and alarm level. The security management module 103 parses the risk alarm data and determines the handling strategy based on the abnormal behavior type and alarm level.

[0045] When the alarm level is high-risk, the security management module 103 generates a blocking-type handling instruction. This instruction includes the network address of the target network device (i.e., the target network device address or attack source address in the risk alarm data) and an operation timestamp, which is the current system time or the event time in the risk alarm data. The security management module 103 sends this handling instruction to the situation awareness module 102. Upon receiving the instruction, the situation awareness module 102 locates the target network device based on the target network address and performs access control operations. When the handling instruction's operation type is blocking, the situation awareness module 102 adds the target network address to the access blacklist and closes the corresponding network port, interrupting the communication link between the address and the target network device. When the handling instruction's operation type is isolation, the situation awareness module 102 moves the target network address to an isolated network area, restricting its access range but not completely terminating the connection.

[0046] Simultaneously, the security management module 103 generates disposal association information. This information includes the network address of the operation object, the operation timestamp, the operation type, and the alarm identifier from the risk alarm data in the aforementioned disposal instruction. The security management module 103 sends this disposal association information to the log audit module 101. After receiving the disposal association information, the log audit module 101 parses the network address of the operation object and the operation timestamp. Based on the network address of the operation object, the log audit module 101 retrieves all log records whose source or destination address matches the address from the original log data storage area. Simultaneously, it determines the time window boundary based on the operation timestamp and extracts relevant log records within that time window.

[0047] Let the operation timestamp be Top, and the half-width of the time window be Δt. Then, the extracted start time Tstart and end time Tend satisfy: Tstart = Top - Δt; Tend = Top + Δt. Where Top is the operation timestamp in the associated information, recorded by the security management module 103 when generating the disposal instruction; Δt is the half-width of the time window, determined by the operation type, taking the larger value when the operation type is a blocking operation and the smaller value when the operation type is an isolation operation. The log auditing module 101 extracts all original log records within the time range from Tstart to Tend that match the address.

[0048] In addition, the log audit module 101 determines the storage retention period for evidence collection log data based on the alarm level in the risk alarm data. When the alarm level is high-risk, a first retention period Th is determined; when the alarm level is low-risk, a second retention period Tl is determined. The first retention period Th is greater than the second retention period Tl. Th is the storage retention period for evidence collection logs corresponding to the high-risk level, determined by a combination of compliance audit requirements and storage resource limits; Tl is the storage retention period for evidence collection logs corresponding to the low-risk level, with a lower value than the high-risk level to optimize storage resource allocation. High-risk level evidence collection logs need to be retained for a longer period to meet the requirements of in-depth tracing and judicial evidence collection, while low-risk level evidence collection logs are retained for a relatively shorter period to reduce storage costs.

[0049] The log auditing module 101 sorts the extracted log records according to the operation timestamp, generates evidence log data containing the log segment before the operation, the log segment at the time of the operation, and the log segment after the operation, and writes it into the anti-tampering storage area and saves it according to the storage retention period determined above.

[0050] The solution of this invention achieves cross-platform linkage between security incident handling and evidence log extraction by having the security management module 103 uniformly generate handling instructions and handling-related information. Because the handling-related information structurally encapsulates the network address of the operation object, the operation timestamp, the operation type, and the alarm identifier, the log auditing module 101 can accurately locate the evidence collection scope based on the handling action itself rather than a fixed strategy. Simultaneously, it determines the storage retention period based on alarm level differences, avoiding storage waste caused by full retention and loss of key evidence due to fixed-period deletion. Thus, it achieves optimized allocation of storage resources while ensuring the integrity of the evidence collection.

[0051] Furthermore, the log auditing module 101 extracts log records from the original log data based on the disposal association information, including: determining the time window length based on the operation type: when the operation type is a blocking operation, determining a first time length; when the operation type is an isolation operation, determining a second time length; and extracting log records within the time window length before and after the operation timestamp from the original log data based on the network address of the operation object, the operation timestamp, and the time window length.

