Situation monitoring system based on commercial secret link and deployment method thereof

Abstract

The application discloses a situation monitoring system based on a commercial secret link and a deployment method thereof, and relates to the technical field of network security. The application discloses a situation monitoring system based on a commercial secret link and a deployment method thereof, and relates to the technical field of network security. The application discloses a situation monitoring system based on a commercial secret link and a deployment method thereof, and relates to the technical field of network security. The application discloses a situation monitoring system based on a commercial secret link and a deployment method thereof, and relates to the technical field of network security. The application discloses a situation monitoring system based on a commercial secret link and a deployment method thereof, and relates to the technical field of network security. The application discloses a situation monitoring system based on a commercial secret link and a deployment method thereof, and relates to the technical field of network security. The application discloses a situation monitoring system based on a commercial secret link and a deployment method thereof, and relates to the technical field of network security. The application discloses a situation monitoring system based on a commercial secret link and a deployment method thereof, and relates to the technical field of network security. The application discloses a situation monitoring system based on a commercial secret link and a deployment method thereof, and relates to the technical field of network security. The application discloses a situation monitoring system based on a commercial secret link and a deployment method thereof, and relates to the technical field of network security. The application discloses a situation monitoring system based on a commercial secret link and a

Description

Technical Field

[0001] This invention relates to the fields of business intelligence visualization applications, network security and information technology applications, and specifically to a situational monitoring system based on a commercial encrypted link and its deployment method. Background Technology

[0002] With the deepening of the national cybersecurity and informatization strategy, the widespread application of commercial cryptography technology in critical national information infrastructure and important business systems has made commercial cryptographic networks a crucial foundational environment for carrying data and core business operations. Ensuring the secure, stable, and reliable operation of commercial cryptographic networks and monitoring their security posture in real time has become a critical task. Currently, the technical approaches or existing solutions commonly used for security monitoring and situational awareness in commercial cryptographic network environments mainly include:

[0003] (1) Traditional network design situational awareness systems are deployed in commercial encrypted networks after certain configuration and modification. These systems usually have basic traffic analysis, log collection and high-precision threat detection functions.

[0004] (2) Deploy independent performance monitoring, log auditing, or traffic probes in different areas of the commercial cryptographic network or for specific types of commercial cryptographic devices (such as VPN gateways, cryptographic machines, etc.). These tools operate independently and lack a unified operation and maintenance environment and the integration of various alarm information data.

[0005] (3) For the sake of security and controllability, some newly built systems have begun to use domestically produced servers, operating systems or databases as single components, but the overall solution has not yet formed a completely domestic technology chain in terms of core analysis engine, software architecture and data protocol.

[0006] However, in the specific and highly secure scenario of commercial encrypted networks, the aforementioned existing technical solutions have the following limitations:

[0007] (1) Lack of unified standards for construction and operation and maintenance leads to "data silos" and "management chimneys". Due to the lack of unified construction and operation and maintenance standards, monitoring systems and tools from different periods, vendors, and technical routes are deployed mixed together in the commercial security network. This results in inconsistent data formats, incompatible interfaces, and scattered management interfaces, making it impossible to form a unified monitoring view across the entire network. Security data cannot be effectively aggregated and correlated for analysis, forming "data silos" that are difficult to support global situation assessment and business decision-making.

[0008] (2) The system functions are fragmented, making it difficult to support the "penetrating management" requirement. Existing solutions often focus on a single function point, with insufficient linkage between various functions. They lack the ability to deeply correlate link status, traffic analysis, threat intelligence, attack events, and the operation and usage of business application systems, and to reconstruct the attack chain. This makes it impossible for administrators to achieve "penetrating" analysis and management from network surface phenomena to deep security roots.

[0009] (3) Insufficient visualization capabilities and unintuitive situation presentation. Visualization often remains at the level of simple chart listings or static topology, lacking dynamic, interactive, and multi-level situation rendering based on the business logic and physical logic architecture of commercial cryptographic networks. It is impossible to intuitively show the correlation between security threats and specific businesses, key assets, and important links, which affects decision-making efficiency and emergency response speed.

[0010] Therefore, there is an urgent need for a new generation of commercial encrypted link access status monitoring system that can deeply integrate domestic technologies, strictly follow unified standards and specifications, and effectively support comprehensive, multi-level, intelligent monitoring and penetrating management of commercial encrypted networks. Summary of the Invention

[0011] This invention provides a situational monitoring system and its deployment method based on commercial encrypted links to solve the problems mentioned in the background section above.

