An intensive network security comprehensive protection system

Abstract

The application relates to an intensive network security comprehensive protection system and belongs to the technical field of network security protection. The application comprises a security service integration framework, a security service component set and a security management module. The security service integration framework is the base of the system and provides services such as cache management, plug-in management, message management, network protocol and analysis, message routing and forwarding; the security service component set is an important resource of the system, is mounted on the integration framework in the form of plug-in, executes security detection of network messages and feeds back detection results; and the security management module executes unified configuration of security policies and unified display of security situations of the mounted security service components, and ensures cooperation between the security services. The application solves the problems that the deployment space, construction cost and operation and maintenance cost of the security protection system in a small, scattered and remote scene are limited.

Description

Technical Field

[0001] This invention belongs to the field of network security protection technology, specifically relating to an integrated network security protection system. Background Technology

[0002] With the continuous upgrading and evolution of cyberattack methods, various security threats are emerging one after another. To ensure the normal operation of business systems, the construction of comprehensive security protection systems is receiving increasing attention. Governments, universities, and medium / large enterprises are building robust comprehensive security protection systems in core areas such as cloud centers and data centers by stacking multiple security protection devices or deploying virtual security devices in server clusters. These systems provide multi-layered defense services to protect the security of central data. However, such security systems suffer from high construction costs, complex deployment, and large space requirements, making them unsuitable for the security construction of small information systems with limited deployment space and construction costs.

[0003] To address the limitations of deployment space, construction costs, and maintenance costs for security systems in small information systems, it is necessary to integrate multiple security services on a single device to reduce the space occupancy and system construction costs while maintaining security protection effectiveness. To solve this problem, various security vendors have launched integrated security protection devices, whose technical approaches can be broadly divided into two categories: one is to achieve the mirroring of scalable platforms and security functions based on virtualization technology; the other is to achieve the synergy of multiple security services through the deep integration of customized security functions. Multifunctional integrated security protection devices based on virtualization technology often use virtual machines and containers for deployment to reduce development costs and technical risks. One security service is deployed within a virtual machine / container, and the collaboration between services is achieved through a virtual machine monitor. This technical approach requires network packets to travel through a path of "host operating system kernel - kernel-mode network protocol stack - scalable framework - microkernel within virtual machine / container - network protocol stack within virtual machine / container -" before reaching the security service components for detection, resulting in problems such as extended transmission processing time and unstable communication between virtual machines / containers. Deep integration of customized security services, due to the lack of a scalable platform, makes it difficult to achieve on-demand expansion of security services and is not suitable for usage environments with frequently changing application scenarios.

[0004] To meet the security protection needs of small information systems that integrate multiple security services and are flexible and scalable, this invention proposes an integrated network security protection system. By integrating multiple types of security services on a single device and optimizing the coordination between these services, a miniaturized, integrated, and low-cost integrated security protection system is achieved, providing multi-layered security defense services and ensuring the network boundary security of small information systems. Summary of the Invention

[0005] (a) Technical problems to be solved The technical problem to be solved by this invention is: how to design a miniaturized, compact, and low-cost comprehensive network security protection system to meet the comprehensive security protection needs of small information systems with limited deployment space, construction costs, and operation and maintenance costs.

[0006] (II) Technical Solution To address the aforementioned technical problems, this invention provides an integrated network security protection system, comprising: a security service integration framework, a security service component set, a security management module, and a security audit module. The system uses the security service integration framework as its foundation, with various security service components mounted on it. These components enable multi-layered and multi-dimensional security detection of network packets. The security management module provides unified configuration of security policies for each security service component. The security audit module aggregates logs reported by the security service integration framework, the security management module, and each security service component, including operation logs, management logs, and security logs. The aggregated logs are then processed, stored, and analyzed in a unified manner to facilitate event tracing and attribution. The security service integration framework includes a data plane layer, which is used to send and receive network packets. This data plane layer includes a data receiving module, a data caching module, a protocol parsing module, a data distribution module, a result aggregation module, and a data sending module. The data receiving module receives network packets from the Data Plane Development Kit (DPDK). The data caching module requests shared memory and caches network packets for access by various security service components. The protocol parsing module extracts the characteristic attributes of the received network packets. The data distribution module determines whether the target service of the network packet is a security service component mounted through this mount point. If so, the characteristic attributes and cache address of the network packet are passed to each security service component for security detection, and the detection results are sent to the result aggregation module; otherwise, the process ends. The result aggregation module collects the detection results from each security service component and determines whether to intercept the network packet. If interception is determined, the process ends; otherwise, the network packet is sent out through the data sending module.