[0052] Specifically, when extracting log records based on the handling-related information, the log auditing module 101 further determines the length of the time window required for evidence collection based on the operation type. The log auditing module 101 parses the operation type field in the handling-related information. When this field indicates a blocking operation, a first time length is determined as half the width of the time window. A blocking operation means completely cutting off the communication link of the target network device. Such operations have a significant impact on business and may trigger subsequent chain reactions. Therefore, it is necessary to extract logs for a relatively long period before and after the operation to fully record the state changes before and after the handling. Let the first time length be Δtblock, and its value is determined by the system's preset blocking operation evidence collection time benchmark, which is usually greater than the time benchmark corresponding to the isolation operation.

[0053] When the operation type field indicates an isolation operation, the second time length is determined as the half-width of the time window. Isolation operations only move the target network device to a restricted area, without completely interrupting the connection; the impact on services is relatively controllable, therefore the required log backtesting period is short. Let the second time length be Δtisolate, its value is determined by the system's preset isolation operation evidence collection time benchmark, and it satisfies: Δtblock>Δtisolate In the formula, Δtblock is the half-width of the time window corresponding to the blocking operation, in seconds or minutes, set by the requirement of full traceability of critical operations in the security operation specifications; Δtisolate is the half-width of the time window corresponding to the isolation operation, in the same unit as Δtblock, set by the minimum effective time period requirement of conventional auditing and evidence collection. Since the blocking operation involves the complete interruption of the communication link, it needs to cover the complete behavioral trajectory of the network connection establishment phase before the operation and the connection teardown phase after the operation, so the value of Δtblock is relatively large; while the isolation operation only involves changes in access permissions, and the behavioral trajectory is relatively concentrated, so the value of Δtisolate is relatively small.

[0054] The log auditing module 101 calculates the time range for log extraction based on the determined half-width of the time window and the operation timestamp in the disposal-related information. Let the operation timestamp be Top, and the half-width of the time window be Δt, then Tstart = Top - Δt; Tend = Top + Δt. Where Top is the operation timestamp recorded in the disposal-related information, marked by the security management module when generating the disposal instruction; Δt is the first or second time length determined according to the operation type. Tstart is the starting boundary of the extraction time range, and Tend is the ending boundary of the extraction time range.

[0055] The log auditing module 101 also establishes address filtering conditions in the raw log data storage area based on the network address of the operation object in the handling association information. This filtering condition matches all raw log records whose source address field or destination address field is equal to the network address of the operation object.

[0056] The log auditing module 101 performs a joint query on the address filtering conditions and the time range conditions to extract all log records from the original log data that simultaneously meet the address matching requirements and whose timestamps are within the range of Tstart to Tend. For example, when the operation type is a blocking operation, Δt is set to Δtblock, and the extraction range covers all communication logs related to that network address within a relatively long period before and after the operation timestamp; when the operation type is an isolation operation, Δt is set to Δtisolate, and the extraction range only covers key behavior logs within a relatively short period before and after the operation timestamp.

[0057] This embodiment achieves an adaptive match between the scope of evidence collection and the intensity of the intervention by dynamically determining the time window length based on the operation type. Because blocking operations involve broader changes in network connection states, requiring longer log periods to reconstruct the attack entry point and the effectiveness of the intervention, while isolation operations only involve adjustments to access boundaries and have relatively concentrated behavioral trajectories, it is technically necessary to adopt differentiated time window extraction strategies for different intervention operations. This mechanism of dynamically adjusting the evidence collection time window based on the operation type avoids storage redundancy or evidence omissions caused by using a fixed extraction duration regardless of the severity of the intervention, thus optimizing the utilization efficiency of log storage resources while ensuring the integrity of the evidence collection.

[0058] Furthermore, in the log audit module 101, generating evidence collection log data includes: sorting the extracted log records according to the operation timestamp to generate evidence collection log data containing a log segment before the operation, a log segment at the operation time, and a log segment after the operation; calculating a hash check value for the evidence collection log data, binding and storing the hash check value with the alarm identifier in the handling association information; writing the evidence collection log data into an anti-tampering storage area, saving it according to the storage retention period, and prohibiting deletion and modification operations on the evidence collection log data in the anti-tampering storage area.