[0012] To solve the above-mentioned technical problems, the present invention adopts the following technical solution:

[0013] A situational monitoring system based on a commercial encrypted link, the system comprising:

[0014] The commercial cryptography platform comprises, from bottom to top, an infrastructure resource layer, a cloud computing service layer, a big data environment layer, and an application system layer. The infrastructure resource layer includes a high-speed, dual-redundant core backbone network with a three-network separation architecture, a diverse heterogeneous computing and storage environment, a cryptographic resource pooling management module, and a trusted base implementation module. The cryptographic resource pooling management module virtualizes multiple physical cryptographic machines into a unified cryptographic service resource pool. The trusted base implementation module injects trust policies during the server operating system installation phase. The cloud computing service layer uses software-defined technology to uniformly manage, dynamically allocate, and securely isolate all-stack hardware resources. This layer includes computing services, storage services, network services, platform operation and maintenance, and security service configuration. The security service configuration interfaces with the cryptographic resource pooling management module. The big data environment layer includes a master data management system and a big data management system. The big data management system includes three subsystems: data acquisition, data governance, and data application. The application system layer includes general application systems and business application systems.

[0015] The unified situation monitoring visualization system is coupled with the commercial cryptography platform through standardized data interfaces and secure channels. It includes: a business intelligence visualization tool deployed in the security management area; a multi-dimensional data model construction module; a penetrating visualization dashboard, including a global situation overview view, a business chain security perspective view that supports full-link drill-down display, an attack chain analysis and tracking view linked with the underlying attack chain reconstruction engine, and a compliance and operational efficiency view; an intelligent analysis drill-down and early warning module; and a unified standard and linkage mechanism module.

[0016] Based on this, the present invention can be further improved as follows:

[0017] Furthermore, the infrastructure resource layer includes a communication network environment and a computing and storage environment; the communication network environment includes a core layer network and an access layer network, the core layer network deploys dual 10 Gigabit stacked egress switches and dual-machine hot standby encryption machines, and the access layer communicates with the core layer through an IPSec VPN tunnel; the computing and storage environment adopts an ARM+C86+X86 hybrid architecture, including centralized storage and distributed storage.

[0018] Furthermore, the cloud computing service layer interfaces with the API of the cryptographic resource pooling management module through a plugin installed in the cloud platform to create a virtual cryptographic machine image; defines installation group policies through the SDN controller; and creates a standardized cloud host image that integrates a cloud workload protection agent.

[0019] Furthermore, the big data environment layer also includes a secure data lake construction module and an analysis engine deployment module. The secure data lake construction module collects decrypted traffic metadata through a bypass-deployed commercial cryptographic traffic probe and collects application audit logs through a log collector. The analysis engine deployment module includes a rule association analysis engine, a machine learning analysis platform, and an attack chain reconstruction engine.

[0020] Furthermore, the attack chain analysis and tracking view transforms the tactical and technical framework into a visual and interactive attack storyline, allowing users to click on any attack stage to view the corresponding original alerts, affected assets, and forensic data.

[0021] Furthermore, the unified situation monitoring visualization system is logically isolated from the production business area network, and the front-end application, back-end service and cache database are deployed separately. The business intelligence visualization tool is security-hardened and compatible with the underlying domestic big data environment layer's JDBC / ODBC.

[0022] The present invention also provides a method for constructing the above-described system, comprising:

[0023] The environmental preparation steps include planning an independent security partition within the existing commercial encrypted network, allocating a dedicated commercial encrypted network address range to the security management area, and ensuring logical isolation between management traffic and business traffic.

[0024] The infrastructure deployment steps include deploying domestic server clusters, configuring commercial cryptographic network equipment, deploying cryptographic machines and implementing cryptographic resource pooling, and injecting trust policies during the server operating system installation phase to implement a trusted base.

[0025] Cloud service deployment steps: Install cloud computing software and configure security services that interface with the password resource pool API;

[0026] Big data deployment steps include: building a big data platform, constructing a secure data lake, and deploying an analytics engine.

[0027] Business deployment steps: migrate business applications to the cloud and configure a unified security gateway;

[0028] Visualize the deployment steps, deploy business intelligence visualization tools in the security management area, and build data models and dashboards;

[0029] The joint debugging and inspection process involves conducting full-chain joint debugging and checking the implementation of standards.

[0030] Furthermore, the infrastructure deployment steps include: deploying a domestically produced server cluster consisting of compute nodes, storage nodes, and management nodes; configuring VLANs and ACLs to ensure controlled communication within the partitions; deploying cryptographic resource pool management software to virtualize physical cryptographic machines into a unified resource pool; and injecting a trust policy during the operating system installation phase to ensure that only the kernel and driver are authenticated and loaded.

[0031] Furthermore, the construction of the secure data lake in the big data deployment steps includes: deploying commercially encrypted traffic probes in the bypass mode of the core switch to collect traffic metadata; configuring targeted log sending on individual devices; deploying lightweight log collectors on business servers to collect audit logs; and deploying the analysis engine, which includes a rule-based correlation analysis engine, a machine learning analysis platform that imports anomaly detection models, and an attack chain reconstruction engine that loads technical and tactical knowledge graphs.