[0007] This invention also provides a method for operating the system, wherein the security policy configuration process executed by the system is as follows: Step 1: Log in to the security management module, enter the security policy configuration page, select the pre-configured security service component from the list of mounted security service components, and configure the corresponding security policy according to the configuration wizard. Step two: Based on the user's selection and input configuration information, the security management module constructs a policy configuration request and sends it to the security service integration framework; Step 3: The security service integration framework receives the policy configuration request, parses and identifies the request type and target service object, and forwards the policy configuration request to the corresponding security service component. Step four: The security service component receives the policy configuration request, parses and extracts the configuration information, updates the configuration attribute values, and constructs a policy configuration result response packet, which is then fed back to the security management module along the original path.

[0008] (III) Beneficial Effects This invention provides an integrated network security protection system, aiming to integrate multiple security services on a single device, providing multi-layered security defense services, and achieving miniaturization, intensification, and low cost of comprehensive security protection. The invention mainly consists of a security service integration framework, a security service component set, a security management module, and a security audit module. The security service integration framework, as the system's foundation, provides services such as cache management, plugin management, message management, network protocol and its parsing, and packet routing and forwarding. The security service component set, as an important system resource, is mounted on the integration framework as plugins, performing security detection of network packets and providing feedback on the detection results. The security management module performs unified configuration of security policies and unified display of security posture for each mounted security service component, ensuring collaboration between security services. The security audit module analyzes collected audit logs, uncovers potential security threats, and provides support for optimizing security policies. This invention solves the problems of limited deployment space, construction costs, and operation and maintenance costs for security systems in small, scattered, and remote information systems, as well as the dynamic and ever-changing security protection needs of small information systems in different application scenarios.

[0009] Compared with the prior art, the present invention has the following advantages: 1. The integrated network security protection system integrates multiple security services on a single device, which is different from virtualization and containerized image integration. It has the advantages of low resource consumption, low construction cost and short processing latency, and can be applied to the security construction of small information systems. 2. The security service integration framework provides plug-in services that support the on-demand deployment and flexible expansion of various security services, which can meet the security protection needs of different application scenarios; 3. Each security service component is defined as a different plugin type according to its different levels of function. It is activated at different stages of data stream transmission and processing to achieve concurrent pipeline detection of multiple network packets, which has high detection efficiency. 4. The security management module is based on the security service integration framework to achieve unified configuration of various security service policies and unified display of security status, avoiding conflicts between various security service policies, reducing the complexity of user configuration, and making it convenient for users to know the overall security status of the system in real time. Attached Figure Description

[0010] Figure 1 This is a schematic diagram of an integrated network security protection system architecture according to the present invention; Figure 2 A schematic diagram of a pipelined process that performs multiple security checks on the same message; Figure 3 A sequence diagram of the security policy configuration process for an integrated network security protection system; Figure 4 This is a sequence diagram of the network packet security detection process for an integrated network security protection system. Figure 5 This is a sequence diagram of the full lifecycle management process of security logs for an integrated network security protection system. Detailed Implementation

[0011] To make the objectives, contents, and advantages of the present invention clearer, the specific embodiments of the present invention will be described in further detail below with reference to the accompanying drawings and examples.

[0012] This invention addresses the limitations of current integrated network security protection systems, which consist of stacked security devices and are unsuitable for mobile scenarios such as vehicle-mounted, ship-mounted, and airborne systems, as well as for small information systems located in geographically dispersed or remote mountainous areas. It proposes an integrated network security protection system that integrates multiple security services on a single device, providing multi-layered security defense services. This achieves miniaturization, consolidation, and low cost in integrated security protection, thus solving the security problems of small information systems.

[0013] To achieve the above objectives, this invention proposes an integrated network security protection system, with reference to... Figure 1 The system comprises the following modules: a security service integration framework, a security service component set, a security management module, and a security audit module. The system uses the security service integration framework as its foundation, enriching threat detection tools by mounting security service components on top of the framework; it achieves multi-layered and multi-dimensional security detection of network packets through various security service components; the security management module uniformly configures security policies for each security service component to enhance threat identification capabilities, providing multi-dimensional and in-depth protection services for information systems; and the security audit module aggregates various operation logs, management logs, and security logs reported by the security service integration framework, security management module, and various security service components, and performs unified processing, storage, and analysis of the aggregated logs to facilitate subsequent event tracing and attribution.

