Network active defense and forensics system based on global situation awareness and application

Abstract

The application discloses a network active defense and forensics system based on global situation awareness and application, comprising a global risk perception and research module, a dynamic active defense and response module, an electronic data investigation and forensics and intelligence conversion module and a safe operation and supply chain management support module, open source component dependency analysis, source code static audit, user and entity behavior baseline analysis are included in the unified perception system, the detection coverage ability is improved; the development pipeline safety access control, sandbox detection before the purchased product enters the network, data leakage protection linkage are included in the dynamic defense system, the differentiated disposal strategy is automatically triggered based on the risk research result, the response speed is improved; through code submission and dependency chain deep forensics, the supply chain attack path is deeply restored, the forensics analysis result is converted into structured threat intelligence and feeds back to the perception and defense module; the compliance baseline strategy template is embedded in the system operation process, the automatic mapping and continuous execution required by laws and regulations are realized.

Description

Technical Field

[0001] This invention relates to the field of network security technology, specifically to a proactive network defense and forensics system and application based on full-domain situational awareness. Background Technology

[0002] With the deepening development of digital business, network security protection systems face multiple pressures, including the generalization of attack surfaces, the upgrading of attack methods, and increasingly stringent compliance requirements. The existing network security architecture is centered on perimeter protection, building static defense boundaries by deploying single-point security devices such as firewalls, intrusion prevention systems, and web application firewalls in sequence, and supporting them with situational awareness systems to achieve risk monitoring and alerts at the network and system layers.

[0003] The architecture still has the following shortcomings in practical applications: 1. The risk perception dimensions of existing situational awareness systems are limited to traditional attack surfaces such as network traffic, hardware assets, and system vulnerabilities. Their detection coverage for encrypted covert channels, abnormal behavior of internal personnel, risks of open-source components introduced by the software supply chain, and source code-level security vulnerabilities is significantly insufficient, making it difficult to adapt to the current trend of attack methods evolving towards the application layer, the supply chain side, and internal human maintenance; 2. Existing proactive defense mechanisms mostly rely on static rule bases and signature-based threat interception, lacking the ability to dynamically orchestrate strategies based on real-time risk assessment results. Furthermore, the development pipeline security access control, pre-network access verification of purchased products, and data leakage protection are not integrated into a unified defense system during the defense strategy formulation process, leading to new attack methods such as open-source component poisoning and supply chain backdoor implantation. 3. Existing electronic data forensics technologies are mostly deployed as an independent step after a security incident, resulting in data and process disconnect between them and the front-end real-time perception and defense system. Forensic triggers lack precise location capabilities and lack in-depth traceability capabilities for code submission history and software bill of materials (SBOM) dependency transmission links, making it difficult to support the complete path reconstruction of supply chain attacks. At the same time, forensic analysis results cannot be automatically converted into machine-readable threat intelligence and fed back to the perception and defense links, which restricts the continuous evolution of protection capabilities. 4. Compliance requirements such as network security level protection and critical information infrastructure security protection mostly rely on security experts to manually interpret them and then convert them into paper-based regulations or periodic inspection tasks. This results in problems such as a disconnect between compliance requirements and daily operations, insufficient continuity of execution, and high manual maintenance costs. Summary of the Invention

[0004] The purpose of this invention is to provide a network proactive defense and forensics system and application based on global situational awareness, so as to solve the problems mentioned in the background art.

[0005] To achieve the above objectives, the present invention provides the following technical solution: a network proactive defense and forensics system based on full-domain situational awareness, comprising a full-domain risk perception and assessment module, a dynamic proactive defense and response module, an electronic data forensics and intelligence conversion module, and a security operation and supply chain governance support module. The security operation and supply chain governance support module establishes data connections with the full-domain risk perception and assessment module, the dynamic proactive defense and response module, and the electronic data forensics and intelligence conversion module, respectively. The full-domain risk perception and assessment module establishes a data connection with the dynamic proactive defense and response module, and the dynamic proactive defense and response module establishes a data connection with the electronic data forensics and intelligence conversion module.

[0006] The comprehensive risk perception and assessment module includes an asset perception and topology mapping unit, a full traffic detection unit, an open-source component risk perception unit, a source code audit perception unit, a vulnerability scanning and compliance verification unit, a threat intelligence early warning unit, a user behavior analysis unit, an attack chain assessment unit, and a compliance baseline mapping unit. The asset perception and topology mapping unit automatically identifies hardware, virtual machines, containers, and business nodes, establishes a dynamic asset topology map, and identifies public network exposure surfaces and high-risk internal interconnect links. The full traffic detection unit analyzes and reconstructs north-south and east-west network traffic, identifies encrypted tunnels, covert channels, and malicious communication fingerprints. The open-source component risk perception unit interfaces with code repositories and container image repositories, automatically recursively parses component dependency trees, compares risks with national vulnerability databases and threat intelligence, and marks open-source components with security vulnerabilities or malicious implantation risks. The source code audit perception unit monitors code submission processes. The source code performs static security scanning to identify hard-coded keys, SQL injection backdoors, and logic bombs. The vulnerability scanning and compliance verification unit regularly performs vulnerability scans, weak password detection, and security baseline configuration verification on the system, middleware, and database, outputting a complete list of vulnerabilities. The threat intelligence early warning unit connects with multiple internal and external threat intelligence sources and industry security reports, automatically correlating and matching compromise indicators with local assets, traffic, and code data to achieve real-time early warning. The user behavior analysis unit constructs operational behavior baselines for operations and maintenance personnel, internal users, and third-party vendors based on graph neural networks to identify abnormal behaviors. The attack chain analysis unit performs spatiotemporal correlation aggregation on multi-source alarms to reconstruct the complete attack chain and attack stages, calculating the probability of attack success and risk level. The compliance baseline mapping unit maps mandatory requirements in laws and regulations into machine-executable security inspection rules, protection strategy templates, and forensic compliance standards.