[0032] Furthermore, the joint debugging and inspection steps include: verifying the complete process from business application access, cryptographic operations, log generation, collection and analysis to visualization; checking whether the device configuration meets the security baseline, whether the log format is standardized, and whether the operation and maintenance are performed through the cloud platform or bastion host.

[0033] The present invention provides a situational monitoring system and its deployment method based on commercial encrypted links, which has the following beneficial effects:

[0034] The situation monitoring system and deployment method based on commercial encrypted links of this invention can solve the technical problems of data silos, functional fragmentation, and insufficient visualization capabilities in existing commercial encrypted network monitoring, achieving "visible" security data, "clear" threat identification, "threat insight," and "supported" decision-making. Specifically, the reasons for the poor monitoring effect of related commercial encrypted networks are: the lack of unified construction and maintenance standards in existing solutions leads to data manipulation; fragmented system functions make it difficult to support penetrating management; and insufficient visualization capabilities result in an unintuitive situation presentation. Based on this, the situation monitoring system based on commercial encrypted links of this invention firstly achieves a unified domestic technology roadmap by constructing a commercial encrypted platform including an infrastructure resource layer, a cloud computing service layer, a big data environment layer, and an application system layer. Then, by deploying a unified situation detection and visualization system, it achieves end-to-end monitoring from bottom-level data collection to top-level penetrating situation presentation. This forms a unified monitoring view across the entire network, supporting penetrating analysis and management, and realizing dynamic, interactive, and multi-level situation rendering, thereby significantly improving the overall security control and operational efficiency of commercial encrypted networks.

[0035] Advantages of additional aspects of the invention will be set forth in part in the description which follows, and in part will be obvious from the description, or may be learned by practice of the invention. Attached Figure Description

[0036] Figure 1 A schematic diagram of the overall system architecture of the situation monitoring system based on commercial encrypted links provided in an embodiment of the present invention;

[0037] Figure 2 A schematic diagram of the infrastructure resource layer architecture in a situational monitoring system based on commercial encrypted links provided in an embodiment of the present invention;

[0038] Figure 3 A schematic diagram of the cloud computing service layer architecture in a situation monitoring system based on commercial encrypted links provided in an embodiment of the present invention;

[0039] Figure 4 A schematic diagram of the big data environment layer architecture in a situational monitoring system based on commercial encrypted links provided in an embodiment of the present invention; Detailed Implementation

[0040] The technical solutions of the embodiments of the present invention will be clearly and completely described below with reference to the accompanying drawings. Obviously, the described embodiments are only some embodiments of the present invention, and not all embodiments. Based on the embodiments of the present invention, all other embodiments obtained by those skilled in the art without creative effort are within the protection scope of the present invention.

[0041] This invention provides an application scenario for a situational monitoring system based on a high-density network link. First, the computing device can receive commercial-density network environment planning information input by the administrator. Then, based on this environment planning information, the computing device can deploy a domestically developed infrastructure resource layer, a cloud computing service layer, a big data environment layer, and an application system layer to build a commercial-density platform. Finally, the computing device can deploy business intelligence visualization tools in the security management area to build a unified situational monitoring visualization system, achieving end-to-end monitoring from bottom-level data acquisition to top-level penetrating situational presentation.

[0042] It should be noted that the aforementioned computing devices can be either hardware or software. When the computing device is hardware, it can be implemented as a distributed cluster consisting of multiple servers or terminal devices, or as a single server or terminal device. When the computing device is software, it can be installed within the hardware devices listed above. It can be implemented as, for example, multiple software programs or software modules used to provide distributed services, or as a single software program or software module. No specific limitations are made here; it should be understood that the number of computing devices can be arbitrary, depending on the implementation requirements.

[0043] Figure 1 This is a schematic diagram of the overall system architecture of the situation monitoring system based on commercial encrypted links according to the present invention.

[0044] exist Figure 1 The system architecture shown consists of two parts: a commercial cryptography platform and a unified situation monitoring and visualization system. These two parts are tightly coupled through standardized data interfaces and secure channels. The commercial cryptography platform serves as the foundation for business operations, comprising, from bottom to top, an infrastructure resource layer, a cloud computing service layer, a big data environment layer, and an application system layer. The unified situation monitoring and visualization system is an independent application layer built upon business intelligence visualization tools. It acquires all data from the underlying platform and provides monitoring, analysis, and visualization capabilities.

[0045] Figure 2 This is a schematic diagram of the infrastructure resource layer architecture in the situation monitoring system based on commercial encrypted links according to the present invention.

[0046] The infrastructure resource layer mainly includes: communication network environment, computing and storage environment, cryptographic resource pooling management module, and trusted base implementation module.

[0047] The communication network environment mainly includes the core layer network and the access layer network.