[0059] Specifically, the log auditing module 101 sorts the log records extracted in the aforementioned steps according to the operation timestamps to generate forensic log data. The operation timestamp is denoted as Top, and the sorted log records are arranged in chronological order of their timestamps.

[0060] The log audit module 101 divides the sorted log records into three segments based on Top. Log records with timestamps earlier than Top are assigned to the pre-operation log segment, which reflects the communication behavior and status information of the target network device before the execution of the disposal operation. Log records with timestamps equal to or closest to Top are assigned to the operation time log segment, which reflects the key events at the moment the disposal operation is executed. Log records with timestamps later than Top are assigned to the post-operation log segment, which reflects the network response and connection status changes after the execution of the disposal operation. The three segments of log records together constitute the complete forensic log data Dforensic. The log audit module 101 calculates the hash check value H of the forensic log data Dforensic. The hash check value H is determined by the following formula: H = Hash(Dforensic). In the formula, Dforensic is the binary content of the aforementioned three-segment forensic log data, containing the complete byte sequence of the pre-operation log segment, the operation time log segment, and the post-operation log segment; Hash is a preset hash algorithm that maps an input of arbitrary length to a fixed-length output digest. The hash check value H uniquely identifies the content status of the current evidence log data. If any bit in the evidence log data changes, the recalculated hash check value will differ from H.

[0061] The log auditing module 101 binds and stores the hash verification value H with the alarm identifier IClalert in the handling association information. The alarm identifier IClalert is a unique identifier assigned by the security management module when generating the handling association information, used to associate risk alarms, handling instructions, and evidence collection logs. The binding storage generates an evidence collection index entry, which at least includes the alarm identifier IClalert, the hash verification value H, a pointer to the storage location of the evidence collection log data, and the generation time.

[0062] The log audit module 101 writes the Dforensic evidence log data to the tamper-proof storage area. This storage area uses an append-only write mode, implemented through file system permission control or a write-once-read-many storage medium. After writing, the log audit module 101 sets access control flags for the evidence log data in this storage area, prohibiting any process or user from performing deletion or modification operations on the data. Deletion operations include physical deletion and logical deletion, while modification operations include content overwriting, appending tampering, and metadata changes. Simultaneously, the log audit module 101 implements lifecycle management for the evidence log data according to the storage retention period (Tretention) determined by the aforementioned alarm level. When the storage retention period expires, the log audit module 101 migrates the evidence log data to the archive storage area instead of deleting it directly; if the evidence log data involves an unresolved security incident, its storage retention period is extended until the incident is closed.

[0063] This embodiment's solution forms an evidence chain structure that strictly corresponds to the handling action by sorting the extracted log records according to the operation timestamp and dividing them into three segments: before the operation, at the operation time, and after the operation. The pre-operation log segment can reconstruct the attack posture before the handling action, the operation time log segment can fix the precise time point of the handling execution, and the post-operation log segment can verify the handling effect, thus giving the forensic log data complete behavioral temporal characteristics. Simultaneously, by calculating hash checksums and binding them to alarm identifiers for storage, the immutable association between the forensic log data and specific security events is ensured; by writing to a tamper-proof storage area and prohibiting deletion and modification, the forensic data is physically isolated and protected at the storage level. This combination of three-segment sorting, hash binding, and tamper-proof storage solves the problems of easy loss, easy tampering, and inaccurate correspondence between log evidence and the handling action time in traditional security forensics, providing a reliable data foundation for subsequent security audits and source tracing analysis.

[0064] Furthermore, after increasing the network traffic data collection frequency of the corresponding network device, the situational awareness module 102 also performs the following: The collected network traffic data is processed according to a preset log format, and supplementary log data is generated and sent to the log audit module. The log auditing module merges the supplementary log data with the structured log to generate merged log data; when the log collection integrity rate corresponding to the merged log data is higher than a preset threshold, a log collection recovery notification is sent to the situation awareness module.

