Network security protection method and device and electronic equipment

Abstract

The invention relates to the technical field of network security, in particular to a network security protection method and device and electronic equipment. The method comprises the following steps: acquiring to-be-detected traffic data; and inputting the to-be-detected traffic data into the white traffic model to obtain a first detection result. And inputting the to-be-detected traffic data into a network application firewall WAF detection engine to obtain a second detection result. And if the first detection result is different from the second detection result, a feature detection model is adopted to extract traffic features of the to-be-detected traffic related to the network attack. Wherein the feature detection model is a machine learning model used for analyzing network traffic and extracting traffic features related to network attacks from the network traffic. And transmitting the traffic characteristics and the attack load of the to-be-detected traffic data to a cloud for artificial research and judgment, and adjusting model parameters of the WAF characteristic library or the white traffic model based on an artificial research and judgment result. According to the scheme, network security protection can be realized, and computer system and data security can be protected.

Description

Technical Field

[0001] The present application relates to the field of network security technology, and in particular to a network security protection method, device and electronic equipment. Background Art

[0002] With the popularization and development of the Internet, network security issues are becoming increasingly serious and have become an important issue for society and enterprises. Threats such as network attacks, network theft, network malicious programs and network disguises are emerging in an endless stream, posing huge challenges to computer system and data security. Therefore, network security protection has become an important means to protect computer system and data security. Summary of the invention

[0003] The embodiments of the present application provide a network security protection method, device and electronic device for implementing network security protection and protecting computer system and data security.

[0004] In a first aspect, an embodiment of the present application provides a network security protection method, the method comprising:

[0005] Obtain the traffic data to be detected;

[0006] Input the traffic data to be detected into the white traffic model to obtain a first detection result, the first detection result is used to indicate whether the traffic data is white traffic. The white traffic model classifies traffic based on the time series characteristics of network traffic. White traffic is data traffic that has no threat or malicious intent during network transmission;

[0007] Input the traffic data to be detected into the network application firewall WAF detection engine to obtain the second detection result, which is used to indicate whether the traffic data is not identified as black traffic. Black traffic is malicious, illegal or unauthorized data traffic during network transmission. The WAF detection engine classifies traffic based on the WAF feature library matching traffic features;

[0008] If the first detection result is different from the second detection result, a feature detection model is used to extract traffic features related to the network attack between the traffic to be detected and the network attack, where the feature detection model is a machine learning model used to analyze network traffic and extract traffic features related to the network attack;

[0009] The traffic characteristics and attack payload of the traffic data to be detected are transmitted to the cloud for manual analysis, and the model parameters of the WAF feature library or white traffic model are adjusted based on the manual analysis results.

[0010] Optionally, the feature detection model is obtained by training firewall ModSecurity grammar rules, existing WAF features, and black traffic matching the existing WAF features in a large language model.

[0011] Optionally, if the first detection result is that the traffic data is black traffic and the second detection result is that the traffic data is white traffic, the traffic characteristics and the attack payload of the traffic data to be detected are transmitted to the cloud for manual analysis, and the model parameters of the WAF feature library or the white traffic model are adjusted based on the manual analysis result, specifically including:

[0012] If the manual analysis result shows that the traffic data to be detected is black traffic, the traffic characteristics are stored in the WAF feature library;

[0013] If the manual judgment result is that the traffic data to be detected is white traffic, the model parameters of the white traffic model are adjusted and the traffic features are deleted.

[0014] Optionally, the above method further includes:

[0015] If the number of hits of the traffic feature within the preset time period is less than the preset threshold, the traffic feature is stored in the WAF feature library.

[0016] Optionally, if the first detection result is that the traffic data is white traffic, and the second detection result is that the traffic data is black traffic, the traffic characteristics and the attack payload of the traffic data to be detected are transmitted to the cloud for manual analysis, and the model parameters of the WAF feature library or the white traffic model are adjusted based on the manual analysis result, specifically including:

[0017] If the manual judgment result is that the traffic data to be detected is black traffic, adjust the model parameters of the white traffic model;

[0018] If the manual analysis result shows that the traffic data to be detected is white traffic, the traffic features in the WAF feature library are deleted.