[0048] The core backbone network deploys dual 10 Gigabit stacked egress switches connected to a dedicated internet egress line with a bandwidth of 1000 Mbps. These switches are connected to the core switch of the encryption platform via dual-machine hot standby core layer encryption machines and egress firewalls. The core switch employs a dual-link stacked deployment to provide high-speed network switching services. Internally, the core layer's business application area, security management area, and maintenance terminal area are all interconnected using 10 Gigabit switches. Each area gateway is located on the core switch, forming a highly available core network support system capable of efficient operation of the entire network.

[0049] Each access node is connected to the core layer in a flat star topology. Gigabit access switches, access layer encryption machines, and firewalls are deployed as needed. The firewall is configured with the unit's gateway address, and an IPSec VPN tunnel is established between the access layer encryption machine and the core layer encryption machine to achieve network interconnection.

[0050] The entire commercial encryption platform network uses IPv4 addresses.

[0051] The computing and storage environment is deployed according to actual needs, using ARM+C86+X86 hybrid architecture computing servers to support the construction of cloud computing platforms and big data platforms, and to provide the operation and data storage of various application systems on the provider cryptographic platform.

[0052] The core layer deploys a centralized + distributed storage environment with block storage, file storage, and object storage capabilities. Centralized storage is mainly used for core business system databases and structured data storage; distributed storage mainly includes video data, office document data, and massive amounts of unstructured data generated by various business systems of cloud platforms and big data platforms.

[0053] Simultaneously, it possesses snapshot backup and recovery management capabilities for the entire cloud server and cloud disk, constructing a snapshot backup protection mechanism to ensure the integrity, continuity, and recoverability of business data. While ensuring the availability of backup data, it effectively reduces the risk of data loss and improves the business's recovery capabilities and data security level in emergencies such as system failures, accidental data deletion, and attack events.

[0054] The cryptographic resource pooling management module deploys cryptographic resource pool management software on the management node. This software virtualizes two physical cryptographic machines into a unified cryptographic service resource pool, providing standard API interfaces to the outside world. It also configures load balancing and high availability strategies for the resource pool.

[0055] Trusted Base Implementation Module. During the server operating system installation phase, a trust measurement policy is injected to ensure that only certified operating system kernels and critical drivers can be loaded.

[0056] Figure 3 This is a schematic diagram of the cloud computing service layer architecture in the situation monitoring system based on commercial encrypted links according to the present invention.

[0057] exist Figure 3 In the cloud computing service layer architecture, the cloud computing service layer includes computing services, storage services, network services, platform operation and maintenance, and security service configuration. Through software-defined computing, storage, and networking technologies, the cloud computing service layer deploys cloud computing software, uniformly drives full-stack hardware resources, and achieves unified management, dynamic allocation, secure isolation, and efficient operation and maintenance of basic resources. It can expand cloud desktop usage modes and provide effective support for application systems. The business network, storage network, and management network all have access capabilities for mainstream network devices with speeds of 10G, 25G, 100G, and 200G or higher, ensuring the network performance requirements for large-scale mirror transmission and business deployment. It has the capability for concurrent and rapid deployment of multiple business systems, improving resource utilization efficiency and service delivery levels.

[0058] The computing service provides unified scheduling and management of computing resources such as cloud hosts and containers, forming resource pools based on servers or business types to achieve pooling and elastic provisioning of computing resources. It constructs a hybrid computing infrastructure environment that combines virtualization scheduling capabilities with physical resource passthrough capabilities, enabling core functions such as full lifecycle management of cloud hosts, container management, image management, bare metal management, resource orchestration, multi-core cloud architecture, and tenant management.

[0059] Traditional architectures deploy stable business applications using cloud servers. These applications utilize unified platform-provided operating system images (such as Kylin and Linux), domestic database and middleware installation images, and orchestratable resource templates. Combined with centralized baseline configuration and compliance management, including password complexity policies, NTP time synchronization, and system firewall policy control, standardized resource delivery and rapid application deployment are achieved. New architectures deploy agile business applications using underlying cloud infrastructure resources as container services. Policies regarding Master and Node specifications and quantities are set to provide an isolated, lightweight, and scalable containerized runtime environment. This enables full lifecycle management of containerized applications, rapid delivery, and elastic scaling, reducing operational complexity and improving resource utilization efficiency.

[0060] The storage service primarily manages and utilizes block, file, and object storage, dividing storage volumes according to application system requirements to achieve storage resource pooling and elastic provisioning. It builds storage management capabilities based on IP and FC protocols, enabling unified management of centralized and distributed storage resources throughout their entire lifecycle.

[0061] By connecting centralized and distributed storage to the cloud platform control node, a unified cloud platform portal is provided to support the formation of underlying data storage security, stability and scalability. Different types of cloud disks can be created according to business needs and automatically mounted to designated cloud hosts or bare metal hosts through policies. At the same time, it has backup policy configuration and data recovery capabilities, and can roll back the failed system or rebuild the data disk with one click, thereby improving business continuity and platform data security level, and reducing the risk of data loss and operation and maintenance complexity.