[0014] The security service integration framework comprises a basic framework layer, a network protocol layer, and a data plane layer, providing services such as cache management, plugin management, message management, network protocols and their parsing, and packet routing and forwarding. The basic framework layer includes modules for cache management, plugin management, and message management, enabling unified management and scheduling of resources within the security service integration framework. The network protocol layer provides a complete user-space network protocol stack, covering the data link layer, network layer, and transport layer, including Ethernet, IPv4, IPv6, ARP, ICMP, TCP, and UDP, providing network packet routing and forwarding and VLAN services to support rapid network packet processing. The data plane layer provides services such as message sending and receiving, application protocol parsing, and data interaction, enabling rapid data transmission and reception. It includes modules for data reception, data caching, protocol parsing, data distribution, result aggregation, and data transmission. The data reception module receives raw messages from the Data Plane Development Kit (DPDK); the data caching module requests shared memory and caches raw messages for access by various security service components; the protocol parsing module extracts the characteristic attributes of the received raw messages; the data distribution module determines whether the target service of the message is a security service component mounted through this mount point; if so, it passes the characteristic attributes and cached address of the raw message to each security service component for processing and sends the processing result to the result aggregation module; otherwise, the process ends. The result aggregation module collects the processing results from each security service component and determines whether to intercept the message.

[0015] The security service integration framework described herein differs from scalable frameworks based on virtualization technology, possessing characteristics such as high versatility, high performance, and high stability. First, the security service integration framework runs in the operating system's user space, decoupled from the operating system kernel, and does not rely on the operating system's kernel interface. It can be quickly deployed on various mainstream Linux systems such as Kylin, UOS, Ubuntu, and CentOS, exhibiting high versatility. Second, the security service integration framework integrates a user-space network protocol stack. Combined with DPDK, it directly receives raw packets from the network card and performs network protocol parsing in user space, bypassing the complex kernel-space network protocol stack. This significantly improves network protocol parsing efficiency, thereby enhancing the processing performance of security services. Third, in scalable architectures based on virtualization technology, network packets undergo a process from reception to processing, involving "host operating system kernel - kernel-space network protocol stack - scalable framework - microkernel within virtual machine / container - network protocol stack within virtual machine / container - packet processing." In contrast, the security service integration framework only requires "host operating system kernel - integration framework - user-space network protocol stack - packet processing," greatly shortening the packet transmission path and improving the processing performance of security services. Finally, in a virtualization-based scalable architecture, communication between virtual machines / containers needs to be relayed through the scalable architecture. Due to communication instability, packet loss occurs. However, the security service integration framework integrates routing forwarding and VLAN modules, which can achieve fast packet forwarding and has high stability.

[0016] The security service integration framework provides plugin registration, plugin mounting, plugin uninstallation, and plugin deregistration interfaces, supporting on-demand deployment of security service components based on actual use cases, suitable for different security requirements. The plugin registration interface is lightweight, requiring only the address of the security service registration object to complete registration, eliminating the need for wrappers such as virtual machines or containers, thus reducing the storage space required for service objects. The plugin mounting interface provides three types based on plugin type: input detection plugin mounting interface, transmission detection plugin mounting interface, and local service plugin mounting interface. These are located at different mounting points within the security service integration framework, aligned with message transmission processing, and are respectively designated as input detection plugin mounting point, transmission detection plugin mounting point, and local service plugin mounting point. At the input detection plugin mounting point at the network packet entry point, security service components are mounted through the input detection plugin mounting interface. When network packets flow through, the security service integration framework intercepts the network traffic and distributes the characteristic attributes and original packet cache address to each security service component at this mounting point through the data distribution module. The security service components perform the first layer of security detection on the packets, and the result aggregation module determines whether to allow the traffic based on the detection results. At the transmission detection plugin mounting point before the packets are routed or distributed to the local service for processing, the security service integration framework suspends the normal processing flow again, storing the characteristic attributes and original packet cache address. The cached address is distributed to the security service component mounted at this mount point, which performs a second layer of security checks on the packet from different dimensions. The result aggregation module summarizes the detection results fed back by each security service component at this mount point and determines whether to allow the packet. For packets distributed to local security services, at the local service-type plugin mount point, the data distribution module of the security service integration framework determines whether the target service of the packet is a security service component mounted at this mount point. If so, the packet's characteristic attributes and the packet cached address are distributed to the corresponding security service component for security processing, and the processing result is fed back to the result aggregation module; otherwise, the process ends. The three types of plugin mount interfaces provided by the security service integration framework, compared with the single mount mode of virtual images, have the characteristics of fine-grained control and can realize multi-layer detection of multiple checks and multi-dimensional detection of the same check. Furthermore, based on the plug-in mounting interface, the security service integration framework supports the flexible deployment of security service components according to the security protection needs of actual use scenarios. It is very suitable for the security protection of different information systems in small, scattered, and remote scenarios. Compared with customized comprehensive security protection systems that deeply integrate multiple security services, this system has extremely high flexibility.

