Rule base updating method and device, electronic device and readable storage medium

Abstract

The invention discloses a rule base updating method and device, an electronic device and a computer readable storage medium, and the method comprises the steps: obtaining to-be-detected data, carryingout the abnormal data detection of the to-be-detected data through employing a rule base, and obtaining a detection result; filtering first abnormal data corresponding to the detection result from the to-be-detected data to obtain to-be-classified data; performing classification processing on the to-be-classified data by utilizing the classification model to obtain second abnormal data; generating rule information corresponding to the second abnormal data, and updating the rule base by utilizing the rule information. According to the method, the classification model is used for further detecting the to-be-classified data, the second abnormal data which cannot be detected by the rule base in the to-be-detected data is detected, the rule base is updated in a targeted mode based on the second abnormal data, the updating efficiency and accuracy of the rule base are improved, false alarms and missing alarms can be reduced through the rule base updated in time, and the reliability of network security protection is improved.

Description

technical field [0001] The present application relates to the technical field of network security, and in particular to a method for updating a rule base, a device for updating a rule base, electronic equipment, and a computer-readable storage medium. Background technique [0002] With the advent of the era of big data and artificial intelligence, and the widespread application of 5G networks, the data volume of network traffic is increasing, and the network environment is becoming more and more complex and diverse. For network security protection, related technologies generally use a rule-based network firewall to perform rule matching on data, and determine network data that meets the requirements of the rules as abnormal data. However, with the emergence of new abnormal network data, the rules in the rule base need to be updated in time. Related technologies need to manually screen the abnormal network data and manually update the rule base based on the abnormal network d...

AI Technical Summary

Problems solved by technology

However, with the emergence of new abnormal network data, the rules in the rule base need to be updated in time. Related technologies need to manually screen the abnormal network data and manually update the rule base based on the abnormal network data, which makes the update speed of the rule base slower. Less efficient and less accurate

At the same time, the rule base that cannot be updated in time will also lead to a large number of false positives and false negatives, and the reliability of network security protection is poor.

[0003] Therefore, the problems of low update efficiency, poor accuracy, and poor reliability of network security protection in related technologies are technical problems that need to be solved by those skilled in the art

Images