[0019] Optionally, the above method further includes:

[0020] If the first detection result is that the traffic data to be detected is black traffic, and the second detection result is that the traffic data to be detected is black traffic, the traffic data to be detected is blocked from passing.

[0021] In a second aspect, an embodiment of the present application provides a network security protection device, the device comprising:

[0022] A communication module, used for acquiring traffic data to be detected;

[0023] A processing module, used for inputting the traffic data to be detected into a white traffic model to obtain a first detection result, wherein the first detection result is used to indicate whether the traffic data is white traffic. The white traffic model classifies traffic based on the time series characteristics of network traffic. White traffic is data traffic that has no threat or malicious intent during network transmission.

[0024] The processing module is further used to input the traffic data to be detected into the network application firewall WAF detection engine to obtain a second detection result, and the second detection result is used to indicate whether the traffic data is not identified as black traffic. Black traffic is malicious, illegal or unauthorized data traffic during network transmission. The WAF detection engine classifies traffic based on the WAF feature library matching traffic features;

[0025] The processing module is further configured to, if the first detection result is different from the second detection result, extract traffic features related to the network attack from the traffic to be detected using a feature detection model, where the feature detection model is a machine learning model for analyzing network traffic and extracting traffic features related to the network attack;

[0026] The communication module is also used to transmit traffic characteristics and attack payloads of traffic data to be detected to the cloud for manual analysis;

[0027] The processing module is also used to adjust the model parameters of the WAF feature library or the white traffic model based on the manual analysis results.

[0028] In a third aspect, an embodiment of the present application provides an electronic device, comprising a memory, a processor, and a computer program stored in the memory and executable on the processor. When the computer program is executed by the processor, the processor implements any one of the network security protection methods described in the first aspect.

[0029] In a fourth aspect, an embodiment of the present application further provides a computer-readable storage medium, in which a computer program is stored. When the computer program is executed by a processor, the network security protection method of any one of the first aspects is implemented.

[0030] In a fifth aspect, an embodiment of the present application further provides a computer program product, including a computer program, which is executed by a processor to implement a network security protection method as described in any one of the first aspects above.

[0031] The technical effects brought about by any one of the implementation methods in the second to fifth aspects can refer to the technical effects brought about by the corresponding implementation method in the first aspect, and will not be repeated here. BRIEF DESCRIPTION OF THE DRAWINGS

[0032] Figure 1 A schematic diagram of an application scenario of network security protection provided in an embodiment of the present application;

[0033] Figure 2 A flow chart of a network security protection method provided in an embodiment of the present application;

[0034] Figure 3 An exemplary flowchart of a network security protection provided in an embodiment of the present application;

[0035] Figure 4 A schematic diagram of a network security protection device provided in an embodiment of the present application;

[0036] Figure 5 A schematic diagram of the structure of an electronic device provided in an embodiment of the present application. DETAILED DESCRIPTION

[0037] Below, some terms in the embodiments of the present application are explained to facilitate understanding by those skilled in the art.

[0038] 1. "And / or" describes the relationship between related objects, indicating that there can be three relationships. For example, A and / or B can mean: A exists alone, A and B exist at the same time, and B exists alone. The character " / " generally indicates that the related objects are in an "or" relationship.

[0039] 2. A World Wide Web (Web) Application Firewall (WAF) is a security device used to protect Web applications from a variety of network attacks. WAF monitors, filters, and analyzes Hypertext Transfer Protocol (HTTP) traffic, detects and blocks malicious traffic, and prevents attackers from exploiting vulnerabilities in Web applications. WAF is an important line of defense for enterprises to protect their Web applications and Application Programming Interfaces (APIs). It can effectively defend against common network attacks such as Structured Query Language (SQL) injection, Cross Site Scripting (XSS), and Cross-site request forgery (CSRF).

[0040] 3. WAF signature library is a collection of network attack protection features. Network attack protection features are developed based on the characteristics of specific attack loads to identify specific attack loads in traffic. Currently, WAF signature library is still the core component of WAF attack protection.

[0041] 4. Zero-Day Vulnerability refers to security vulnerabilities in software or systems that have not been publicly disclosed and therefore have not been widely known or patched. Since these vulnerabilities have not been fixed, they can be exploited by attackers to launch attacks.

