Attack detection rule opening method, and equipment

Abstract

The invention discloses an attack detection rule opening method, and equipment. The method includes the steps that network equipment determines whether a current opened attack detection rule has a corresponding trigger opening rule set when flows are made to match the current opened attack detection rule; the network equipment obtains a rule identification in the trigger opening rule set if the current opened attack detection rule has a corresponding trigger opening rule set; and when the default state of the attack detection rule corresponding to the rule identification is a non-set state and the intelligent state of the attack detection rule corresponding to the rule identification is a non-set state or a closed state, the network equipment starts the attack detection rule corresponding to the rule identification, and modifies the intelligent state of the attack detection rule corresponding to the rule identification to be an opening state. According to the embodiment of the invention, the cost and the security of the network equipment can be as balanced as possible.

Description

technical field [0001] The invention relates to the technical field of communications, in particular to a method and device for enabling an attack detection rule. Background technique [0002] With the improvement of users' awareness of network security technology and network security products, users pay more and more attention to the number of attack detection rules supported by network devices, and with the steady increase in the number of new vulnerabilities every year, the number of attacks supported by network devices The number of detection rules has also exploded. Based on this, if all attack detection rules are directly enabled on the network device, a large number of attack detection rules will be enabled, and the network device needs to process many attack detection rules, which will inevitably lead to a decrease in the processing performance of the network device. If only a small number of attack detection rules are enabled on network devices, the utilization rat...

AI Technical Summary

Problems solved by technology

Based on this, if all attack detection rules are directly enabled on the network device, a large number of attack detection rules will be enabled, and there are many attack detection rules that the network device needs to process, which will inevitably lead to a decrease in the processing performance of the network device

If only a small number of attack detection rules are enabled on network devices, the utilization rate of attack detection rules will be reduced, and some attacks may even be missed by network devices, affecting security.

Images