[0017] The security service component set is divided into three categories based on the different security service processing results: gatekeeper, bypass, and invocation. Gatekeeper service components have the ability to intercept detected attack packets, such as network access control, network traffic anomaly detection, and application access control components. They can intercept illegal access packets, malformed packets, and abnormal traffic packets, directly blocking their further transmission and recording security logs to report to the security audit module. Bypass service components cannot intercept detected attack packets, such as network intrusion detection components and traffic behavior audit components. They can only record security logs to report to the security audit module and report alarms to the security management module. Users can adjust their policies according to the prompts to improve protection effectiveness. Invocation service components are the final processing process of packets. They execute corresponding operations according to request instructions, such as device access control components, malicious code detection components, and database audit components. They feed back the operation results along the original path and record log data to report to the security audit module.

[0018] The different security service components in the security service component set are defined as different plugin types according to their different layers of operation in the OSI architecture, including input detection plugins, transmission detection plugins, and local service plugins. The network traffic anomaly detection component is defined as an input detection plugin, which is activated first by the data distribution module of the security service integration framework after network traffic is received. Security service components such as network access control components, application access control components, and network intrusion detection components are defined as transmission detection plugins, which are activated by the data distribution module of the security service integration framework before packet routing or local processing to perform security detection. Service components such as device access control components, malware detection components, and database auditing components are defined as local service plugins, which are activated by the data distribution module of the security service integration framework when the packet is a local packet and the target service process is a mounted security service component, to process the network packet.

[0019] The security service component set described herein features lightweight design. To support the normal and stable operation of security services, traditional virtualization-based security services are typically deployed within virtual machines or containers. Leveraging the microkernel integrated within the virtual machine / container, the security service can run normally and stably without modification. However, during the process of packaging the security service into an image, it needs to be packaged together with the virtual machine / container. This results in a large storage space requirement for the image, and the performance is inevitably affected as packets need to traverse the virtual machine or container's encapsulation during operation. This system's security service components are encapsulated according to the plugin registration, plugin mounting, plugin unmounting, and plugin deregistration interfaces provided by the security service integration framework. This eliminates the need for external encapsulation of the virtual machine / container, significantly reducing the component's space occupancy. Simultaneously, the security service components directly utilize the host machine's operating system, improving overall performance to a certain extent.

[0020] The security management module comprises sub-modules such as system management, security policy management, security upgrade, and situational awareness display. It supports three types of administrators and enables functions including configuring system parameters, uniformly configuring security policies for various security service components, upgrading the system and attack signature database, querying basic information about the device and security service components, querying audit logs, and uniformly displaying the system's security situation. The security management module provides a unified human-computer interaction interface. System administrators log in to the security management module and configure and query system parameters using the configuration wizard on the system configuration page. They also perform security upgrades for the system software and attack signature database using the wizard on the system maintenance page, including both local offline upgrades and remote online upgrades. Security administrators log in to the security management module and configure and query security policies for various security service components using the wizard on the security policy configuration page. Audit administrators log in to the security management module and configure log storage policies and query various log information using the wizard on the audit management page. After logging into the security management module, all three types of administrators can view the current security overview of the system and the security situation reported by each security service component through the situational awareness monitoring page. The security management module follows the standard security management interface specification and accepts remote online management of the system from the superior security management system, including querying the system's security status and current security policies, and issuing security control commands.

[0021] The security audit module aggregates all operation logs, management logs, and security logs generated by the other three modules of the system, processes, analyzes, and stores them. It consists of sub-modules for log collection, log processing, log analysis, log storage, and log querying. The log collection sub-module is responsible for collecting various log data sent by the security service integration framework, various security service components, and the security management module. The log processing sub-module performs cleaning, redundancy removal, and normalization on various log data. The log storage sub-module stores the processed log data in the corresponding log database. The log analysis sub-module analyzes the stored log data from different dimensions to uncover potential security threats, generate alarms, and report them to the security management module, providing support for security policy optimization. The log query sub-module supports querying the stored log data from different dimensions and displays it on the audit management page of the security management module. The security audit module follows standard security audit management interface specifications, accepting log queries from the superior security audit system or operation and maintenance management system, or proactively reporting security logs to the superior security audit system or operation and maintenance management system according to policy configuration.

[0022] The key technologies of this invention are pipelined processing of different security checks on the same message and concurrent security checks on multiple messages. Traditional virtualization-based integrated security protection systems mount each security service component as a virtual image on a scalable architecture, enabling only concurrent processing of the same message. To achieve pipelined processing of different security checks on the same message, this system uses message transmission processing as the axis and sets different plugin mounting points on the security service integration framework: input detection plugin mounting point, transmission detection plugin mounting point, and local service plugin mounting point. Different types of plugins are mounted to perform different security checks, and the system intercepts non-compliant messages upon detection, avoiding redundant checks by subsequent security service components.