[0042] In order to make the purpose, technical solutions and advantages of the present application clearer, the present application will be further described in detail below in conjunction with the accompanying drawings. Obviously, the described embodiments are only part of the embodiments of the present application, rather than all the embodiments. Based on the embodiments in the present application, all other embodiments obtained by ordinary technicians in this field without making creative work are within the scope of protection of the present application.

[0043] The application scenarios described in the embodiments of the present application are intended to more clearly illustrate the technical solutions of the embodiments of the present application, and do not constitute a limitation on the technical solutions provided by the embodiments of the present application. It is known to those skilled in the art that with the emergence of new application scenarios, the technical solutions provided by the embodiments of the present application are also applicable to similar technical problems. In the description of the present application, unless otherwise specified, the meaning of "multiple" is two or more.

[0044] With the popularization and development of the Internet, network security issues are becoming increasingly serious and have become an important issue for society and enterprises. Threats such as network attacks, network theft, network malicious programs and network disguises are emerging in an endless stream, posing huge challenges to computer system and data security. Therefore, network security protection has become an important means to protect computer system and data security.

[0045] In order to solve the above problems, an embodiment of the present application provides a network security protection method. The method includes: obtaining traffic data to be detected. Inputting the traffic data to be detected into a white traffic model to obtain a first detection result. The first detection result is used to indicate whether the traffic data is white traffic, and the white traffic model classifies traffic based on the time series characteristics of network traffic. White traffic is data traffic without threats or malicious intentions during network transmission. Inputting the traffic data to be detected into a network application firewall WAF detection engine to obtain a second detection result. The second detection result is used to indicate whether the traffic data is not identified as black traffic. Black traffic is malicious, illegal or unauthorized data traffic during network transmission. The WAF detection engine classifies traffic based on the WAF feature library matching traffic features. If the first detection result is different from the second detection result, a feature detection model is used to extract traffic features related to the network attack of the traffic to be detected. The feature detection model is a machine learning model for analyzing network traffic and extracting traffic features related to network attacks. The traffic features and the attack load of the traffic data to be detected are transmitted to the cloud for manual judgment, and the model parameters of the WAF feature library or the white traffic model are adjusted based on the manual judgment results.

[0046] In this way, through the white traffic model, traffic can be classified based on the time series characteristics of network traffic, and normal white traffic can be effectively identified. The WAF detection engine uses the WAF feature library to match traffic features and identify data that is not identified as black traffic. When the detection results of the two are inconsistent, the feature detection model is used for further analysis to extract traffic features related to network attacks, thereby improving the accuracy of detection. According to the results of manual analysis, the model parameters of the WAF feature library or white traffic model can be adjusted in time, so that the WAF can more effectively respond to new attacks and variant attacks, thereby enhancing defense capabilities. Combining machine learning models and manual analysis, an organic combination of automated detection and manual intervention is achieved. On the basis of automated detection, adjusting the WAF feature library and white traffic model through manual analysis results helps to improve the adaptability and accuracy of the model, so that it can better respond to the ever-changing network threat environment.

[0047] A schematic diagram of an application scenario of an optional network security protection method according to an embodiment of the present application. Figure 1 As shown, it includes a server 100 and a terminal 101. The server 100 and the terminal 101 can be communicatively connected through a network to implement the network security protection method of the present application.

[0048] The user can use the server 100 to interact with the terminal 101 through the network, such as receiving or sending messages, etc. Various client applications can be installed on the terminal 101, such as program writing applications, web browser applications, search applications, etc.

[0049] It is understandable that in the embodiment of the present application, the server 100 can be implemented as an independent server or a server cluster composed of multiple servers. The terminal 101 can be various electronic devices with a display screen and supporting web browsing, including but not limited to smart phones, tablet computers, desktop computers, etc.