[0007] The dynamic proactive defense and response module includes a boundary intelligent protection unit, a terminal micro-isolation and detection unit, a development pipeline security access control unit, an attack trapping unit, a purchased product access detection unit, a data leakage protection linkage unit, a security orchestration and response unit, an attack tracing and blocking unit, and a defense performance optimization unit. The boundary intelligent protection unit dynamically updates the protection rules of the firewall, web application firewall, and intrusion prevention system based on the risk level output by risk assessment. The terminal micro-isolation and detection unit performs process-level micro-isolation on the server and terminal sides to block the lateral movement path of attacks, performs malicious code detection and network isolation on compromised terminals, and curbs the spread of attacks. The development pipeline security access control unit sets security access controls in the CI / CD continuous integration pipeline; when high-risk open-source dependencies or malicious code submissions are detected, it automatically blocks the build and release process. The attack trapping unit deploys dynamically deformable, highly realistic honeypot services at the network boundary and intranet to detect suspicious scans and probes. Traffic measurement is proactively directed to the honeynet environment to capture attack tools, attack methods, and attack path characteristics. The purchased product access detection unit performs mandatory security checks on third-party purchased software and hardware products before they are allowed to enter the network. They are placed in a sandbox environment to observe all behavior and are only allowed to go online after confirming that there are no backdoors or malicious logic. The data leakage protection linkage unit monitors abnormal outward transmission of sensitive data and links with the data leakage protection gateway to perform real-time interception and watermark tracing to control data leakage risks. The security orchestration response unit has built-in emergency response scripts for supply chain poisoning, data extortion, and internal leaks. It automatically triggers the corresponding response process according to the risk level. The attack tracing and blocking unit traces the complete attack path, locates the attack source IP and jump node, and issues precise blocking policies to the boundary protection device within the scope of compliance to block the continuous access of the attack. The defense performance optimization unit collects the hit rate, false positive rate, and false negative rate data of each defense response and iteratively optimizes the detection rules and protection strategies.

[0008] The electronic data forensics and intelligence conversion module includes a multi-source evidence fixation unit, a traffic backtracking evidence collection unit, a source code and dependency chain evidence collection unit, a malicious code deep analysis unit, a behavior log evidence collection unit, an evidence chain storage and verification unit, and a report and intelligence dual output unit. The multi-source evidence fixation unit supports remote and local evidence mirroring fixation on physical machines, cloud hosts, containers, and storage devices, employing copy-on-write technology to ensure seamless business operations during the evidence collection process. The traffic backtracking evidence collection unit retrieves specific session data packets based on attack event timestamps and feature identifiers, completely reconstructing the entire process of attack command issuance and data transmission. The source code and dependency chain evidence collection unit collects and fixes evidence of code repository commit records, branch merging, and file changes, tracing the initial injection time and committing entity of malicious code, while also utilizing SBOM dependencies. The tree traces the introduction path, transmission level, and version change nodes of malicious open-source components, fully reconstructing the entire software supply chain attack chain. The malicious code deep analysis unit places suspicious malicious samples into a kernel-level sandbox for execution, monitoring their processes, registry, and network communication behaviors, and extracting system call sequences and attack behavior characteristics. The behavior log evidence collection unit collects system logs, operation logs, and audit logs, reconstructing the attacker's complete operation trajectory according to the timeline to form a complete behavioral evidence chain. The evidence chain storage and verification unit uses the national cryptographic SM3 algorithm to generate digital fingerprints for all electronic evidence, supports blockchain storage mode, and ensures the integrity, immutability, and judicial admissibility of the evidence. The report and intelligence dual output unit simultaneously outputs judicial appraisal reports for judicial and compliance scenarios and structured threat intelligence packages for system linkage.

[0009] The security operations and supply chain governance support module includes a security data platform unit, a supply chain tool integration unit, a unified SBOM management unit, a supplier quantitative rating unit, a supply chain intelligence operations unit, and a situation visualization unit. The security data platform unit collects all module operation logs and security data, completes data cleaning, enrichment, and standardized storage, and achieves millisecond-level data correlation query and statistical analysis based on a real-time stream computing engine. The supply chain tool integration unit uniformly manages SCA component scanners, code auditing tools, image security scanners, and vulnerability assessment tools, enabling one-click tool scheduling and normalized output of detection results. The unified SBOM management unit centrally stores the software material list of the entire business system. The supplier quantitative rating unit is used to establish an automated quantitative scoring model to achieve dynamic rating and management of supplier security risks. The supply chain intelligence operations unit actively subscribes to national and industry supply chain security notifications, generates targeted risk warnings based on internal asset and business data, and pushes them to security operations personnel and corresponding vendors. The situation visualization unit provides three layers of visualization views: a regulatory dashboard, an operations dashboard, and a technical dashboard, respectively presenting compliance status, attack handling progress, and raw technical data.

[0010] The application of a network proactive defense and forensics system based on full-domain situational awareness includes the following steps: Step 1, full-domain risk perception and attack chain analysis; Step 2, multi-dimensional dynamic defense and strategy triggering; Step 3, electronic evidence examination and forensics; Step 4, identification report output and structured threat intelligence encapsulation; Step 5, rule updates based on structured threat intelligence. In step one above, multi-dimensional data is collected through the full-domain risk perception and judgment module, and spatiotemporal correlation analysis of multi-source alarms is completed in combination with compliance baseline rules to restore the complete attack chain, calculate the probability of attack success, and output the attack chain judgment result with risk level and confidence level. In step two above, the attack chain analysis results are received through the dynamic active defense and response module, and emergency response scripts are matched. Differentiated attack blocking and risk containment are carried out from the dimensions of boundary, terminal, development pipeline, access of purchased products and data leakage protection. At the same time, the effectiveness data of this defense and response is collected, and after confirming that a real attack event has occurred, the evidence collection trigger instruction is issued to the electronic data forensics and intelligence conversion module. In step three above, the electronic data examination and evidence collection and intelligence conversion module executes the evidence collection process on the assets involved based on the evidence collection triggering instructions issued by the dynamic active defense and response module, forming a complete chain of evidence. In step four above, the electronic data forensics and intelligence conversion module generates an appraisal report that meets judicial requirements based on the obtained complete chain of evidence, and encapsulates the attack features extracted during the evidence analysis process into structured threat intelligence. In step five above, structured threat intelligence is synchronously transmitted back to the global risk perception and assessment module and the dynamic proactive defense and response module via the data bus of the security operation and supply chain governance support module. The global risk perception and assessment module updates the threat intelligence database and vulnerability association rules based on the transmitted threat intelligence, while the dynamic proactive defense and response module iteratively optimizes the boundary protection strategy and endpoint detection rules based on the transmitted threat intelligence and its own collected defense effectiveness data.