[0062] Network services support cloud computing platforms with software-defined networking (SDN) technology to achieve network resource utilization and elastic provisioning. By constructing a unified orchestration and hierarchical isolation SDN network architecture, network resource scheduling is achieved for multi-tenant cloud environments.

[0063] By deploying SDN controller management nodes, it has the ability to flexibly define and orchestrate logical network topologies between tenants and business systems, realize automatic isolation and secure interconnection of network resources between different tenants, services and projects, ensure rapid interconnection and flexible access of business systems, and meet network service requirements such as multi-tenant concurrency, dynamic topology, secure access and high availability of services.

[0064] The platform operation and maintenance system possesses the capabilities to collect resource status in real time, perceive platform operation status, and manage indicator strategies from aspects such as cloud platform engine, cloud product services, and user load, enabling real-time monitoring of operation status, rapid fault location, and efficient operation and maintenance collaboration.

[0065] By building an integrated cloud platform operation and maintenance environment, various alarm information is collected and uniformly aggregated into the monitoring database, realizing alarm monitoring, log collection and processing, and a visual display panel. It has one-stop indicator monitoring capabilities for the entire platform, supporting operation and maintenance personnel to instantly discover, notify, locate, and handle faults and anomalies in platform operation in a closed loop, realizing real-time monitoring of resource usage, and improving the efficiency of fault alarm handling.

[0066] The security service configuration installs a plugin in the cloud platform. This plugin interfaces with the API of the cryptographic resource pooling management module deployed in the infrastructure resource layer to create a "virtual cryptographic machine" image. When a cloud host is created, it can choose to bind a virtual cryptographic machine.

[0067] Define security group policies that match the business organizational structure through the SDN controller of the cloud platform.

[0068] Create a standardized cloud host image that integrates a cloud workload protection agent. This agent must be pre-configured with the data reporting address and authentication key of the situation awareness center.

[0069] Figure 4 This is a schematic diagram of the big data environment layer architecture in the situation monitoring system based on commercial encrypted links according to the present invention.

[0070] exist Figure 4 The big data environment layer architecture shown includes a master data management system, a big data management system, a secure data lake construction module, and an analysis engine deployment module.

[0071] By building a master data management system, we can achieve unified standards, data cleansing, sharing and distribution, and quality control capabilities. This will solve problems such as fragmentation and inconsistency of key business data, enable authoritative distribution and full lifecycle management of master data for various application systems, ensure data security and compliance, support various application systems to quickly connect to existing systems, and simplify business processes and compliance management.

[0072] The big data management system consists of three subsystems: data collection, data governance, and data application. Based on the data flow collected from various business application systems, it conducts data classification and hierarchical classification, determines data usage permissions, performs data governance according to data standards, generates a data asset catalog, and finally designs data models based on business needs and automatically generates business indicators to achieve data sharing and application.

[0073] The data acquisition subsystem is capable of automatically extracting data from the database tables of various business subsystems according to different scenarios and functional requirements, and storing the collected data in the original database of the big data system. The data governance subsystem obtains source data from the original database, builds business relationships between the data, reconstructs new database table structures according to business classifications, and stores the data in the governance database of the big data system. The data application subsystem, based on the original database and the governance database, performs model calculations and statistical analysis according to the business data application and control indicator display requirements, stores the data in the product database of the big data system, forms big data application service capabilities, and meets the higher quality data requirements of business systems.

[0074] The secure data lake construction module deploys commercial cryptographic traffic probes in bypass mode on the core network switches, configuring them to send decrypted traffic metadata and suspicious payloads to the data access platform. Configurations are made on cryptographic machines, network devices, and the cloud platform to direct logs to the data access platform. A lightweight log collector is deployed on the business servers to collect application audit logs.

[0075] The analysis engine deployment module deploys a rule-based association analysis engine and writes initial association rules. Simultaneously, it deploys a machine learning analysis platform, imports an anomaly detection model trained on historical data, deploys an attack chain reconstruction engine, and loads predefined technical and tactical knowledge graph templates.

[0076] The unified situation detection visualization system in the situation monitoring system based on commercial encrypted links according to the present invention is deployed as follows.

[0077] The unified situational awareness visualization system is deployed in the secure management zone of the commercial encrypted network, with dedicated server resources or a dedicated cloud host cluster planned to host the business intelligence visualization tools. This zone is logically isolated from the production business zone, allowing communication only through necessary, strictly controlled data service ports. Domestically developed business intelligence visualization software is deployed in this zone. Front-end applications, back-end services, and cache databases can be deployed separately to improve system performance and reliability.

[0078] We selected domestically developed visualization tools that support domestic operating systems and databases, deployed business intelligence tools as independent applications in a secure, isolated area, and extracted data from the secure data lake of the underlying big data environment layer through data service interfaces subject to strict access control and security auditing.