[0050] The server 100 can be used to obtain traffic data to be detected. The traffic data to be detected is input into the white traffic model to obtain a first detection result. The first detection result is used to indicate whether the traffic data is white traffic, and the white traffic model classifies traffic based on the time series characteristics of network traffic. White traffic is data traffic without threats or malicious intent during network transmission. The traffic data to be detected is input into the network application firewall WAF detection engine to obtain a second detection result. The second detection result is used to indicate whether the traffic data is not identified as black traffic. Black traffic is malicious, illegal or unauthorized data traffic during network transmission. The WAF detection engine classifies traffic based on the WAF feature library matching traffic features. If the first detection result is different from the second detection result, the feature detection model is used to extract the traffic features related to the network attack of the traffic to be detected. The feature detection model is a machine learning model used to analyze network traffic and extract traffic features related to network attacks. The traffic features and the attack load of the traffic data to be detected are transmitted to the cloud for manual analysis, and the model parameters of the WAF feature library or the white traffic model are adjusted based on the manual analysis results.

[0051] like Figure 2 As shown, a flowchart of a network security protection method provided by an embodiment of the present application, optionally, Figure 2 The method flow shown can be Figure 1 The scenario shown may be performed by the server side, or by Figure 1 The terminal included in the scenario shown is executed, and the present application is for Figure 2 The execution subject of the method flow shown is not limited. Specifically, it may include the following steps.

[0052] Step S201: Obtain the flow data to be detected.

[0053] Step S202: input the flow data to be detected into the white flow model to obtain a first detection result.

[0054] The first detection result is used to indicate whether the traffic data is white traffic. The white traffic model classifies traffic based on the time series characteristics of network traffic. White traffic is data traffic that has no threat or malicious intent during network transmission.

[0055] For example, the white traffic model may be a Hidden Markov Model (HMM).

[0056] Step S203: input the traffic data to be detected into the network application firewall (WAF) detection engine to obtain a second detection result.

[0057] The second detection result is used to indicate whether the traffic data is not identified as black traffic. Black traffic is malicious, illegal or unauthorized data traffic during network transmission. The WAF detection engine classifies traffic based on the WAF feature library matching traffic features.

[0058] In an optional embodiment, after obtaining the first detection result and the second detection result, it can be determined whether the first detection result is the same as the second detection result. In a possible situation, the first detection result is that the flow data to be detected is white flow. The second detection result is that the flow data to be detected is white flow. The first detection result is the same as the second detection result. It is determined that the flow data to be detected is white flow, and no security protection processing is performed.

[0059] In another possible situation, the first detection result is that the flow data to be detected is black flow. The second detection result is that the flow data to be detected is black flow. The first detection result is the same as the second detection result, and it is determined that the flow data to be detected is black flow. The flow data to be detected is blocked from passing.

[0060] In another possible situation, the first detection result is that the flow data to be detected is black flow. The second detection result is that the flow data to be detected is white flow. The first detection result is different from the second detection result. Step S204 is executed.

[0061] In another possible situation, the first detection result is that the flow data to be detected is white flow. The second detection result is that the flow data to be detected is black flow. The first detection result is different from the second detection result. Step S204 is executed.

[0062] Step S204: If the first detection result is different from the second detection result, a feature detection model is used to extract traffic features related to the traffic to be detected and the network attack.

[0063] Among them, the feature detection model is a machine learning model used to analyze network traffic and extract traffic features related to network attacks.

[0064] Optionally, the feature detection model is obtained by training the firewall ModSecurity grammar rules, existing WAF features, and black traffic matching the existing WAF features into a large language model.

[0065] In the above method, by integrating the grammatical rules of ModSecurity and the existing WAF features in the large language model for training, the feature detection model can integrate multiple security detection mechanisms and strategies. This enables the model to more comprehensively identify and analyze potential threats in network traffic, improving the accuracy and coverage of detection. Using black traffic data that matches the WAF features as training data helps the model learn the characteristics and patterns of black traffic, enhancing the adaptability and robustness of the model.

[0066] Optionally, in order to retain the complete processing track of the traffic data to be detected and facilitate subsequent analysis and investigation, information related to the traffic data to be detected can be stored in a log.

[0067] Step S205: Transmit the traffic characteristics and the attack payload of the traffic data to be detected to the cloud for manual analysis, and adjust the model parameters of the WAF feature library or the white traffic model based on the manual analysis results.