[0065] Specifically, after increasing the network traffic data collection frequency of the corresponding network device, the situational awareness module 102 continuously captures the data packet stream of that network device through the traffic mirroring interface. At this time, because the sampling rate has been increased or the statistical window has been shortened, the number of captured data packets is significantly higher than the number under the baseline collection state.

[0066] The situational awareness module 102 extracts fields from the collected network traffic data according to a preset log format. This preset log format is determined in advance through negotiation between the log auditing module 101 and the situational awareness module 102, and includes at least a timestamp field, a source network address field, a destination network address field, a port number field, and a protocol type field. The situational awareness module 102 extracts five-tuple information from the packet header, including the source IP address, destination IP address, source port, destination port, and transport layer protocol identifier, and maps these network layer fields to their corresponding fields in the log format. Simultaneously, it extracts application layer features from the packet payload and fills them into the application layer fields of the log format. After the above field extraction, the original network traffic data is converted into supplementary text or JSON type log data.

[0067] The situational awareness module 102 sends the supplementary log data to the log auditing module 101. Upon receiving the supplementary log data, the log auditing module 101 merges it with the previously collected structured logs. During the merging process, the log auditing module 101 first checks the field alignment between the supplementary log data and the structured logs, including whether the timestamp precision is consistent, whether the field names match, and whether any field values ​​are missing. When the field alignment is normal, the log auditing module 101 inserts the supplementary log data into the corresponding positions of the missing time periods in the structured logs, generating merged log data.

[0068] The log auditing module 101 calculates the log collection integrity rate corresponding to the merged log data. Let the actual number of log entries after merging be Nmerged, and the expected number of log entries to be collected in the current collection period be Nexp. Then, the log collection integrity rate Pmerged after merging is determined by the following formula: Pmerged = Nmerged / Nexp × 100% Nmerged represents the total number of log entries after merging the supplementary log data with the original structured logs, obtained by the log audit module 101 counting the merged log data. Nexp represents the expected number of log entries to be collected by the network device in the current collection period, determined by multiplying the device's historical average log generation rate by the collection period duration, consistent with the benchmark used when calculating the expected number of log entries to be collected before sending the data gap notification.

[0069] When the merged log collection integrity rate Pmerged is higher than or equal to the integrity rate threshold Pth, it indicates that the missing logs of the network device in the current collection period have been filled with supplementary log data. The log audit module 101 sends a log collection recovery notification to the situation awareness module 102. This recovery notification includes at least the network device identifier and the time when the recovery takes effect, and is used to inform the situation awareness module 102 that the log collection of the network device has returned to normal.

[0070] After receiving the log collection recovery notification, the situational awareness module 102 queries the previously recorded traffic compensation status entries, restores the network traffic data collection frequency corresponding to the network device identifier to the base frequency before the increase, and ends the temporary traffic compensation.

[0071] Furthermore, when multiple network devices simultaneously send data gap notifications, the situational awareness module 102 also performs the following: Obtain the asset security level of each network device, and the type of log missing reason in the corresponding data gap notification for each network device; Based on the asset security level and the type of log missing reason, the priority for increasing the traffic data collection frequency of each network device is determined as follows: when the asset security level is higher than the level threshold and the log missing reason type is transmission interruption, it is determined as the first priority; when the asset security level is lower than or equal to the level threshold, it is determined as the second priority. Network traffic data collection bandwidth is allocated sequentially according to the increasing priority. When the total bandwidth is insufficient, the increased traffic data collection frequency requirement of the network device corresponding to the first priority is given priority, and the increase in traffic data collection frequency of the network device corresponding to the second priority is reduced by a preset ratio.

[0072] Specifically, the situational awareness module 102 simultaneously receives data gap notifications from multiple network devices within a certain collection period. Each notification carries the corresponding network device identifier, the time period of the missing log, and the type of log missing reason. The situational awareness module 102 queries the security management module 103 for the asset security level of each network device. This level is pre-assessed by the security management module 103 based on the importance of the business system to which the device belongs and the asset vulnerability score, and is denoted as Lasset. At the same time, the situational awareness module 102 parses the log missing reason type in each data gap notification, denoted as Rtype. The situational awareness module 102 determines the priority of increasing the traffic data collection frequency based on the asset security level and the log missing reason type. The level threshold is set to Lth. When the asset security level Lasset of a network device is greater than Lth, and its log missing reason type Rtype is transmission interruption, the device is determined to be of first priority P1. When the asset security level Lasset is less than or equal to Lth, the device is determined to be of second priority P2.

