Message detection method and device

Abstract

The embodiment of the invention provides a message detection method and device, and is applied to security equipment. The method comprises the steps that the rules in a rule management library are classified, each type of rules are compiled one by one so as to generate distributed detection engines performing message detection by using the type of rules, and all the rules in the rule management library are compiled so as to generate a master detection engine performing message detection by using all the rules; when a message is received, whether the master detection engine is generated is detected; if the master detection engine is not generated, existence of the generated distributed detection engines is detected; if the generated distributed detection engines exist, the generated distributed detection engines are utilized to detect the message; and if the first distributed detection engine of the generated distributed detection engines detects that the message is matched with the rule used by the first distributed detection engine, the message is processed by using the first distributed detection engine according to the matched rule. With application of the message detection method and device, the possibility of attack to the network protected by the security equipment can be reduced.

Description

technical field [0001] The present application relates to the field of communication technologies, and in particular to a message detection method and device. Background technique [0002] The technical core of DPI (Deep Packet Inspection, deep packet inspection) is the detection engine. The detection engine integrates the rule management library and is set on the security device. The rule management library is IPS (Intrusion Prevention System, intrusion prevention system), APR (Application Recognition , application identification) and other rule sets related to the upper-layer application load identification business, the detection engine can use the rules in the rule management library to detect packets. In some scenarios, such as active / standby device switchover, rule management library upgrade, and service policy change delivery process, the rules in the rule management library will be recompiled, and the detection engine will be regenerated, and the security device will...

AI Technical Summary

Problems solved by technology

[0003] However, during the process of recompiling the rules in the rule management library, there is no detection engine available on the security device, and the detection engine cannot be used to process the message, and the DPI service is interrupted. At this time, if the DPI device receives the message, it will directly forward it

Especially in the case of a large number of rules in the rule management library, it will take a long time to recompile the rules in the rule management library, which may cause the DPI service of the security device to be interrupted for a long time, and the network protected by the security device may be easily attacked

Images