[0011] In step one, the multi-dimensional data includes network assets, traffic, open-source components, source code, system vulnerabilities, user behavior, and threat intelligence.

[0012] In step two, the performance data includes the hit rate, false alarm rate, and false negative rate of the defense response.

[0013] In step three, the evidence collection process specifically includes: performing lossless fixation of multi-source electronic evidence, full flow backtracking, source code and dependency chain tracing, in-depth analysis of malicious code, and reconstruction of behavior log trajectories on the assets involved.

[0014] In step four, the structured threat intelligence includes: YARA rules, malicious domain names, malicious IP addresses, file hash values, vulnerability exploitation methods, and profiles of attack groups. The structured threat intelligence is encapsulated in STIX / TAXII format.

[0015] Compared with existing technologies, the beneficial effects of this invention are as follows: This invention incorporates open-source component dependency resolution, source code static auditing, and user and entity behavior baseline analysis into a unified perception system, improving detection coverage; it incorporates development pipeline security access control, pre-network sandbox testing of purchased products, and data leakage protection linkage into a dynamic defense system, automatically triggering differentiated handling strategies based on risk assessment results, thus improving response speed; it achieves in-depth reconstruction of supply chain attack paths through code submission and deep forensics of dependency chains, transforming forensic analysis results into structured threat intelligence and feeding back into perception and defense modules; and it embeds compliance baseline policy templates into the system operation process, achieving automated mapping and continuous execution of legal and regulatory requirements. Attached Figure Description

[0016] Figure 1 This is a block diagram of the overall structure of the present invention; Figure 2 This is a structural block diagram of the global risk perception and assessment module of the present invention; Figure 3 This is a block diagram of the dynamic active defense and response module of the present invention; Figure 4 This is a structural block diagram of the electronic data forensics and intelligence conversion module of the present invention; Figure 5 This is a structural block diagram of the security operation and supply chain governance support module of the present invention; Figure 6 This is a flowchart illustrating the application of the present invention.

[0017] In the diagram: 1. Comprehensive Risk Perception and Assessment Module; 11. Asset Perception and Topology Mapping Unit; 12. Full Traffic Detection Unit; 13. Open Source Component Risk Perception Unit; 14. Source Code Audit Perception Unit; 15. Vulnerability Scanning and Compliance Verification Unit; 16. Threat Intelligence Early Warning Unit; 17. User Behavior Analysis Unit; 18. Attack Chain Assessment Unit; 19. Compliance Baseline Mapping Unit; 2. Dynamic Proactive Defense and Response Module; 21. Boundary Intelligent Protection Unit; 22. Terminal Micro-Issuance and Killing Unit; 23. Development Pipeline Security Access Control Unit; 24. Attack Deception Unit; 25. Purchased Product Access Detection Unit; 26. Data Leakage Protection Linkage Unit; 27. Security Orchestration and Response Unit. 28. Attack Tracing and Blocking Unit; 29. ​​Defense Performance Optimization Unit; 3. Electronic Data Forensics and Intelligence Conversion Module; 31. Multi-Source Evidence Fixing Unit; 32. Traffic Backtracking Evidence Collection Unit; 33. Source Code and Dependency Chain Evidence Collection Unit; 34. Malicious Code Deep Analysis Unit; 35. Behavior Log Evidence Collection Unit; 36. Evidence Chain Storage and Verification Unit; 37. Report and Intelligence Dual Output Unit; 4. Security Operation and Supply Chain Governance Support Module; 41. Security Data Platform Unit; 42. Supply Chain Tool Integration Unit; 43. SBOM Unified Management Unit; 44. Supplier Quantitative Rating Unit; 45. Supply Chain Intelligence Operation Unit; 46. Situational Awareness Visualization Unit. Detailed Implementation

[0018] The technical solutions of the embodiments of the present invention will be clearly and completely described below with reference to the accompanying drawings. Obviously, the described embodiments are only some embodiments of the present invention, and not all embodiments. Based on the embodiments of the present invention, all other embodiments obtained by those skilled in the art without creative effort are within the scope of protection of the present invention.