[0073] The priority determination logic can be expressed as follows: if Lasset > Lth and Rtype = transmission interruption, then P = P1; otherwise, P = P2.

[0074] In the formula, Lasset is the asset security level of the network device, which is pre-assessed and stored by the security management module 103; Lth is the preset level threshold, used to distinguish between core assets and general assets; Rtype is the log missing reason type, including transmission interruption, format parsing failure and storage queue overflow; P is the priority of traffic data collection frequency, which can be P1 or P2, with P1 having higher scheduling priority than P2.

[0075] The situational awareness module 102 acquires the total available network traffic data acquisition bandwidth, denoted as Btotal. This bandwidth is determined by the physical link capacity of the traffic mirroring interface and the current basic acquisition load. The situational awareness module 102 allocates bandwidth according to priority order. First, it allocates the bandwidth requirement after the increase in traffic data acquisition frequency to the network device corresponding to the first priority P1. Let the number of first priority devices be N1, and the bandwidth requirement of a single first priority device after the increase be b1, then the total bandwidth requirement B1 of the first priority is: B1 = N1 × b1. Where, N1 is the number of network devices determined to be first priority; b1 is the bandwidth required by a single first priority device after the increase in traffic data acquisition frequency, calculated from the increased sampling rate and statistical window of the device.

[0076] The situational awareness module 102 compares the total bandwidth Btotal with the first priority's total bandwidth requirement B1. When Btotal is greater than or equal to B1, after satisfying all the bandwidth requirements of the first priority, the remaining bandwidth is allocated to the network device corresponding to the second priority P2. When Btotal is less than B1, the bandwidth requirements of the first priority device are prioritized, and the second priority device cannot obtain full bandwidth allocation. At this time, the situational awareness module 102 reduces the increase in the traffic data collection frequency of the network device corresponding to the second priority by a preset ratio. Let the original increase of the second priority device be Δf, and the reduced increase be Δfreduced, then: Δfreduced = Δf × α. Where, Δf is the original increase in the traffic data collection frequency of the second priority device, calculated from the increase method that should have been determined by the log missing reason type in the data gap notification of the device; α is the reduction ratio coefficient, which is greater than zero and less than 1, dynamically determined by the degree of bandwidth gap. When the bandwidth gap is large, α takes a smaller value, which significantly reduces the traffic compensation of the second priority device; when the bandwidth gap is small, α takes a larger value, which allows the second priority device to still receive a certain degree of compensation.

[0077] The situational awareness module 102 records the actual bandwidth allocation results and adjustment values ​​of each network device, and generates bandwidth allocation logs for subsequent auditing and policy optimization reference.

[0078] In another embodiment, the determination of the increased priority for traffic data collection frequency of each network device can be further determined by combining the log missing ratio in the corresponding data gap notification of each network device. The log missing ratio is the ratio of the number of missing log entries in the current collection period to the expected number of log entries to be collected. When the log missing ratio exceeds a preset missing ratio threshold, the priority of that network device is increased; or, the network devices are prioritized according to their missing ratio from high to low, with higher missing ratios resulting in higher priority.

[0079] In another embodiment, the determination of the priority for increasing the traffic data collection frequency of each network device can be further combined with the estimated bandwidth required after increasing the traffic data collection frequency of each network device. Specifically, when obtaining the estimated bandwidth requirement of each network device after increasing the frequency, and given a limited total bandwidth, for multiple network devices with the same asset security level and the same type of log missing cause, priority is given to satisfying the network device with the smaller estimated bandwidth requirement, so that the limited total bandwidth can cover data compensation for more network devices.

[0080] In another embodiment, the priority can also be determined by a weighted score based on at least two of the following: asset security level, log missing cause type, log missing ratio, and device bandwidth requirements. A corresponding weight coefficient is assigned to each factor, a comprehensive priority score for each network device is calculated, and network traffic data collection bandwidth is allocated sequentially from high to low based on the comprehensive priority score.