[0023] refer to Figure 2 Assume that the integrated network security protection system integrates security service components such as network traffic anomaly detection, network access control, application access control, network intrusion detection, device access authentication, malware detection, and database auditing. Among these, the network traffic anomaly detection component is defined as an input detection plugin and mounted on the input detection plugin mounting point of the security service integration framework; the network access control, application access control, and network intrusion detection service components are defined as transmission detection plugins and mounted on the transmission detection plugin mounting point of the security service integration framework; and the device access control, malware detection, and database auditing service components are defined as local service plugins and mounted on the local service plugin mounting point of the security service integration framework.

[0024] To achieve pipelined processing, with message transmission processing as the central axis, security service components are activated at different plugin mounting points within the security service integration framework to perform security checks. When a message passes through an input detection plugin mounting point, the security service integration framework suspends the message's subsequent normal flow. The data distribution module within the security service integration framework then passes the message's characteristic attributes and the original message cache address to the network traffic anomaly detection service component for detecting abnormal traffic, malformed messages, flood attack messages, etc. Security events detected are logged and reported to the security audit module. Simultaneously, the detection results are fed back to the result aggregation module within the security service integration framework. If the detection result determines it to be an attack message, the result aggregation module will intercept it, blocking the message from posing a security threat to the internal network; otherwise, message transmission is resumed and allowed. When a packet passes through the mounting point of a transmission detection plugin, it is suspended again by the security service integration framework. The data distribution module within the integration framework distributes the packet to service components such as network access control, application access control, and network intrusion detection to perform operations such as access permission determination, unauthorized access detection, and attack packet detection. Security events detected are logged and reported to the security audit module, while the detection results are aggregated to the result aggregation module. The result aggregation module decides whether to block the packet based on the type of security service component and the detection results. If any gatekeeper-type security service component detects an attack packet, the result aggregation module immediately performs an interception operation, blocking the packet's transmission. If only a bypass-type security service component detects an attack packet, it alerts the security management module, logs the security information, and allows the packet to continue transmission. When the packet is a local packet and the target process is a mounted local service plugin, the security service integration framework directly sends the packet to the target service component through the data distribution module and receives the processing results from the security service.

[0025] To improve overall security detection / processing performance, this system first requests shared memory through the data caching module of the security service integration framework and caches the received raw packets. At the plug-in mount point, the data distribution module of the security service integration framework then distributes the cached address of the raw packets to each security service component, achieving zero-copy packets and avoiding copying and transferring packets between multiple security service components, thus greatly reducing transmission load. Secondly, during pipelined processing, the security service integration framework promptly filters illegal or attack packets, preventing duplicate detection of packets across all security service components and avoiding waste of system resources such as CPU and memory. Finally, the pipelined processing incorporates... Concurrent processing is implemented for security service components of the same type, such as network access control, application access control, and network intrusion detection, which are all transmission detection plugins. Each security service component performs security detection independently and concurrently, and reports the detection results. The result aggregation module then performs packet interception or allowance operations based on the collected detection results. Its processing latency is the longest among all security service components. Finally, network packets are streamed into the security device. Each plugin mount point performs security detection independently on the packets that flow through it, realizing concurrent processing of different packets without waiting for the previous packet to complete all multiple detections, which greatly improves the overall processing performance of the system.

[0026] To enhance the system's ability to address security needs across diverse usage scenarios, security service components are deployed on demand as plug-ins. For input detection and transmission detection plug-ins, the data distribution module of the security service integration framework simultaneously distributes the packet's characteristic attributes and the original packet cache address to each security service component. Each component independently performs security checks and feeds back the results to the result aggregation module. For local service plug-ins, the data distribution module transmits the packet's characteristic attributes and the original packet cache address to the target service component based on the packet's target process, and the result aggregation module receives the processing results from the corresponding component. These three plug-in types cover all security service components, and the different plug-in mounting points provided by the security service integration framework allow for flexible integration of different security service components, meeting the security protection needs of various application scenarios.

[0027] To make the objectives, content, and advantages of this invention clearer, this invention uses multiple embodiments to illustrate the workflow of an integrated network security protection system, including: a security policy configuration process; a network packet security detection process; and a security log lifecycle management process.

[0028] The specific embodiments of the present invention will be described in further detail below with reference to the accompanying drawings and examples.

[0029] like Figure 3 As shown, the specific steps for configuring the security policy of the integrated network security protection system are as follows: Step 1: The security administrator logs into the security management module of this system, enters the security policy configuration page, selects the pre-configured security service component from the list of mounted security service components, and configures the corresponding security policy according to the configuration wizard. Step two: Based on the user's selection and input configuration information, the security management module constructs a policy configuration request and sends it to the security service integration framework; Step 3: The security service integration framework receives the policy configuration request, parses and identifies the request type and target service object, and forwards the policy configuration request to the corresponding security service component object. Step four: The security service component object receives the policy configuration request, parses and extracts the configuration information, updates the configuration attribute values ​​of this service, and constructs a policy configuration result response packet, which is then fed back to the security management module along the original path.