[0068] In an optional embodiment, if the first detection result is that the traffic data is black traffic, and the second detection result is that the traffic data is white traffic, the traffic characteristics and the attack load of the traffic data to be detected are transmitted to the cloud for manual analysis. If the manual analysis result is that the traffic data to be detected is black traffic, the traffic characteristics are stored in the WAF feature library. If the manual analysis result is that the traffic data to be detected is white traffic, the model parameters of the white traffic model are adjusted, and the traffic characteristics are deleted.

[0069] For example, when the traffic to be detected is judged as black traffic after being detected by the white traffic model, but is then judged as white traffic again after being detected by the WAF feature library. Use the feature detection model to extract the traffic features related to the network attack of the traffic to be detected. Block the traffic to be detected from passing. Transmit the traffic features and the attack payload of the traffic data to be detected to the cloud for manual analysis.

[0070] If the manual analysis result shows that the traffic data to be detected is black traffic, it means that the WAF feature library has underreporting. The WAF feature library can be fine-tuned based on the uploaded load and traffic features to ensure that similar attacks can be accurately identified and blocked in the future. The fine-tuned features will be added to the feature library and released to the entire network to update all related detection systems.

[0071] If the result of manual analysis is that the traffic data to be detected is white traffic, it means that the white traffic model has false positives. In order to reduce the false positive rate, the white traffic model can be trained, tested and fine-tuned to improve the accuracy and robustness of the model.

[0072] Optionally, if the number of hits of the traffic feature within a preset time period is less than a preset threshold, the traffic feature is stored in a WAF feature library.

[0073] The preset threshold is used to determine whether there is an abnormality in the number of hits of the traffic feature within a preset time period.

[0074] It is understandable that the preset time period and the preset threshold value can be preset by those skilled in the art. The preset time period and the preset threshold value can also be changed based on the application scenario. For example, the preset time period is 1 hour or 1 day. The preset threshold value is 95 times or 200 times.

[0075] For example, set a preset time period (such as one day, one week, or one month, etc.) and a preset threshold (such as 10 times, 50 times, etc.). During this preset time period, count the number of hits of the traffic feature. If the number of hits is less than the preset threshold, the traffic feature is stable and effective during this period, that is, the number of times it is triggered is within a reasonable range and does not cause too many false alarms. The traffic feature can be stored in the WAF feature library. This facilitates the subsequent use of the traffic feature to detect and block future attack traffic.

[0076] Optionally, if the number of hits is greater than or equal to the preset threshold, the traffic feature has too many hits within the preset time, and there is a large amount of false positive traffic. In this case, the processing action corresponding to the traffic feature can be modified. The processing action is changed from blocking the traffic corresponding to the traffic feature to log, that is, only the log information related to the traffic feature is recorded, and no measures to block the traffic are taken.

[0077] In another optional embodiment, if the first detection result is that the traffic data is white traffic, and the second detection result is that the traffic data is black traffic, the traffic features and the attack payload of the traffic data to be detected are transmitted to the cloud for manual analysis. If the manual analysis result is that the traffic data to be detected is black traffic, the model parameters of the white traffic model are adjusted. If the manual analysis result is that the traffic data to be detected is white traffic, the traffic features in the WAF feature library are deleted.

[0078] For example, when the traffic to be detected is determined to be white traffic after being detected by the white traffic model, but is then determined to be black traffic after being detected by the WAF feature library. Use the feature detection model to extract the traffic features related to the network attack of the traffic to be detected. Block the traffic to be detected from passing. Transmit the traffic features and the attack payload of the traffic data to be detected to the cloud for manual analysis.

[0079] If the result of manual analysis is that the traffic data to be detected is black traffic, it means that the white traffic model has false positives. In order to reduce the false positive rate, the white traffic model can be trained, tested, and fine-tuned to improve the accuracy and robustness of the model.

[0080] If the manual judgment result is that the traffic data to be detected is white traffic, it means that there is a false alarm in the WAF feature library. You can fine-tune the WAF feature library based on the uploaded load and traffic characteristics, and change the handling action of the traffic feature to release. Prevent false alarms and publish it to the whole network to update all related detection systems.