[0079] Security hardening of business intelligence visualization tools includes: disabling unnecessary default services and ports; changing default administrator accounts and passwords; and enabling dual access control based on roles and IP addresses. Ensure the business intelligence visualization tools are fully compatible with the underlying domestically developed big data environment's JDBC / ODBC drivers, and conduct connectivity tests.

[0080] In business intelligence visualization tools, the multi-dimensional data model building module constructs subject-oriented multi-dimensional data models based on actual situational monitoring needs. These models include, but are not limited to, information on asset security, vulnerability data, alarm events, attack chain information, threat intelligence, related business access logs, user behavior analysis, related link status, traffic analysis, cryptographic device performance and alarms, etc.

[0081] The transparent visualization dashboard leverages the powerful interactive dashboard features of business intelligence visualization tools, and the following core views are designed, with the specific views depending on actual needs:

[0082] Overall Situation Overview: Dynamically displays core indicators such as network-wide security score, real-time threat map, distribution of key attack types, and health status of critical business operations through a command dashboard.

[0083] Business Chain Security Perspective: Select any key business and drill down to view the real-time security status and historical events of each node in the complete chain from the front-end application to the back-end database, the cloud environment in which it runs, the network paths it depends on, and the cryptographic services it calls.

[0084] Attack Chain Analysis and Tracking View: In conjunction with the underlying attack chain reconstruction engine, it transforms the tactical and technical framework into a visual and interactive attack storyline. Users can click on any attack stage to view the corresponding original alerts, affected assets, and forensic data.

[0085] Compliance and Operational Performance View: Monitor operational metrics such as coverage of unified security policies, average response time of security incidents, and vulnerability remediation rate through dashboards to support management decisions.

[0086] The intelligent analysis drill-down and early warning module allows system administrators or authorized users to conduct drag-and-drop self-service data exploration through business intelligence visualization tools. By connecting to the database to create data sources, using database languages ​​to design corresponding indicator models, and creating visualization reports, designing parameter transmission rules and chart linkage mechanisms based on sufficient data preparation, the module ultimately achieves intelligent analysis drill-down and early warning.

[0087] The unified standards and linkage mechanism module strictly defines the data exchange format, interface, and secure transmission protocol between the big data environment layer and the unified situation monitoring visualization system to ensure the stability and security of data supply. Furthermore, it establishes unified dashboard design specifications, component style standards, and color semantic specifications to ensure consistent visual presentation.

[0088] The deployment method for a situational monitoring system based on the above commercial links includes the following steps:

[0089] S1, Environment Preparation. In some embodiments, the entity implementing the situational awareness monitoring system deployment method based on commercial encrypted links can plan independent security partitions (e.g., a "production business area" and a "security management area") within an existing commercial encrypted network. A dedicated commercial encrypted network address range is allocated to the "security management area" to ensure logical isolation between management traffic and business traffic. The data center environment must meet the power supply, heat dissipation, and rack space requirements of domestically produced equipment.

[0090] S2, Deployment of Domestic Infrastructure Resources. In some embodiments, the aforementioned execution entity can deploy a domestic server cluster, divided into compute nodes, storage nodes, and management nodes. Compute nodes are used to support cloud platform virtualization and big data components; storage nodes are configured with a domestic distributed storage system to provide block, file, and object storage services.

[0091] Deploy commercial-grade cryptographic switches / routers, configure VLANs and ACLs to ensure controlled communication between the "production business area" and the "security management area".

[0092] Deploy two or more domestically produced high-performance server cryptographic machines and connect them to an independent management network.

[0093] Deploy cryptographic resource pool management software on the management node. This software virtualizes two physical cryptographic machines into a unified cryptographic service resource pool, providing standard API interfaces to the outside world. Configure load balancing and high availability policies for the resource pool.

[0094] During the server operating system installation phase, a trusted measurement policy is injected to ensure that only certified operating system kernels and critical drivers can be loaded.

[0095] S3, Cloud Computing Service Layer Deployment and Configuration. In some embodiments, the aforementioned execution entity can install cloud computing software on the management node. Compute and storage nodes are managed, creating initial compute resource pools, storage resource pools, and virtual network resource pools.

[0096] Install a plugin in the cloud platform. This plugin interfaces with the password resource pool API deployed in the second step to create a "virtual cryptographic machine" image. When creating a cloud host, you can choose to bind a virtual cryptographic machine.

[0097] Define security group policies that match the domain business organizational structure through the SDN controller on the cloud platform.

[0098] Create a standardized cloud host image that integrates a cloud workload protection agent. This agent must be pre-configured with the data reporting address and authentication key of the situation awareness center.

[0099] S4, Big Data Environment and Intelligent Analysis Layer Deployment. In some embodiments, the aforementioned execution entity can create multiple cloud hosts on the cloud computing service layer to deploy clusters of domestically produced distributed databases (for structured data), graph databases (for attack chain association), and time-series databases (for indicator data).