[0019] Please see the appendix Figure 1 -Appendix Figure 5This invention provides an embodiment of a network proactive defense and forensics system based on full-domain situational awareness, comprising a full-domain risk perception and assessment module 1, a dynamic proactive defense and response module 2, an electronic data forensics and intelligence conversion module 3, and a security operation and supply chain governance support module 4. The security operation and supply chain governance support module 4 establishes data connections with the full-domain risk perception and assessment module 1, the dynamic proactive defense and response module 2, and the electronic data forensics and intelligence conversion module 3, respectively. The full-domain risk perception and assessment module 1 establishes a data connection with the dynamic proactive defense and response module 2, and the dynamic proactive defense and response module 2 establishes a data connection with the electronic data forensics and intelligence conversion module 3. 1. As the risk perception and assessment center, it is responsible for collecting cyberspace elements in all dimensions, identifying security risks, assessing attack trends, and providing decision-making basis for proactive defense and evidence collection. 2. As the risk handling execution layer, it executes proactive and dynamic defense strategies based on the risk information output by situational awareness, realizing attack interception, risk reduction, and attack countermeasures. 3. Based on the event clues locked by the full-domain situational awareness, it completes the fixation, analysis, and compliant output of electronic evidence, supporting event characterization and judicial accountability. 4. Security operation and supply chain governance support module is used to provide underlying data, tool scheduling, and operational visualization support for the other modules, realizing unified management and capability linkage of the system.The comprehensive risk perception and assessment module 1 includes an asset perception and topology mapping unit 11, a full traffic detection unit 12, an open-source component risk perception unit 13, a source code audit perception unit 14, a vulnerability scanning and compliance verification unit 15, a threat intelligence early warning unit 16, a user behavior analysis unit 17, an attack chain assessment unit 18, and a compliance baseline mapping unit 19. The asset perception and topology mapping unit 11 automatically identifies hardware, virtual machines, containers, and business nodes, establishes a dynamic asset topology map, and identifies public network exposure surfaces and high-risk internal interconnect links. The full traffic detection unit 12 analyzes and reconstructs north-south and east-west network traffic, identifying encrypted tunnels, covert channels, and malicious communication fingerprints. The open-source component risk perception unit 13 interfaces with code repositories and container image repositories, automatically recursively parses component dependency trees, interfaces with national vulnerability databases and threat intelligence for risk comparison, and marks open-source components with security vulnerabilities and malicious implantation risks. The source code audit perception unit 14 performs static security checks on the source code submitted during the code submission process. The system includes: a scanning and identification unit 15 for vulnerabilities, SQL injection backdoors, and logic bombs; a vulnerability scanning and compliance verification unit 16 for regular vulnerability scanning, weak password detection, and security baseline configuration verification of the system, middleware, and database, outputting a full list of vulnerabilities; a threat intelligence early warning unit 16 for connecting with multiple internal and external threat intelligence sources and industry security reports, automatically correlating compromise indicators with local assets, traffic, and code data to achieve real-time early warning; a user behavior analysis unit 17 for constructing operational behavior baselines for maintenance personnel, internal users, and third-party suppliers based on graph neural networks, identifying abnormal behaviors such as large-scale data downloads and unauthorized access during non-working hours; an attack chain analysis unit 18 for spatiotemporal correlation aggregation of multi-source alarms such as traffic detection, vulnerability identification, and behavior analysis, restoring the complete attack chain and attack stages, and calculating the probability of attack success and risk level; and a compliance baseline mapping unit 19 for mapping mandatory requirements in laws and regulations into machine-executable security inspection rules, protection strategy templates, and evidence collection compliance standards.The dynamic proactive defense and response module 2 includes a boundary intelligent protection unit 21, a terminal micro-isolation and detection unit 22, a development pipeline security access control unit 23, an attack trapping unit 24, a purchased product access detection unit 25, a data leakage protection linkage unit 26, a security orchestration response unit 27, an attack tracing and blocking unit 28, and a defense performance optimization unit 29. The boundary intelligent protection unit 21 dynamically updates the protection rules of the firewall, web application firewall, and intrusion prevention system based on the risk level output by risk assessment. The terminal micro-isolation and detection unit 22 performs process-level micro-isolation on the server and terminal sides to block the lateral movement path of attacks, performs malicious code detection and network isolation on compromised terminals, and curbs the spread of attacks. The development pipeline security access control unit 23 sets security access control in the CI / CD continuous integration pipeline; when high-risk open-source dependencies or malicious code submissions are detected, it automatically blocks the build and release process. The attack trapping unit 24 deploys dynamically deformable, highly realistic honeypot services at the network boundary and within the intranet. The system actively directs suspicious scanning and probing traffic to the honeynet environment, capturing attack tools, attack methods, and attack path characteristics. The purchased product access detection unit 25 performs mandatory security checks on third-party purchased software and hardware products before they are allowed to enter the network. It places them in a sandbox environment to observe all behaviors and only allows them to go online after confirming that there are no backdoors or malicious logic. The data leakage protection linkage unit 26 monitors abnormal outward transmission of sensitive data and links with the data leakage protection gateway to perform real-time interception and watermark tracing to control data leakage risks. The security orchestration response unit 27 has built-in emergency response scripts for supply chain poisoning, data extortion, and internal leakage. It automatically triggers the corresponding response process according to the risk level. The attack tracing and blocking unit 28 traces back the complete attack path, locates the attack source IP and jump node, and issues precise blocking strategies to the boundary protection device within the scope of compliance to block the continuous access of attacks. The defense performance optimization unit 29 collects the hit rate, false alarm rate, and false negative rate data of each defense response and iteratively optimizes the detection rules and protection strategies.The Electronic Data Forensics and Intelligence Transformation Module 3 includes a multi-source evidence fixation unit 31, a traffic backtracking evidence collection unit 32, a source code and dependency chain evidence collection unit 33, a malicious code deep analysis unit 34, a behavior log evidence collection unit 35, an evidence chain storage and verification unit 36, and a report and intelligence dual output unit 37. The multi-source evidence fixation unit 31 supports remote and local evidence mirroring fixation on physical machines, cloud hosts, containers, and storage devices, employing copy-on-write technology to ensure seamless business operations during the evidence collection process. The traffic backtracking evidence collection unit 32 retrieves specific session data packets based on attack event timestamps and feature identifiers, completely reconstructing the entire process of attack command issuance and data transmission. The source code and dependency chain evidence collection unit 33 tracks code repository commit records, branch merging, and file changes. Furthermore, evidence collection and fixation are carried out, tracing the initial injection time and submitting entity of malicious code. Simultaneously, based on the SBOM dependency tree, the introduction path, transmission hierarchy, and version change nodes of malicious open-source components are traced back to fully reconstruct the entire software supply chain attack chain. The malicious code deep analysis unit 34 places suspicious malicious samples into a kernel-level sandbox for execution, monitoring their processes, registry, and network communication behavior, extracting system call sequences and attack behavior characteristics. The behavior log evidence collection unit 35 collects system logs, operation logs, and audit logs, reconstructing the attacker's complete operational trajectory chronologically to form a complete behavioral evidence chain. The evidence chain storage and verification unit 36 ​​uses the national cryptographic SM3 algorithm to generate digital fingerprints for all electronic evidence, supporting blockchain storage mode to ensure the integrity of the evidence. The report and intelligence dual-output unit 37 simultaneously outputs judicial appraisal reports for judicial and compliance scenarios and structured threat intelligence packages for system linkage, ensuring authenticity, immutability, and legal admissibility. The security operations and supply chain governance support module 4 includes a security data platform unit 41, a supply chain tool integration unit 42, a unified SBOM management unit 43, a supplier quantitative rating unit 44, a supply chain intelligence operations unit 45, and a situational visualization unit 46. The security data platform unit 41 collects all module operation logs and security data, completes data cleaning, enrichment, and standardized storage, and achieves millisecond-level data correlation query and statistical analysis based on a real-time stream computing engine. The supply chain tool integration unit 42 uniformly manages SCA component scanners, code auditing tools, and mirrors. Features such as security scanners and vulnerability assessment tools enable one-click tool scheduling and standardized output of detection results. The SBOM unified management unit 43 centrally stores the software material list for the entire business system. The supplier quantitative rating unit 44 establishes an automated quantitative scoring model based on dimensions such as vulnerability response timeliness and security incident records for supplier products, enabling dynamic rating and management of supplier security risks. The supply chain intelligence operation unit 45 proactively subscribes to national and industry supply chain security bulletins, combines internal asset and business data to generate targeted risk warnings, and pushes them to security operations personnel and corresponding vendors. The situation visualization unit 46 provides three layers of visualization views: a regulatory dashboard, an operational dashboard, and a technical dashboard, respectively presenting compliance status, attack handling progress, and raw technical data.