[0081] This invention prioritizes traffic compensation by simultaneously considering both asset security level and the type of log loss cause, achieving differentiated scheduling under limited bandwidth resources. Because core assets and devices experiencing log loss due to transmission interruptions often represent more serious security monitoring blind spots, their traffic compensation bandwidth needs to be prioritized. This dual-dimensional priority determination mechanism based on asset importance and the root cause of the loss avoids the indiscriminate or random processing common in traditional traffic acquisition systems when multiple devices experience concurrent log loss. It ensures that critical network devices receive sufficient traffic data compensation even in resource-constrained scenarios, thereby maintaining the continuity and effectiveness of network-wide security monitoring.

[0082] Secondly, this embodiment also proposes a collaborative protection method for network security platforms, applied to the collaborative protection system for network security platforms described in the first aspect. The collaborative protection method for network security platforms proposed in this embodiment is applied to the aforementioned system and is executed collaboratively by the log auditing module, the situational awareness module, and the security management module.

[0083] like Figure 2 As shown, the collaborative protection method of the network security platform includes: S201, Collect log data from network devices and generate structured logs; The log auditing module receives raw log streams reported by various network devices in real time via a collection agent deployed in the network area using the Syslog protocol or SNMP Trap method. It performs field parsing and format conversion on the raw log streams to generate structured logs in a unified format. These structured logs contain at least a timestamp field, a source network address field, an event type field, and a log level field.

[0084] S202, monitor whether the structured log has been collected completely; if it is incomplete, generate a data gap notification. The log auditing module determines the expected number of log entries to be collected within the current collection period based on the historical log generation rate of each network device. It then compares the actual number of successfully parsed log entries with the expected number to generate a log collection completeness rate. When the log collection completeness rate is lower than the completeness rate threshold, it is determined that the collection is incomplete, and a data gap notification is generated. This notification must at least include the network device identifier, the missing time period, and the type of reason for the missing log.

[0085] S203, based on the data gap notification, increase the network traffic data collection frequency of the corresponding network device; The situational awareness module analyzes the log missing cause type in the data gap notification to determine the addition method. When the log missing cause type is transmission interruption, the packet capture sampling rate is increased so that the number of packets captured per unit time is higher than the number under the baseline collection state. When the log missing cause type is format parsing failure, the traffic statistics time window is shortened and the application layer protocol identification depth is increased so that traffic data is parsed and recorded at a finer granular level.

[0086] S204, perform correlation analysis between the network traffic data and the structured log to generate risk alarm data; The situational awareness module extracts connection records from network traffic data and behavior records from structured logs, comparing the network addresses, port numbers, and timestamps of the two. When these fields match and the timestamps fall within the same time window, the corresponding network traffic data is matched and associated with the structured log. If no corresponding structured log exists within a missing time period, the network traffic data records within that time period are used as risk-related data, generating risk alarm data and sending it to the security management module.

[0087] S205, Generate a handling instruction based on the risk alarm data, and execute a control operation based on the handling instruction; The security management module analyzes the abnormal behavior types and alarm levels in the risk alarm data to determine the handling strategy. The handling instruction includes the network address of the target object and the operation timestamp. After receiving the handling instruction, the situational awareness module locates the target network device based on the target object's network address and executes access control operations.

[0088] S206, Generate disposal association information according to the disposal instruction; extract log records from the original log data according to the disposal association information to generate evidence collection log data.

[0089] The associated information includes the network address of the operation target, the operation timestamp, the operation type, and the alarm identifier. The log auditing module extracts matching records from the raw log data based on the network address of the operation target and the operation timestamp. Simultaneously, it determines the time window length based on the operation type. When the operation type is a blocking operation, since completely severing the communication link has a significant impact on services, it is necessary to extract logs from a longer period before and after the operation to fully record the status change; therefore, a first time length is determined. When the operation type is an isolation operation, since only the device is moved to a restricted area without completely terminating the connection, the impact on services is relatively controllable; therefore, a second time length is determined, and the first time length is longer than the second time length. The log auditing module extracts the raw log records within this time window length before and after the operation timestamp, sorts them according to the operation timestamp, and generates forensic log data containing pre-operation log segments, operation-time log segments, and post-operation log segments.