[0081] Optional, since the WAF detection engine relies on known attack features and patterns to identify black traffic. However, for zero-day vulnerability attacks, since these attacks exploit vulnerabilities that have not yet been publicly disclosed, the WAF detection engine cannot directly identify zero-day vulnerability attacks. If the manual analysis results determine that there is an attack payload of a zero-day vulnerability in the black traffic, the probability of the subsequent WAF detection engine capturing the zero-day vulnerability attack can be increased. This helps protect Web applications from the harm of zero-day vulnerability attacks and improves the efficiency and accuracy of overall network security protection.

[0082] like Figure 3 As shown, an exemplary flowchart of a network security protection method provided in an embodiment of the present application may include the following steps:

[0083] Step S301, obtaining flow data to be detected;

[0084] Step S302: input the flow data to be detected into the white flow model to obtain a first detection result;

[0085] Step S303: input the traffic data to be detected into the network application firewall (WAF) detection engine to obtain a second detection result;

[0086] Step S304, determine whether the first detection result is the same as the second detection result, if they are the same, execute step S305, if they are different, execute step S308;

[0087] Step S305: determine whether the traffic data to be detected is white traffic based on the first detection result and the second detection result. If yes, execute step S306; if no, execute step S307;

[0088] Step S306: If the first detection result is that the traffic data to be detected is white traffic, and the second detection result is that the traffic data to be detected is white traffic, it is determined that the traffic data to be detected is white traffic, and no security protection processing is performed;

[0089] Step S307: if the first detection result is that the traffic data to be detected is black traffic, and the second detection result is that the traffic data to be detected is black traffic, the traffic data to be detected is determined to be black traffic, and the traffic data to be detected is blocked from passing;

[0090] Step S308: extracting traffic features related to the network attack by using a feature detection model;

[0091] Step S309: Transmit the traffic characteristics and the attack payload of the traffic data to be detected to the cloud for manual analysis;

[0092] Step S310: If the first detection result is that the traffic data is black traffic, and the second detection result is that the traffic data is white traffic, and if the manual judgment result is that the traffic data to be detected is black traffic, the traffic characteristics are stored in the WAF characteristic library;

[0093] Step S311: if the first detection result is that the flow data is black flow, and the second detection result is that the flow data is white flow, if the manual judgment result is that the flow data to be detected is white flow, adjust the model parameters of the white flow model and delete the flow characteristics;

[0094] Step S312: if the first detection result is that the flow data is white flow, and the second detection result is that the flow data is black flow, and if the manual judgment result is that the flow data to be detected is black flow, adjust the model parameters of the white flow model;

[0095] Step S313: if the first detection result is that the traffic data is white traffic, and the second detection result is that the traffic data is black traffic, and if the manual judgment result is that the traffic data to be detected is white traffic, the traffic features in the WAF feature library are deleted.

[0096] Figure 4 This is a schematic diagram of the structure of a network security protection device provided in an embodiment of the present application. Figure 4 As shown, the device includes: a communication module 401 and a processing module 402.

[0097] Communication module 401, used to obtain the flow data to be detected;

[0098] A processing module 402 is used to input the traffic data to be detected into a white traffic model to obtain a first detection result, where the first detection result is used to indicate whether the traffic data is white traffic. The white traffic model classifies traffic based on the time series characteristics of network traffic. White traffic is data traffic that has no threat or malicious intent during network transmission.

[0099] The processing module 402 is further used to input the traffic data to be detected into the network application firewall WAF detection engine to obtain a second detection result, and the second detection result is used to indicate whether the traffic data is not identified as black traffic. Black traffic is malicious, illegal or unauthorized data traffic during network transmission. The WAF detection engine performs traffic classification based on the WAF feature library matching traffic features;

[0100] The processing module 402 is further configured to, if the first detection result is different from the second detection result, use a feature detection model to extract traffic features related to the network attack from the traffic to be detected, where the feature detection model is a machine learning model for analyzing network traffic and extracting traffic features related to the network attack;

[0101] The communication module 401 is also used to transmit the traffic characteristics and the attack payload of the traffic data to be detected to the cloud for manual analysis;

[0102] The processing module 402 is further used to adjust the model parameters of the WAF feature library or the white traffic model based on the manual analysis result.

[0103] Optionally, the feature detection model is obtained by training the firewall ModSecurity grammar rules, existing WAF features, and black traffic matching the existing WAF features into a large language model.