[0020] Please see Figure 6 The present invention provides an embodiment of a network proactive defense and forensics system based on full-domain situational awareness, comprising the following steps: Step 1, full-domain risk awareness and attack chain analysis; Step 2, multi-dimensional dynamic defense and strategy triggering; Step 3, electronic evidence examination and forensics; Step 4, identification report output and structured threat intelligence encapsulation; Step 5, rule updates based on structured threat intelligence. In step one above, multi-dimensional data is collected through the full-domain risk perception and assessment module 1, and spatiotemporal correlation analysis of multi-source alarms is completed in combination with compliance baseline rules to restore the complete attack chain, calculate the probability of attack success, and output the attack chain assessment results with risk level and confidence level; the multi-dimensional data includes network assets, traffic, open source components, source code, system vulnerability, user behavior and threat intelligence. In step two above, the attack chain analysis results are received by the dynamic active defense and response module 2, and an emergency response script is matched. Differentiated attack blocking and risk containment are carried out from the dimensions of boundary, terminal, development pipeline, access of purchased products and data leakage protection. At the same time, the effectiveness data of this defense and response is collected, including the hit rate, false alarm rate and false negative rate of the defense and response. After confirming that a real attack event has occurred, the evidence collection triggering instruction is issued to the electronic data forensics and intelligence conversion module 3. In step three above, the electronic data examination and evidence collection and intelligence conversion module 3 executes the evidence collection process on the assets involved based on the evidence collection triggering instructions issued by the dynamic active defense and response module 2: performing lossless fixation of multi-source electronic evidence, full flow backtracking, source code and dependency chain tracing, in-depth analysis of malicious code and reconstruction of behavior log trajectory on the assets involved, forming a complete evidence chain; In step four above, the electronic data examination and evidence collection and intelligence conversion module 3 generates an appraisal report that meets judicial requirements based on the obtained complete chain of evidence, and encapsulates the attack features extracted during the evidence analysis process into structured threat intelligence. The structured threat intelligence includes: YARA rules, malicious domain names, malicious IP addresses, file hash values, vulnerability exploitation methods and attack group profiles. The structured threat intelligence is encapsulated in STIX / TAXII format. In step five above, structured threat intelligence is synchronously transmitted back to the global risk perception and assessment module 1 and the dynamic proactive defense and response module 2 via the data bus of the security operation and supply chain governance support module 4. The global risk perception and assessment module 1 updates the threat intelligence database and vulnerability association rules based on the transmitted threat intelligence, while the dynamic proactive defense and response module 2 iteratively optimizes the boundary protection strategy and endpoint detection rules based on the transmitted threat intelligence and its own collected defense effectiveness data.

