Design And Implementation Of Network Security Situation Awareness Engine

With the rapid development of modern science and technology,network security issues have become increasingly serious.In order to solve the pre-judgment of the overall risk trend of network security in Shaanxi Province,the Office of Shannxi Provincial Cyber Security and Informatization Group proposed the construction of a network security situation awareness system.The system consists of two parts,a network security situation awareness platform and a network security situation awareness engine.This thesis focuses on the construction of an efficient and secure network security situation awareness engine to solve the flow of security data,instructions,and information in various areas of the network security situation awareness platform.The data of the network security situation awareness platform is provided by the distributed system,and there are differences among the computer nodes that make up the distributed system.In order to resolve the difficulties of data exchange between government,finance,energy,manufacturing and public service systems,it is imperative to build an efficient and reliable network security situation awareness engine.In order to accurately predict the security situation of the network,it is necessary to integrate and understand the massive network security state data.The data involved in this article comes mainly from the 1746 key information infrastructure in Shaanxi Province.Due to the large amount of data,it may happen that the sudden increase of data in one instant causes the system to respond slowly,the message is lost and even the engine directly crashes.In order to solve the above problems,a network security situation awareness engine was implemented to ensure efficient and reliable data transmission based on the background of Shaanxi Province network security situation awareness system project.Aiming at the requirements for high performance of the network security situation awareness engine,a high-performance network communication framework based on Netty is innovatively applied to the design of network security situation awareness engine.This implements the underlying network communication module of the network security situation awareness engine,which includes the design of the communication protocol,the engine Broker Core component network communication design and the engine Broker Producer&Consumer component network communication design.Aiming at the reliability requirements of the network security situation awareness engine,a message persistence module is designed on the engine Broker Core component so as to ensure that the engine will not lose data no matter what kind of sudden situation occurs.In order to make the network security situation awareness engine has strong pressure resistance under the high flow shock,both the engine Broker Core components and engine Broker Producer&Consumer component support clustered deployment.This thesis based on the modular design method,completed the realization of the network security situation awareness engine,mainly including engine Broker Core components,engine Broker Producer&Consumer components and Name Server three modules.The engine Broker Producer&Consumer components can be further divided into engine message sending end and engine message receiving end.Detailed tests were performed on the completed engine,including functional tests and performance tests.The test results show that the engine meets expected functional requirements and achieves high-performance,highly reliable,and scalable design goals.