[0104] Optionally, if the first detection result is that the traffic data is black traffic, and the second detection result is that the traffic data is white traffic, the traffic characteristics and the attack payload of the traffic data to be detected are transmitted to the cloud for manual analysis, and the model parameters of the WAF feature library or the white traffic model are adjusted based on the manual analysis result. The processing module 402 is specifically used for:

[0105] If the manual analysis result shows that the traffic data to be detected is black traffic, the traffic characteristics are stored in the WAF feature library;

[0106] If the manual judgment result is that the traffic data to be detected is white traffic, the model parameters of the white traffic model are adjusted and the traffic features are deleted.

[0107] Optionally, the processing module 402 is further configured to:

[0108] If the number of hits of the traffic feature within the preset time period is less than the preset threshold, the traffic feature is stored in the WAF feature library.

[0109] Optionally, if the first detection result is that the traffic data is white traffic, and the second detection result is that the traffic data is black traffic, the traffic characteristics and the attack payload of the traffic data to be detected are transmitted to the cloud for manual analysis, and the model parameters of the WAF feature library or the white traffic model are adjusted based on the manual analysis result. The processing module 402 is specifically used for:

[0110] If the manual judgment result is that the traffic data to be detected is black traffic, adjust the model parameters of the white traffic model;

[0111] If the manual analysis result shows that the traffic data to be detected is white traffic, the traffic features in the WAF feature library are deleted.

[0112] Optionally, the processing module 402 is further configured to:

[0113] If the first detection result is that the traffic data to be detected is black traffic, and the second detection result is that the traffic data to be detected is black traffic, the traffic data to be detected is blocked from passing.

[0114] Based on the same technical concept, an electronic device is also provided in an embodiment of the present application, and the electronic device can realize the functions of the aforementioned network security protection device.

[0115] Figure 5 A schematic diagram of the structure of an electronic device provided in an embodiment of the present application.

[0116] At least one processor 501, and a memory 502 connected to the at least one processor 501. The specific connection medium between the processor 501 and the memory 502 is not limited in the embodiment of the present application. Figure 5 In the example, the processor 501 and the memory 502 are connected via a bus 500. The bus 500 is Figure 5 The connections between other components are shown in bold lines, and are not intended to be limiting. The bus 500 can be divided into an address bus, a data bus, a control bus, etc. For ease of representation, Figure 5 Only one thick line is used in the figure, but it does not mean that there is only one bus or one type of bus. Alternatively, the processor 501 can also be called a controller, and there is no limitation on the name.

[0117] In the embodiment of the present application, the memory 502 stores instructions that can be executed by at least one processor 501. The at least one processor 501 can execute a network security protection method discussed above by executing the instructions stored in the memory 502. The processor 501 can implement Figure 4 The functions of each module in the device shown.

[0118] Among them, the processor 501 is the control center of the device, and can use various interfaces and lines to connect the various parts of the entire control device. By running or executing instructions stored in the memory 502 and calling data stored in the memory 502, the various functions of the device and processing data, the device can be monitored as a whole.

[0119] In one possible design, the processor 501 may include one or more processing units, and the processor 501 may integrate an application processor and a modem processor, wherein the application processor mainly processes an operating system, a driver interface, and application programs, and the modem processor mainly processes wireless communications. It is understandable that the modem processor may not be integrated into the processor 501. In some embodiments, the processor 501 and the memory 502 may be implemented on the same chip, and in some embodiments, they may also be implemented separately on separate chips.

[0120] Processor 501 can be a general-purpose processor, such as a central processing unit (CPU), a digital signal processor, an application-specific integrated circuit, a field programmable gate array or other programmable logic device, a discrete gate or transistor logic device, a discrete hardware component, and can implement or execute the various methods, steps and logic block diagrams disclosed in the embodiments of the present application. A general-purpose processor can be a microprocessor or any conventional processor, etc. The steps of a network security protection method disclosed in conjunction with the embodiments of the present application can be directly embodied as a hardware processor execution, or a combination of hardware and software modules in the processor.