[0021] Based on the above, the advantages of this invention are that, when in use, the security operation and supply chain governance support module 4 provides underlying data, tool scheduling, and operational visualization support for the other modules, realizing unified system management and capability linkage; among them, the security data platform unit 41 aggregates network asset data, traffic data, code data, log data, and threat data, and completes the cleaning, standardization, enrichment, and real-time streaming computation of heterogeneous data, supporting millisecond-level correlation analysis and risk assessment of upper-layer modules; the supply chain tool integration unit 42 uniformly manages all supply chain security tools such as SCA component scanning, source code auditing, image security testing, and vulnerability verification, realizing intensive tool scheduling and standardized output of test results, solving the problem of the fragmented nature of traditional security tools. The SBOM unified management unit 43 centrally stores, tracks versions, and provides change alerts for the entire business system software material list, continuously recording the introduction relationships and version iteration links of open-source components and third-party dependencies, providing benchmark data for supply chain risk tracing, perception, and evidence collection; the supplier quantitative rating unit 44 automatically scores and dynamically rates third-party suppliers based on multi-dimensional indicators such as vulnerability response, security incidents, and access behavior, achieving quantitative governance of supply chain access risks; the supply chain intelligence operation unit 45 continuously subscribes to national and industry supply chain security early warnings and vulnerability notifications, and internally updates the risk feature database to achieve early warning of supply chain threats; the situation visualization unit 46 displays a layered visualization view. It displays compliance status, attack status, and supply chain risk status to support operational decisions and regulatory reporting; through the full-domain risk perception and analysis module 1, it performs static and dynamic risk perception across the entire network, all businesses, and the entire supply chain, completing multi-source alarm aggregation and quantitative situational analysis; among them, the asset perception and topology mapping unit 11 actively maps the entire network's physical assets, virtual assets, containers, and business nodes, generating dynamic network topology and identifying publicly exposed assets and high-risk interconnect links, such as accurately detecting the risk of unregistered test hosts exposing public ports; the full traffic detection unit 12 analyzes, restores, and identifies anomalies in the north-south and east-west directions of the entire network traffic, covering encrypted tunnels, covert channels, and malicious communication behavior detection, and can identify attackers using TLS Encrypted tunnels conceal the transmission of Trojan commands and the theft of internal network data; the open-source component risk perception unit 13 relies on SBOM data to recursively parse business dependency chains and match vulnerability databases to identify high-risk open-source components and poisoning dependencies; the source code audit perception unit 14 performs static security audits on the source code submitted by R&D, identifies hard-coded keys, backdoor code, and vulnerable logic, and intercepts code security defects in advance during the development stage; the vulnerability scanning and compliance verification unit 15 periodically completes vulnerability scanning, weak password detection, and baseline verification of hosts, middleware, and databases to discover operational security risks and non-compliant configurations; the threat intelligence early warning unit 16 connects to internal and external threat intelligence databases and achieves real-time early warning of malicious IPs, domain names, and hash samples through IOC collision;User behavior analysis unit 17 establishes a behavior baseline based on the historical operations of users, maintenance personnel, and supplier personnel, identifying internal threat behaviors such as unauthorized access, batch downloads, and abnormal logins; compliance baseline mapping unit 19 transforms laws, regulations, and security compliance standards into machine-executable inspection rules and protection standards, achieving automated implementation of compliance requirements; finally, attack chain analysis unit 18 performs spatiotemporal correlation, aggregation and deduplication, attack phase reconstruction, and risk confidence level assessment on multi-source heterogeneous alarms, outputting unified and quantitative security posture results, providing accurate decision-making basis for subsequent proactive defense; after obtaining the quantitative risk posture, dynamic proactive defense and response module 2 executes layered, automated, and full-scenario proactive defense according to the risk level. The system handles risks by enabling proactive interception, dynamic containment, and iterative optimization of strategies. The intelligent boundary protection unit 21 integrates the control capabilities of ordinary network boundaries and supply chain access boundaries, dynamically updating firewall, WAF, and intrusion prevention policies based on perception results to intercept malicious attacks, high-risk component pulls, and unauthorized vendor access. The terminal micro-isolation and removal unit 22 performs malicious code removal, process control, and network segment micro-isolation on compromised terminals, blocking lateral movement within the internal network and curbing the spread of ransomware and Trojans. The development pipeline security access control unit 23 sets up security checkpoints in the CI / CD pipeline, automatically blocking the release process for high-risk code submissions and malicious dependencies, achieving secure left-hand shift. The attack trapping unit 24 deploys simulation services. High-honeypot nodes such as code repositories and mirror repositories actively drive scanning and probing traffic to capture attacker tools, methods, and attack chains; the purchased product access detection unit 25 performs pre-network sandbox detection and behavior observation on third-party purchased software and hardware to prevent supply chain products with backdoors or hidden risks from entering the network; the data leakage prevention linkage unit 26 identifies, alerts, and intercepts the outward transmission of source code, keys, and sensitive business data to prevent core data leakage; the security orchestration response unit 27, based on standardized emergency scripts, achieves automated handling process linkage for scenarios such as supply chain poisoning, ransomware attacks, and internal leaks; the attack tracing and blocking unit 28 traces attack paths, locates attack sources and jump servers, and, in conjunction with... Within the specified scope, precise boundary blocking is implemented; the defense effectiveness optimization unit 29 continuously calculates the defense hit rate, false alarm rate, and false negative rate, and iterates the detection features and protection strategies in reverse to enable the system's defense capabilities to have adaptive evolution capabilities; when security incidents such as network attacks, supply chain intrusions, and data leaks occur, the electronic data forensics and intelligence conversion module 3 initiates a closed loop of full-process compliant evidence collection, trajectory reconstruction, and intelligence feedback; the multi-source evidence fixation unit 31 performs lossless and business-insensitive evidence mirroring fixation on hosts, cloud hosts, containers, and storage devices to ensure the originality of the evidence; the traffic backtracking evidence collection unit 32 backtracks the entire network traffic session based on the event timestamp to reconstruct the complete communication process of attack commands, file uploads, and data transmission;The source code and dependency chain forensics unit 33 traces code submitters, malicious code injection times, and branch change records. Simultaneously, it uses the SBOM link to trace the multi-level dependency propagation path of malicious open-source components, achieving dual-dimensional forensics of code personnel tracing and supply chain dependency tracing. The malicious code deep analysis unit 34 dynamically runs suspicious samples in a sandbox to analyze malicious behavior, system calls, and destructive logic. The behavior log forensics unit 35 integrates system logs, operation logs, and audit logs, reconstructing the complete attack behavior trajectory chronologically to form a closed-loop behavior evidence chain. The evidence chain storage and verification unit 36 ​​uses national cryptographic algorithms and blockchain storage for verification. The system ensures all evidence is tamper-proof, verifiable, and legally credible. The dual-output unit (37) simultaneously outputs compliant forensic reports and structured threat intelligence data packages. The forensic reports are used for event characterization, liability determination, and compliance self-inspection. Structured intelligence is pushed back in real-time to the full-domain risk perception and analysis module 1 and the dynamic proactive defense and response module 2. The full-domain risk perception and analysis module 1 updates its threat intelligence database and vulnerability association rules based on the returned threat intelligence. The dynamic proactive defense and response module 2 iteratively optimizes its boundary protection strategies and endpoint detection rules based on the returned threat intelligence and its own collected defense effectiveness data.