[0100] Deploy commercial cryptographic traffic probes in bypass mode on the core network switch, configuring them to send decrypted traffic metadata and suspicious payloads to the data access platform. Configure cryptographic machines, network devices, and cloud platforms to direct logs to the data access platform. Deploy lightweight log collectors on business servers to collect application audit logs.

[0101] Deploy the rule-based association analysis engine and write the initial association rules. Simultaneously, deploy the machine learning analysis platform, import the anomaly detection model trained on historical data, deploy the attack chain reconstruction engine, and load the predefined technical and tactical knowledge graph template.

[0102] S5, Secure Deployment of Business Application Systems. In some embodiments, the aforementioned implementing entity can containerize existing systems or directly use cloud host images, deploying them in the "production business area" through a cloud platform. Dedicated security groups, load balancers, and cloud database services are created.

[0103] Configure national cryptographic SSL certificates and enable national cryptographic algorithm suites; implement WAF policies to defend against common web attacks such as SQL injection and cross-site scripting; and implement access control policies to allow access only from IP addresses originating from specific government extranet regions.

[0104] S6, Deployment of the Unified Situation Monitoring Visualization System. In some embodiments, the aforementioned implementing entity can deploy a domestically developed business intelligence visualization tool on a dedicated cloud host in the "Security Management Zone". Configure the data source in this tool, connecting to the various databases in the secure data lake constructed in step four. Create scheduled data extraction tasks or real-time data stream subscriptions.

[0105] In business intelligence visualization tools, multi-dimensional analysis models are established based on different themes. Core visualization dashboards are developed, including a comprehensive "Network Security Situation" dashboard: displaying attack flows in real time, while showing various specific indicators in large numerical form; real-time display of attack event lists; usage status of business applications; recent alert trends, etc.

[0106] S7, System Integration and Standard Execution. In some embodiments, the aforementioned execution entity can verify the complete process from business application access, to cryptographic operations, to log generation, collection, analysis, and finally real-time display on a unified situation monitoring visualization dashboard.

[0107] Check whether the configuration of all devices meets the security baseline, whether the log format of all components is standardized, and whether the operation and maintenance are carried out through the cloud platform or bastion host to ensure that the "unified construction, operation and maintenance standards" are implemented.

[0108] The application system layer includes general application systems and business application systems. General application systems have characteristics such as high concurrency, global availability, elastic business resources, and unified operation and maintenance, and need to be deployed in a centralized cluster. Business application systems have characteristics such as agile iteration, business resource isolation, and self-operation and maintenance by business management departments, and need to be deployed independently according to different business lines.

[0109] General application systems, based on their characteristics, can be deployed in a centralized cluster, combined with SDN to achieve fine-grained traffic control, and have the ability to automatically and elastically scale system resources, enabling unified operation and maintenance and resource release during idle periods, effectively improving resource utilization.

[0110] The business application system can deploy financial systems, human resources systems, and various regulatory systems by building a dedicated cloud resource pool on the commercial encryption platform. The core layer uses VPC (Virtual Private Cloud) network isolation technology to ensure the independent operation of the business application system. On the system side, container services and image repositories are used to support flexible configuration of business processes.

[0111] This invention provides an integrated system technology solution based on commercial encrypted links, converged infrastructure, and business intelligence visualization applications. This solution aims to build a domestically produced, standardized, visible, and controllable commercial encrypted network operation and security foundation. The core lies in the systematic construction of domestically produced infrastructure, cloud computing, and big data environments to support business applications, while deeply integrating business intelligence visualization concepts and tools to construct a multi-dimensional, interactive, and decision-supporting situational monitoring visualization system, achieving penetrating presentation and management from underlying data to top-level insights.

[0112] Optionally, some possible implementations may include all or part of the above-described implementations.

[0113] It should be understood that in the description of this specification, references to terms such as "one embodiment," "some embodiments," "example," "specific example," or "some examples" refer to specific features, structures, materials, or characteristics described in connection with that embodiment or example, which are included in at least one embodiment or example of the present invention. In this description, the illustrative expressions of the above terms do not necessarily refer to the same embodiment or example. Furthermore, the specific features, structures, materials, or characteristics described may be combined in any suitable manner in one or more embodiments or examples. Moreover, without contradiction, those skilled in the art can combine and integrate different embodiments or examples described in this specification, as well as some features of different embodiments or examples.

[0114] Of course, those skilled in the art can make various corresponding changes and modifications based on the present invention without departing from its spirit and essence, but such changes and modifications should all fall within the protection scope of the claims of the present invention.