[0090] Thirdly, the present invention also proposes an electronic device comprising: one or more processors, and a memory for storing one or more computer programs; the computer programs are configured to be executed by the one or more processors, and the programs include steps for performing the network security platform collaborative protection method as described in the second aspect.

[0091] The memory stores one or more computer programs containing a sequence of instructions executable by a processor. When the processor reads and executes the computer program, the electronic device performs the steps of the aforementioned method. The electronic device may also include a communication interface for data interaction with the network environment where the log auditing module, situational awareness module, and security management module are deployed, and an input / output interface for receiving user configuration parameters and outputting security operation status information.

[0092] Specifically, this embodiment also proposes a computer-readable storage medium storing a computer program. When the computer program is loaded and executed by a processor in an electronic device, it implements the aforementioned collaborative protection method of the network security platform. The computer-readable storage medium may be in at least one form of magnetic storage medium, optical storage medium, or semiconductor storage medium, such as a hard disk, optical disk, or flash memory chip. The program code in the storage medium may also include an interface protocol stack for implementing cross-module data communication, ensuring that data transmission between each step conforms to preset communication formats and timing requirements.

[0093] The above description is merely an embodiment of the present invention and is not intended to limit the scope of protection of the present invention. For those skilled in the art, the present invention can have various modifications and variations. Any modifications, equivalent substitutions, improvements, etc., made within the spirit and principles of the present invention should be included within the scope of protection of the present invention.

Claims

1. A collaborative protection system for a network security platform, characterized in that, include: The log auditing module collects log data from network devices and generates structured logs, which are then sent to the situation awareness module. It also monitors whether the structured logs are collected completely, and if incomplete, sends a data gap notification to the situation awareness module. The situational awareness module receives the structured logs and the data gap notifications; when the data gap notification is received, the network traffic data collection frequency of the corresponding network device is increased; The network traffic data is correlated and analyzed with the structured logs to generate risk alarm data, which is then sent to the security management module. The security management module generates a response instruction based on the risk alarm data and sends it to the situation awareness module, so that the situation awareness module can perform control operations according to the response instruction. The system generates and sends disposal-related information to the log auditing module, enabling the log auditing module to extract log records from the original log data based on the disposal-related information and generate evidence collection log data. The data gap notification also includes the missing time period and the type of reason for the missing log; The types of reasons for missing logs include transmission interruption, format parsing failure, and storage queue overflow. The increase in the network traffic data collection frequency of the corresponding network devices includes: Based on the log missing reason type in the data gap notification, determine the method for increasing the traffic data collection frequency; specifically, when the log missing reason type is transmission interruption, increase the data packet capture sampling rate; when the log missing reason type is format parsing failure, shorten the traffic statistics time window and increase the application layer protocol identification depth. The addition method is associated with the network device identifier and recorded. When the log audit module subsequently sends a log collection recovery notification for the network device identifier, the network traffic data collection frequency is restored to the baseline frequency before the addition.

2. The network security platform collaborative protection system according to claim 1, characterized in that, The step of performing correlation analysis between the network traffic data and the structured logs includes: The source network address, destination network address, port number, and connection timestamp in the network traffic data are compared with the operation source address, operation target address, service port number, and log timestamp in the structured log, respectively. When the source network address is consistent with the operation source address, the destination network address is consistent with the operation target address, the port number is consistent with the service port number, and the connection timestamp and the log timestamp are in the same time window, the corresponding network traffic data is matched and associated with the structured log. When there is no corresponding structured log within the missing time period, the network traffic data records within the missing time period are used as risk association data to generate the risk alarm data.