[0022] It will be apparent to those skilled in the art that the present invention is not limited to the details of the exemplary embodiments described above, and that the invention can be implemented in other specific forms without departing from its spirit or essential characteristics. Therefore, the embodiments should be considered in all respects as exemplary and non-limiting, and the scope of the invention is defined by the appended claims rather than the foregoing description. Thus, all variations falling within the meaning and scope of equivalents of the claims are intended to be included within the present invention. No reference numerals in the claims should be construed as limiting the scope of the claims.

Claims

1. A network proactive defense and evidence collection system based on full-domain situational awareness, comprising a full-domain risk perception and assessment module (1), a dynamic proactive defense and response module (2), an electronic data forensics and intelligence conversion module (3), and a security operation and supply chain governance support module (4), characterized in that: The security operation and supply chain governance support module (4) establishes data connections with the full-domain risk perception and assessment module (1), the dynamic active defense and response module (2), and the electronic data investigation and evidence collection and intelligence conversion module (3), respectively. The full-domain risk perception and assessment module (1) establishes data connections with the dynamic active defense and response module (2), and the dynamic active defense and response module (2) establishes data connections with the electronic data investigation and evidence collection and intelligence conversion module (3).

2. The network proactive defense and evidence collection system based on global situational awareness as described in claim 1, characterized in that: The full-domain risk perception and assessment module (1) includes an asset perception and topology mapping unit (11), a full traffic detection unit (12), an open-source component risk perception unit (13), a source code audit perception unit (14), a vulnerability scanning and compliance verification unit (15), a threat intelligence early warning unit (16), a user behavior analysis unit (17), an attack chain assessment unit (18), and a compliance baseline mapping unit (19). The asset perception and topology mapping unit (11) is used to automatically identify hardware, virtual machines, containers, and business nodes, establish a dynamic asset topology map, and identify public network exposure surfaces and internal high-risk interconnection links. The full traffic detection unit (12) is used to analyze and restore the north-south and east-west full network traffic, identify encrypted tunnels, hidden channels, and malicious communication fingerprints. The open-source component risk perception unit (13) connects to code repositories and container image repositories, automatically recursively parses component dependency trees, connects to the national vulnerability database and threat intelligence for risk comparison, and marks open-source components with security vulnerabilities and malicious implantation risks. The audit perception unit (14) performs static security scanning on the source code of the code submission process to identify hard-coded keys, SQL injection backdoors, and logic bombs. The vulnerability scanning and compliance verification unit (15) regularly performs vulnerability scanning, weak password detection, and security baseline configuration verification on the system, middleware, and database, and outputs a full list of vulnerabilities. The threat intelligence early warning unit (16) connects with multiple threat intelligence sources and industry security reports from internal and external sources, and automatically correlates and collides the compromise indicators with local assets, traffic, and code data to achieve real-time early warning. The user behavior analysis unit (17) builds the operation behavior baseline of operation and maintenance personnel, internal users, and third-party suppliers based on graph neural networks to identify abnormal behavior. The attack chain analysis unit (18) performs spatiotemporal correlation aggregation on multi-source alarms to restore the complete attack chain and attack stages, and calculates the probability of attack success and risk level. The compliance baseline mapping unit (19) maps the mandatory requirements in laws and regulations into machine-executable security inspection rules, protection strategy templates, and evidence collection compliance standards.

3. The network proactive defense and forensics system based on global situational awareness as described in claim 1, characterized in that: The dynamic active defense and response module (2) includes a boundary intelligent protection unit (21), a terminal micro-isolation and detection unit (22), a development pipeline security access control unit (23), an attack trapping unit (24), a purchased product access detection unit (25), a data leakage protection linkage unit (26), a security orchestration response unit (27), an attack tracing and blocking unit (28), and a defense performance optimization unit (29). The boundary intelligent protection unit (21) dynamically updates the protection rules of the firewall, web application firewall, and intrusion prevention system according to the risk level output by the risk assessment. The terminal micro-isolation and detection unit (22) performs process-level micro-isolation on the server and terminal sides to block the lateral movement path of the attack, performs malicious code detection and network isolation on the compromised terminal, and curbs the spread of the attack. The development pipeline security access control unit (23) sets up security access control in the CI / CD continuous integration pipeline. When a high-risk open source dependency or malicious code submission is detected, it automatically blocks the build and release process. The attack trapping unit (24) deploys dynamic security access control on the network boundary and intranet. The high-fidelity honeypot service actively pulls suspicious scanning and probing traffic to the honeynet environment, capturing attack tools, attack methods and attack path characteristics. The external product access detection unit (25) performs mandatory security detection on third-party external software and hardware products before they enter the network, places them in a sandbox environment to observe all behaviors, and allows them to go online only after confirming that there are no backdoors and no malicious logic. The data leakage protection linkage unit (26) monitors the abnormal external transmission behavior of sensitive data, links the data leakage protection gateway to perform real-time interception and watermark tracing, and manages the risk of data leakage. The security orchestration response unit (27) has built-in emergency response scripts for supply chain poisoning, data extortion and internal leakage, and automatically triggers the corresponding response process according to the risk level. The attack tracing and blocking unit (28) traces back the complete attack path, locates the attack source IP and jump node, and issues precise blocking strategies to the boundary protection equipment within the scope of compliance to block the continuous access of the attack. The defense performance optimization unit (29) collects the hit rate, false alarm rate and false negative rate data of each defense response, and iteratively optimizes the detection rules and protection strategies.