[0030] like Figure 4 As shown, the specific steps of network packet security detection in the integrated network security protection system are as follows: Step 1: The data receiving module in the security service integration framework receives network packets from DPDK, caches the original packets through the caching module, and then the protocol parsing module performs the parsing and feature attribute extraction operations of the network packets. Step 2: At the input detection plugin mounting point of the security service integration framework, the security service integration framework suspends the normal processing flow and passes the packet's characteristic attributes and the original packet's cache address to the network traffic anomaly detection service component through the data distribution module. Step 3: The network traffic anomaly detection service component performs services such as malformed packet detection and abnormal traffic detection based on the input packet characteristics to detect whether there are any anomalies, and feeds back the detection results to the integration framework. At the same time, it records security logs for detected anomalies and reports them to the security audit module. Step 4: The result aggregation module of the security service integration framework performs packet interception or allowance operations based on the results fed back by the network traffic anomaly detection service component. For allowed network traffic, the security service integration framework resumes the suspended processing flow. Step 5: At the mounting point of the transmission detection plugin in the security service integration framework, the normal processing flow of the packet is remounted. The packet characteristic attributes and the original packet cache address are simultaneously distributed to the network layer access control service component, the application layer access control service component, and the network intrusion detection service component through the data distribution module. Step 6: Each service component concurrently executes the corresponding security detection operation and feeds back the detection results to the integration framework. At the same time, the attack events detected by each service component are recorded in the security log and reported to the security audit module. Step 7: The result aggregation module of the integrated framework aggregates the detection results of each service component. For the attack packet detection results reported by the gatekeeper security service component, it performs packet interception; otherwise, it allows the packet and resumes the suspended normal processing flow. Step 8: When a message is identified as a local message after being routed, at the local service plugin mounting point, the security service integration framework determines whether the destination address of the message request is the mounted security service component. If so, the message characteristic attributes and the original message cache address are passed to the target service component through the data distribution module. Step nine: The target service component performs the corresponding security processing and feeds back the processing result to the result aggregation module of the integration framework, and then sends it out through the data sending module of the integration framework.

[0031] like Figure 5 As shown, the specific steps for the full lifecycle management of security logs in the integrated network security protection system are as follows: Step 1: After detecting a security event, each security service component automatically records a security log and uploads it to the security audit module; Step 2: The security audit module collects security logs from each mounted security service component through the log collection submodule, calls the log processing submodule to clean the log data, remove redundancy, normalize the format, and classify and label the data, and calls the log storage submodule to save the logs to different log data tables according to different categories. Step 3: The security audit module performs statistical analysis and correlation analysis on log data through the log analysis submodule to uncover potential security threats and display the situation information in a graphical form for system administrators, security administrators and audit administrators to view. Step 4: When the log storage space or storage time reaches the threshold configured by the policy, report an alarm and, according to the emergency response policy, perform a new log overwrite or non-save operation.

[0032] The above description is only a preferred embodiment of the present invention. It should be noted that for those skilled in the art, several improvements and modifications can be made without departing from the technical principles of the present invention, and these improvements and modifications should also be considered within the scope of protection of the present invention.

Claims

1. An integrated network security protection system, characterized in that, include: Security service integration framework, security service component set, security management module, and security audit module; The system is based on a security service integration framework, on which various security service components are mounted. These components enable multi-layered and multi-dimensional security detection of network packets. The security management module configures security policies for each security service component in a unified manner. The security audit module aggregates logs reported by the security service integration framework, the security management module, and each security service component, including operation logs, management logs, and security logs. The aggregated logs are then processed, stored, and analyzed in a unified manner to enable event tracing and attribution. The security service integration framework includes a data plane layer, which is used to send and receive network packets. This data plane layer includes a data receiving module, a data caching module, a protocol parsing module, a data distribution module, a result aggregation module, and a data sending module. The data receiving module receives network packets from the Data Plane Development Kit (DPDK). The data caching module requests shared memory and caches network packets for access by various security service components. The protocol parsing module extracts the characteristic attributes of the received network packets. The data distribution module determines whether the target service of the network packet is a security service component mounted through this mount point. If so, the characteristic attributes and cache address of the network packet are passed to each security service component for security detection, and the detection results are sent to the result aggregation module; otherwise, the process ends. The result aggregation module collects the detection results from each security service component and determines whether to intercept the network packet. If interception is determined, the process ends; otherwise, the network packet is sent out through the data sending module.