3. The network security platform collaborative protection system according to claim 1, characterized in that, The processing association information includes the network address of the operation object, the operation timestamp, the operation type, and the alarm identifier of the processing instruction; The log auditing module extracts log records from the original log data based on the network address of the operation object and the operation timestamp; The log auditing module further determines the storage retention period of the evidence collection log data based on the alarm level in the risk alarm data; wherein, when the alarm level is high-risk, a first retention period is determined; when the alarm level is low-risk, a second retention period is determined; the first retention period is longer than the second retention period.

4. The network security platform collaborative protection system according to claim 3, characterized in that, The step of extracting log records from the original log data based on the processing association information includes: The time window length is determined based on the operation type: when the operation type is a blocking operation, a first time length is determined; when the operation type is an isolation operation, a second time length is determined. Based on the network address of the operation object, the operation timestamp, and the time window length, extract log records within the time window length before and after the operation timestamp from the original log data.

5. The network security platform collaborative protection system according to claim 4, characterized in that, The generation of forensic log data includes: The extracted log records are sorted according to the operation timestamp to generate evidence log data containing the log segment before the operation, the log segment at the time of the operation, and the log segment after the operation. Calculate a hash check value for the evidence collection log data, and bind and store the hash check value with the alarm identifier in the handling association information; The evidence collection log data is written to the tamper-proof storage area and stored for the specified retention period. Deletion and modification of the evidence collection log data in the tamper-proof storage area are prohibited.

6. The network security platform collaborative protection system according to claim 1, characterized in that, After increasing the network traffic data collection frequency of the corresponding network devices, the situational awareness module also performs the following: The collected network traffic data is processed according to a preset log format, and supplementary log data is generated and sent to the log audit module. The log auditing module merges the supplementary log data with the structured log to generate merged log data; when the log collection integrity rate corresponding to the merged log data is higher than a preset threshold, a log collection recovery notification is sent to the situation awareness module.

7. The network security platform collaborative protection system according to claim 1, characterized in that, When multiple network devices simultaneously send data gap notifications, the situational awareness module also performs the following: Obtain the asset security level of each network device, and the type of log missing reason in the corresponding data gap notification for each network device; Based on the asset security level and the type of log missing reason, the priority for increasing the traffic data collection frequency of each network device is determined as follows: when the asset security level is higher than the level threshold and the log missing reason type is transmission interruption, it is determined as the first priority; when the asset security level is lower than or equal to the level threshold, it is determined as the second priority. Network traffic data collection bandwidth is allocated sequentially according to the increasing priority. When the total bandwidth is insufficient, the increased traffic data collection frequency requirement of the network device corresponding to the first priority is given priority, and the increase in traffic data collection frequency of the network device corresponding to the second priority is reduced by a preset ratio.

8. A collaborative protection method for a network security platform, characterized in that, The method, applied to the collaborative protection system for a network security platform according to any one of claims 1-7, comprises: Collect log data from network devices and generate structured logs; monitor whether the structured logs are collected completely, and generate a data gap notification when they are incomplete; the data gap notification includes the missing time period and the type of log missing reason; the type of log missing reason includes transmission interruption, format parsing failure, and storage queue overflow; Receive the structured logs and the data gap notification; when the data gap notification is received, increase the network traffic data collection frequency of the corresponding network device; perform correlation analysis between the network traffic data and the structured logs to generate risk alarm data; Based on the risk alarm data, a handling instruction is generated, and a control operation is executed according to the handling instruction; handling association information is generated, and log records are extracted from the original log data according to the handling association information to generate evidence collection log data; The method of increasing the network traffic data collection frequency of the corresponding network device includes: determining the method of increasing the traffic data collection frequency according to the log missing reason type in the data gap notification; increasing the data packet capture sampling rate when the log missing reason type is transmission interruption; and shortening the traffic statistics time window and increasing the application layer protocol identification depth when the log missing reason type is format parsing failure. The addition method is associated with the network device identifier and recorded. When a log collection recovery notification for the network device identifier is sent subsequently, the network traffic data collection frequency is restored to the baseline frequency before the addition.

9. An electronic device, the electronic device comprising: One or more processors, a memory for storing one or more computer programs; characterized in that the computer programs are configured to be executed by the one or more processors, the programs including steps for performing the network security platform collaborative protection method as described in claim 8.

Images