Processing method of signature rule, server and intrusion defending system

Abstract

Disclosed are a method for processing a signature rule, a server and an intrusion prevention system. The method includes: by performing association analysis on signature rule service status information about individual safety devices connected to same and an up-to-date signature rule collection issued by a cloud server, the cloud server acquiring a list of the most active threatening signature rule identification codes (IDs), and after generating update information according to the list of the most active threatening signature rule identification codes (IDs), the cloud server sending the update information to the individual safety devices to update a signature rule. The present invention is suitable for the field of network security systems.

Description

technical field [0001] The invention relates to the field of network security systems, in particular to a method for processing signature rules, a server and an intrusion prevention system. Background technique [0002] With the wide application of computers and the continuous popularization of the network, there are more and more threats from inside and outside the network, which has caused problems such as abuse of network resources, network paralysis, and leakage of user private data. In order to provide effective network security protection and prevent internal and external attacks on the network, it is necessary to deploy security devices in the network, such as IPS (Intrusion Prevention System, intrusion prevention system), firewall and so on. [0003] Current security devices mainly use signature feature scanning to detect network attacks, viruses, worms, and malicious software. Researchers analyze the signature features of vulnerabilities, viruses, worms, malware, e...

AI Technical Summary

Problems solved by technology

[0004] However, in the prior art, on the one hand, due to the limitation of CPU (Central Processing Unit, central processing unit) resources and different deployment scenarios, the security device does not load all the signature rules, but loads the signature rules according to the configuration part, and The configuration of signed rules is entirely up to the operator based on experience

On the other hand, there are differences in the signature rules loaded by different security devices in different industries in different regions. When a problem occurs, only the security devices loaded with the corresponding signature rules are protected, and the security devices that have not been loaded are not protected. Therefore, the existing The protection capabilities of security equipment in technology are not ideal

Images