Claims

1. A situational monitoring system based on a commercial encrypted link, characterized in that, include: The commercial cryptography platform, from bottom to top, includes an infrastructure resource layer, a cloud computing service layer, a big data environment layer, and an application system layer; The infrastructure resource layer includes a high-speed dual-redundant core layer backbone network with a three-network separation architecture, a multi-dimensional heterogeneous computing and storage environment, a cryptographic resource pooling management module, and a trusted base implementation module; the cryptographic resource pooling management module virtualizes multiple physical cryptographic machines into a unified cryptographic service resource pool; The trusted foundation implementation module injects a trust policy during the server operating system installation phase; the cloud computing service layer uses software-defined technology to uniformly manage, dynamically allocate, and securely isolate all-stack hardware resources, and includes computing services, storage services, network services, platform operation and maintenance, and security service configuration; the security service configuration interfaces with the cryptographic resource pooling management module; the big data environment layer includes a master data management system and a big data management system, and the big data management system includes three subsystems: data acquisition, data governance, and data application; the application system layer includes general application systems and business application systems; The unified situation monitoring visualization system is coupled with the commercial cryptography platform through standardized data interfaces and secure channels. It includes: a business intelligence visualization tool deployed in the security management area; a multi-dimensional data model construction module; a penetrating visualization dashboard, including a global situation overview view, a business chain security perspective view that supports full-link drill-down display, an attack chain analysis and tracking view linked with the underlying attack chain reconstruction engine, and a compliance and operational efficiency view; an intelligent analysis drill-down and early warning module; and a unified standard and linkage mechanism module.

2. The system according to claim 1, characterized in that, The infrastructure resource layer includes a communication network environment and a computing and storage environment. The communication network environment includes a core layer network and an access layer network. The core layer network deploys dual 10 Gigabit stacked egress switches and dual-machine hot standby encryption machines. The access layer communicates with the core layer through an IPSec VPN tunnel. The computing and storage environment adopts an ARM+C86+X86 hybrid architecture, including centralized storage and distributed storage.

3. The system according to claim 1, characterized in that, The cloud computing service layer interfaces with the API of the cryptographic resource pooling management module through a plugin installed in the cloud platform to create a virtual cryptographic machine image; defines installation group policies through the SDN controller; and creates a standardized cloud host image that integrates a cloud workload protection agent.

4. The system according to claim 1, characterized in that, The big data environment layer also includes a secure data lake construction module and an analysis engine deployment module. The secure data lake construction module collects decrypted traffic metadata through a bypass-deployed commercial cryptographic traffic probe and collects application audit logs through a log collector. The analysis engine deployment module includes a rule association analysis engine, a machine learning analysis platform, and an attack chain reconstruction engine.

5. The system according to claim 1, characterized in that, The attack chain analysis and tracking view transforms the tactical and technical framework into a visual and interactive attack storyline, allowing users to click on any attack stage to view the corresponding original alerts, affected assets, and forensic data.

6. The system according to claim 1, characterized in that, The unified situation monitoring and visualization system is logically isolated from the production business area network. The front-end application, back-end service and cache database are deployed separately. The business intelligence visualization tool is security-hardened and compatible with the underlying domestic big data environment layer's JDBC / ODBC.

7. A method for constructing the system according to any one of claims 1-6, characterized in that, include: The environmental preparation steps include planning an independent security partition within the existing commercial encrypted network, allocating a dedicated commercial encrypted network address range to the security management area, and ensuring logical isolation between management traffic and business traffic. The infrastructure deployment steps include deploying domestic server clusters, configuring commercial cryptographic network equipment, deploying cryptographic machines and implementing cryptographic resource pooling, and injecting trust policies during the server operating system installation phase to implement a trusted base. Cloud service deployment steps: Install cloud computing software and configure security services that interface with the password resource pool API; Big data deployment steps include: building a big data platform, constructing a secure data lake, and deploying an analytics engine. Business deployment steps: migrate business applications to the cloud and configure a unified security gateway; Visualize the deployment steps, deploy business intelligence visualization tools in the security management area, and build data models and dashboards; The joint debugging and inspection process involves conducting full-chain joint debugging and checking the implementation of standards.

8. The method according to claim 7, characterized in that, The infrastructure deployment steps include: deploying a domestic server cluster consisting of compute nodes, storage nodes, and management nodes; configuring VLANs and ACLs to ensure controlled communication within the partitions; deploying cryptographic resource pool management software to virtualize physical cryptographic machines into a unified resource pool; and injecting trust policies during the operating system installation phase to ensure that only the kernel and drivers are authenticated and loaded.

9. The method according to claim 7, characterized in that, The construction of a secure data lake in the big data deployment steps includes: deploying commercially encrypted traffic probes in bypass mode on the core switch to collect traffic metadata; configuring targeted log sending on individual devices; deploying lightweight log collectors on business servers to collect audit logs; and deploying the analysis engine, which includes a rule-based correlation analysis engine, a machine learning analysis platform that imports anomaly detection models, and an attack chain reconstruction engine that loads technical and tactical knowledge graphs.

10. The method according to claim 7, characterized in that, The joint debugging and inspection steps include: verifying the complete process from business application access, cryptographic operations, log generation, collection and analysis to visualization; checking whether the device configuration meets the security baseline, whether the log format is standardized, and whether the operation and maintenance are carried out through the cloud platform or bastion host.

Images