2. The method as described in claim 1, characterized in that, The security service integration framework runs in the operating system's user space, decoupled from the operating system kernel, and does not depend on the operating system's kernel interface. Furthermore, the security service integration framework integrates a user-space network protocol stack, which, when combined with DPDK, directly receives network packets from the network card and performs network protocol parsing in user space. The security service integration framework also includes a basic framework layer and a network protocol layer. The basic framework layer is used to implement unified management and scheduling of security service components; the network protocol layer provides network packet routing and VLAN services.

3. The method as described in claim 1, characterized in that, The security service integration framework provides plugin registration, plugin mounting, plugin uninstallation, and plugin deregistration interfaces. The plugin registration interface allows registration simply by inputting the address of the security service registration object. The plugin mounting interface offers three types based on plugin type: input detection, transmission detection, and local service. These are located at different mounting points within the security service integration framework, aligned with packet transmission processing, and are, in order, input detection, transmission detection, and local service. At the input detection plugin mounting point at the network packet input, security service components are mounted via the input detection plugin mounting interface. When network packets flow through, the security service integration framework intercepts the network traffic and distributes the network packet's characteristics and cache address to each security service component at this mounting point via the data distribution module. The security service components then perform the first layer of security detection on the network packets, and the result aggregation module determines whether to allow the traffic based on the detection results. At the transmission detection plugin mounting point before the packet is routed, forwarded, or distributed to the local service for processing, the security service integration framework suspends the normal processing flow again. It distributes the network packet's characteristics and cache address to the security service component mounted at this mounting point, which then performs a second layer of security detection on the network packet. The result aggregation module summarizes the detection results from each security service component at this mounting point and determines whether to allow the packet to proceed. For network packets distributed to the local security service, at the local service plugin mounting point, the security service integration framework's data distribution module determines whether the target service of the network packet is a security service component mounted at this mounting point. If so, it distributes the network packet's characteristics and cache address to the corresponding security service component for security processing and feeds back the processing result to the result aggregation module; otherwise, the process ends.

4. The method as described in claim 3, characterized in that, The security service components in the security service component set are divided into three categories based on their security service processing results: gatekeeper, bypass, and invocation. Gatekeeper service components can intercept detected attack packets, including illegal access packets, malformed packets, and abnormal traffic packets, directly blocking their further transmission and recording security logs to be reported to the security audit module. These include network access control components, network traffic anomaly detection components, and application access control components. Bypass service components cannot intercept detected attack packets but can only record security logs to be reported to the security audit module and simultaneously report alarms to the security management module. These include network intrusion detection components and traffic behavior audit components. Invocation service components, as the final processing step for packets, can execute corresponding operations based on request instructions, feedback the operation results along the original path, and record log data to be reported to the security audit module. These include device access control components, malicious code detection components, and database audit components.

5. The method as described in claim 4, characterized in that, The different security service components in the security service component set are defined as different plugin types according to the different layers in which the security service plays its role in the OSI architecture, including input detection plugins, transmission detection plugins and local service plugins. The network traffic anomaly detection component is defined as an input detection plugin, which is first activated by the data distribution module of the security service integration framework after network traffic is received. The network access control component, application access control component, and network intrusion detection component are defined as transmission detection plugins, which are activated by the data distribution module of the security service integration framework before packet routing or local processing to perform security detection. The device access control component, malicious code detection component, and database audit component are defined as local service plugins, which are activated by the data distribution module of the security service integration framework when the packet is a local packet and the target service process is a mounted security service component, to process the network packet.

6. The method as described in claim 1, characterized in that, The security management module is also used to configure system parameters, upgrade the security of the system and attack signature database, query security service component information, query logs, and display the unified security status of the system. The security management module provides a unified human-computer interaction interface. The configuration wizard on the system configuration page allows for the configuration and querying of device system parameters. The wizard on the system maintenance page allows for security upgrades to the attack signature database, including both local offline upgrades and remote online upgrades. The wizard on the security policy configuration page allows for the configuration and querying of security policies for each security service component. The wizard on the audit management page allows for the configuration of log storage policies and the querying of log information. The situation monitoring page allows users to view the current security overview of the system and the system security situation reported by each security service component.

7. The method as described in claim 1, characterized in that, The security audit module includes a log collection submodule, a log processing submodule, a log analysis submodule, a log storage submodule, and a log query submodule. The log collection submodule collects various logs sent by the security service integration framework, various security service components, and the security management module. The log processing submodule performs cleaning, redundancy removal, and normalization on various log data. The log storage submodule stores the processed log data in the corresponding log database. The log analysis submodule analyzes the stored log data from different dimensions to uncover potential security threats, generate alarms, and report them to the security management module, providing support for security policy optimization. The log query submodule allows users to query the stored log data from different dimensions and display it on the audit management page of the security management module.

