A message detection method, device, electronic device and storage medium

Abstract

The invention discloses a message detection method, device, electronic device and storage medium. The method includes: acquiring a first packet initiated by a first user at a current moment; using an auxiliary packet list in a current time period to detect the first packet, and obtaining a first detection result of the first packet; wherein, The auxiliary message in the auxiliary message list is selected from the second message initiated in the current time period according to the matching situation of the detection rule; if the first detection result is that the detection fails, it is determined that the first user is associated with The first packet detection rule list is used, and the first packet detection rule list is used to detect the first packet to obtain a second detection result of the first packet. The invention introduces new user-centered management matching rules on the traditional Linux netfilter framework, and the message processing process is precisely matched, which reduces the complexity of message matching; in addition, when updating, adding and deleting rule entries, it does not affect other data.

Description

technical field [0001] Embodiments of the present invention relate to the technical field of firewalls, and in particular, to a packet detection method, device, electronic terminal, and storage medium. Background technique [0002] iptables / netfilter (hereinafter referred to as iptables) constitutes a packet filtering firewall under the Linux platform. Like most Linux software, this packet filtering firewall is free. It can replace expensive commercial firewall solutions and meet the needs of most scenarios. Complete functions such as packet filtering, packet redirection, and network address translation (NAT). [0003] The iptables firewall places multiple detection points at several positions in the entire network process, and adds sub-chains and rules to the detection points to process the data flow through the network kernel and protect the internal network from the intrusion of illegal users. However, in the existing data flow processing method based on iptables firewal...

AI Technical Summary

Problems solved by technology

[0005] . When a large number of matching rules are configured in iptables, the packet processing will go through too many tables and links, resulting in a significant decrease in the throughput and response speed of the firewall, and a significant increase in CPU usage;

[0006] . When iptables rules are updated, all rules need to be recreated. Under the premise of a large number of matching rules, it will take longer to update and add rules. In severe cases, the established link application will be disconnected.

Images