Method and device for generating traffic detection rule

Abstract

Embodiments of the invention provide a method and a device for generating a traffic detection rule, which are applied to electronic equipment. The method comprises the following steps of obtaining traffic files of at least two attack traffics for a preset loophole, wherein the traffic files at least include load data in the attack traffics; determining a requester and an answer party of each attack traffic according to a protocol type of the attack traffic; determining loophole information of the preset loophole as an information guide item; extracting the first load data of all requesters from all traffic files; taking all first load data and the information guide item as a first input source and computing to obtain a first longest common substring of all first load data; determining the first longest common substring as a first characteristic; and generating a first traffic detection rule according to the first characteristic. Through application of the embodiments of the invention, the time consumed by generation of the traffic detection rule is reduced.

Description

technical field [0001] The invention relates to the technical field of the Internet, in particular to a method and device for generating traffic detection rules. Background technique [0002] With the popularization of Internet technology, various network applications emerge in an endless stream, and security threats and network abuse are also increasing day by day, which puts forward requirements for quickly and reliably identifying various traffic. [0003] At present, DPI (Deep Packet Inspection, deep data packet inspection technology) is generally used to detect traffic. The rules of deep data packet inspection technology to detect traffic are generated in the following way: manually extract features from the load of attack traffic, and extract the extracted features Input into the detection engine, the detection engine generates traffic detection rules from the extracted features according to its own rule syntax. [0004] When generating traffic detection rules accordi...

AI Technical Summary

Problems solved by technology

[0004] When generating traffic detection rules according to the above method, the more features extracted, the more accurate the traffic detection results. In order to improve the accuracy of the detection results, a large number of features need to be manually extracted, which makes the generation of traffic detection rules consume a lot of time

Images