8. The method as described in claim 5, characterized in that, To achieve pipelined processing, with packet transmission processing as the central axis, security service components are activated at different plugin mounting points within the security service integration framework to perform security checks. When a packet passes through an input detection plugin mounting point, the security service integration framework suspends the subsequent normal flow of the network packet. The data distribution module within the security service integration framework then transmits the network packet's characteristic attributes and cache address to the network traffic anomaly detection service component for detecting abnormal traffic, malformed packets, and flood attack packets. Security events detected are logged and reported to the security audit module, while the detection results are simultaneously fed back to... If the detection result determines that the network packet is an attack packet, the result aggregation module will perform an interception operation to block the network packet from posing a security threat to the internal network. Otherwise, the network packet will be allowed to pass. When the network packet passes through the mounting point of the transmission detection plugin, it will be suspended again by the security service integration framework. The data distribution module will distribute the packet to the network access control, application access control, and network intrusion detection service components to perform access permission determination, unauthorized access behavior detection, and attack packet detection operations. The detected security events will be recorded in the security log and reported to the security audit module. At the same time, the detection results will be summarized in the result aggregation module. The result aggregation module decides whether to block the packet based on the type of security service component and the detection result. If any gatekeeper service component detects an attack packet, the result aggregation module immediately performs an interception operation, blocking the transmission of the network packet. If only the bypass service component detects an attack packet, it alerts the security management module, records the security log, and allows the network packet to continue transmitting. When the network packet is a local packet and the target process is a mounted local service plugin, the security service integration framework directly sends the network packet to the corresponding security service component through the data distribution module and receives the corresponding processing result.

9. A method of operating the system as described in any one of claims 1 to 8, characterized in that, The system's security policy configuration process is as follows: Step 1: Log in to the security management module, enter the security policy configuration page, select the pre-configured security service component from the list of mounted security service components, and configure the corresponding security policy according to the configuration wizard. Step two: Based on the user's selection and input configuration information, the security management module constructs a policy configuration request and sends it to the security service integration framework; Step 3: The security service integration framework receives the policy configuration request, parses and identifies the request type and target service object, and forwards the policy configuration request to the corresponding security service component. Step four: The security service component receives the policy configuration request, parses and extracts the configuration information, updates the configuration attribute values, and constructs a policy configuration result response packet, which is then fed back to the security management module along the original path.

10. The method as described in claim 9, characterized in that, The network packet security detection process executed by the system is as follows: Step 1: The data receiving module in the security service integration framework receives network packets from DPDK, caches the network packets through the data caching module, and then the protocol parsing module performs parsing and feature attribute extraction operations on the network packets. Step 2: At the input detection plugin mounting point of the security service integration framework, the security service integration framework suspends the normal processing flow and passes the characteristic attributes and cache address of the network packet to the network traffic anomaly detection service component through the data distribution module. Step 3: The network traffic anomaly detection service component performs malformed packet detection and abnormal traffic detection based on the input feature attributes to detect whether there are any anomalies, and feeds back the detection results to the result aggregation module. At the same time, it records security logs for detected anomalies and reports them to the security audit module. Step 4: The result aggregation module of the security service integration framework performs network packet interception or allowance operations based on the results fed back by the network traffic anomaly detection service component. For allowed network traffic, the result aggregation module resumes the suspended processing flow. Step 5: At the mounting point of the transmission detection plugin in the security service integration framework, the normal processing flow of the packet is remounted. The network packet's characteristic attributes and cache address are simultaneously distributed to the network layer access control service component, the application layer access control service component, and the network intrusion detection service component through the data distribution module. Step 6: The network layer access control service component, application layer access control service component, and network intrusion detection service component concurrently execute the corresponding security detection operations and feed back the detection results to the result aggregation module. At the same time, the attack events detected by the network layer access control service component, application layer access control service component, and network intrusion detection service component are recorded in security logs and reported to the security audit module. Step 7: The result aggregation module of the integrated framework aggregates the detection results of the network layer access control service component, the application layer access control service component, and the network intrusion detection service component. For the attack packet detection results reported by the gatekeeper security service component, it performs packet interception; otherwise, it allows network packets to pass and resumes the suspended normal processing flow. Step 8: When a network packet is identified as a local packet after being routed, at the local service plugin mounting point, the security service integration framework determines whether the destination address of the packet request is the mounted security service component. If so, the feature attributes and cache address are passed to the corresponding security service component through the data distribution module. Step nine: The corresponding security service components perform the corresponding security processing and feed back the processing results to the result aggregation module, which then sends them out through the data sending module.

Images