A detection rule optimization configuration method and device

Abstract

The invention discloses a detection rule optimization configuration method and equipment, wherein, the method includes: receiving network traffic; extracting messages in the network traffic, and identifying the Protocol-related information; saving the protocol-related information and the corresponding relationship between the protocol-related information to the first learning association table; matching the corresponding rule items from the vulnerability rule base according to the relevant protocol information, and generating the first simplified rule set. Through the simplified rule set generated by the present invention, subsequent protocol detection is only performed on the protocol threats that may appear in the live network, therefore, the content to be detected later is reduced, the detection efficiency is improved, and unnecessary performance consumption is avoided at the same time .

Description

technical field [0001] The invention relates to the field of configuration of detection rules, in particular to a method and equipment for optimal configuration of detection rules. Background technique [0002] With the widespread use of computers and the continuous popularization of networks, there are more and more threats from inside and outside the network. In order to protect the security of the system, it is necessary to perform threat detection on the network. Protocol content detection is a type of threat detection. [0003] Taking IPS equipment as an example, the existing protocol content detection is mainly performed by pattern matching, that is, different detection rules correspond to different protocol configurations. The IPS device provides the function of custom rules, and detection is performed by adding, enabling or disabling certain detection rules by the user. However, there are thousands of existing protocol types, and tens of thousands of specific prot...

AI Technical Summary

Problems solved by technology

In IPS threat detection, most of its performance is consumed in the protocol content detection part. Therefore, using the existing method of directly enabling protocol detection rules will also detect protocol threats that do not appear in the network, resulting in IPS consumption. A lot of unnecessary resources are consumed, which reduces the efficiency and performance of IPS detection

Images