4. The network proactive defense and forensics system based on global situational awareness as described in claim 1, characterized in that: The electronic data forensics and intelligence conversion module (3) includes a multi-source evidence fixing unit (31), a traffic backtracking evidence unit (32), a source code and dependency chain evidence unit (33), a malicious code deep analysis unit (34), a behavior log evidence unit (35), an evidence chain storage and verification unit (36), and a report and intelligence dual output unit (37). The multi-source evidence fixing unit (31) supports remote and local evidence mirroring fixing of physical machines, cloud hosts, containers, and storage devices, and adopts copy-on-write technology to ensure that the evidence collection process is seamless. The traffic backtracking evidence unit (32) retrieves specific session data packets based on the attack event timestamp and feature identifier, and completely reconstructs the entire process of attack command issuance and data transmission. The source code and dependency chain evidence unit (33) collects and fixes evidence of code repository commit records, branch merging, and file changes, and traces the first injection time and commit time of malicious code. The main body, based on the SBOM dependency tree, traces back the introduction path, transmission level and version change node of malicious open source components, and fully restores the entire software supply chain attack chain. The malicious code deep analysis unit (34) puts the suspicious malicious samples into the kernel-level sandbox to run, monitors its process, registry and network communication full behavior, and extracts system call sequence and attack behavior characteristics. The behavior log evidence collection unit (35) collects system logs, operation logs and audit logs, reconstructs the attacker's complete operation trajectory according to the timeline, and forms a complete behavioral evidence chain. The evidence chain storage and verification unit (36) uses the national cryptographic SM3 algorithm to generate digital fingerprints for all electronic evidence, supports blockchain storage mode, and ensures the integrity, immutability and judicial admissibility of the evidence. The report and intelligence dual output unit (37) simultaneously outputs judicial appraisal reports for judicial and compliance scenarios and structured threat intelligence packages for system linkage.

5. The network proactive defense and forensics system based on global situational awareness as described in claim 1, characterized in that: The security operation and supply chain governance support module (4) includes a security data platform unit (41), a supply chain tool integration unit (42), a unified SBOM management unit (43), a supplier quantitative rating unit (44), a supply chain intelligence operation unit (45), and a situation visualization unit (46). The security data platform unit (41) collects the operation logs and security data of the entire module, completes data cleaning, enrichment, and standardized storage, and realizes millisecond-level data association query and statistical analysis based on the real-time stream computing engine. The supply chain tool integration unit (42) uniformly manages SCA component scanners, code auditing tools, image security scanners, and vulnerability assessment tools. The tool can be scheduled with one click and the test results can be output in a normalized manner. The SBOM unified management unit (43) centrally stores the software material list of the entire business system. The supplier quantitative rating unit (44) is used to establish an automated quantitative scoring model to realize the dynamic rating and management of supplier security risks. The supply chain intelligence operation unit (45) actively subscribes to national and industry supply chain security notification information, generates targeted risk warnings by combining internal asset and business data, and pushes them to security operation personnel and corresponding manufacturers. The situation visualization unit (46) provides three layers of visualization views: the regulatory screen, the operation screen, and the technical screen, which respectively present the compliance situation, the attack handling progress, and the original technical data.

6. Application of a network proactive defense and forensics system based on full-domain situational awareness, including step one, full-domain risk perception and attack chain analysis; step two, multi-dimensional dynamic defense and strategy triggering; step three, electronic evidence examination and forensics; step four, identification report output and structured threat intelligence encapsulation; and step five, rule updates based on structured threat intelligence; characterized in that: In step one above, multi-dimensional data is collected through the full-domain risk perception and judgment module (1), and the spatiotemporal correlation analysis of multi-source alarms is completed in combination with compliance baseline rules to restore the complete attack chain, calculate the probability of successful attack, and output the attack chain judgment result with risk level and confidence level. In step two above, the attack chain analysis results are received by the dynamic active defense and response module (2), and the emergency response script is matched. Differentiated attack blocking and risk containment are carried out from the dimensions of boundary, terminal, development pipeline, access of purchased products and data leakage protection. At the same time, the effectiveness data of this defense response is collected, and after confirming that a real attack event has occurred, the evidence collection trigger instruction is issued to the electronic data forensics and intelligence conversion module (3). In step three above, the electronic data inspection and evidence collection and intelligence conversion module (3) executes the evidence collection process on the assets involved based on the evidence collection triggering instruction issued by the dynamic active defense and response module (2), forming a complete chain of evidence. In step four above, the electronic data examination and evidence collection and intelligence conversion module (3) generates an appraisal report that meets judicial requirements based on the obtained complete chain of evidence, and encapsulates the attack features extracted during the evidence analysis process into structured threat intelligence. In step five above, the structured threat intelligence is synchronously transmitted back to the global risk perception and assessment module (1) and the dynamic proactive defense and response module (2) through the data bus of the security operation and supply chain governance support module (4). The global risk perception and assessment module (1) updates the threat intelligence database and vulnerability association rules according to the transmitted threat intelligence. The dynamic proactive defense and response module (2) iteratively optimizes the boundary protection strategy and terminal detection rules according to the transmitted threat intelligence and the defense effectiveness data it collects.

7. The application of the network proactive defense and forensics system based on global situational awareness as described in claim 6, characterized in that: In step one, the multi-dimensional data includes network assets, traffic, open-source components, source code, system vulnerabilities, user behavior, and threat intelligence.

8. The application of the network proactive defense and forensics system based on global situational awareness as described in claim 6, characterized in that: In step two, the performance data includes the hit rate, false alarm rate, and false negative rate of the defense response.

9. The application of the network proactive defense and forensics system based on global situational awareness as described in claim 6, characterized in that: In step three, the evidence collection process specifically includes: performing lossless fixation of multi-source electronic evidence, full flow backtracking, source code and dependency chain tracing, in-depth analysis of malicious code, and reconstruction of behavior log trajectories on the assets involved.

10. The application of the network proactive defense and forensics system based on global situational awareness as described in claim 6, characterized in that: In step four, the structured threat intelligence includes: YARA rules, malicious domain names, malicious IP addresses, file hash values, vulnerability exploitation methods, and profiles of attack groups. The structured threat intelligence is encapsulated in STIX / TAXII format.

Images