[0121] The memory 502 is a non-volatile computer-readable storage medium that can be used to store non-volatile software programs, non-volatile computer executable programs and modules. The memory 502 may include at least one type of storage medium, such as a flash memory, a hard disk, a multimedia card, a card-type memory, a random access memory (Random Access Memory, RAM), a static random access memory (Static Random Access Memory, SRAM), a programmable read-only memory (Programmable Read Only Memory, PROM), a read-only memory (Read Only Memory, ROM), an electrically erasable programmable read-only memory (Electrically Erasable Programmable Read-Only Memory, EEPROM), a magnetic memory, a disk, an optical disk, etc. The memory 502 is any other medium that can be used to carry or store a desired program code in the form of an instruction or data structure and can be accessed by a computer, but is not limited thereto. The memory 502 in the embodiment of the present application can also be a circuit or any other device that can realize a storage function, for storing program instructions and / or data.

[0122] By programming the processor 501, the code corresponding to the network security protection method described in the above embodiment can be fixed into the chip, so that the chip can execute the code when running. Figure 2 The embodiment shown is a network security protection method. How to design and program the processor 501 is a technology well known to those skilled in the art and will not be described in detail here.

[0123] It should be noted here that the above-mentioned electronic device provided in the embodiment of the present application can implement all the method steps implemented in the above-mentioned method embodiment, and can achieve the same technical effect. The parts and beneficial effects of this embodiment that are the same as the method embodiment will not be described in detail here.

[0124] An embodiment of the present application further provides a computer-readable storage medium, which stores computer-executable instructions, and the computer-executable instructions are used to enable a computer to execute a network security protection method in the above embodiment.

[0125] Those skilled in the art will appreciate that the embodiments of the present application may be provided as methods, systems, or computer program products. Therefore, the present application may adopt the form of a complete hardware embodiment, a complete software embodiment, or an embodiment in combination with software and hardware. Moreover, the present application may adopt the form of a computer program product implemented on one or more computer-usable storage media (including but not limited to disk storage, CD-ROM, optical storage, etc.) that contain computer-usable program code.

[0126] The present application is described with reference to the flowcharts and / or block diagrams of the methods, devices (systems), and computer program products according to the present application. It should be understood that each process and / or block in the flowchart and / or block diagram, as well as the combination of the processes and / or blocks in the flowchart and / or block diagram, can be implemented by computer program instructions. These computer program instructions can be provided to a processor of a general-purpose computer, a special-purpose computer, an embedded processor, or other programmable data processing device to generate a machine, so that the instructions executed by the processor of the computer or other programmable data processing device generate instructions for implementing the processes in the flowchart and / or block diagram. Figure 1 Flow or flows and / or boxes Figure 1 A device that performs the functions specified in a box or multiple boxes.

[0127] These computer program instructions may also be stored in a computer-readable memory capable of directing a computer or other programmable data processing device to operate in a specific manner, so that the instructions stored in the computer-readable memory produce an article of manufacture comprising an instruction device, which implements the process Figure 1 Flow or flows and / or boxes Figure 1 The functions specified in one or more boxes.

[0128] These computer program instructions can also be loaded onto a computer or other programmable data processing device so that a series of operating steps are executed on the computer or other programmable device to produce a computer-implemented process, thereby providing instructions for implementing the process. Figure 1 Flow or flows and / or boxes Figure 1 A step that specifies a function in one or more boxes.

[0129] Obviously, those skilled in the art can make various changes and modifications to the present application without departing from the spirit and scope of the present application. Thus, if these modifications and variations of the present application fall within the scope of the claims of the present application and their equivalents, the present application is also intended to include these modifications and variations.

Claims

1. A network security protection method, characterized in that: The method comprises: Obtain the traffic data to be detected; Inputting the traffic data to be detected into a white traffic model to obtain a first detection result, wherein the first detection result is used to indicate whether the traffic data is white traffic. The white traffic model classifies traffic based on the time series characteristics of network traffic. The white traffic is data traffic that has no threat or malicious intent during network transmission; Input the traffic data to be detected into a network application firewall (WAF) detection engine to obtain a second detection result, where the second detection result is used to indicate whether the traffic data is not identified as black traffic, where black traffic is malicious, illegal or unauthorized data traffic during network transmission, and the WAF detection engine performs traffic classification based on the WAF feature library matching traffic features; If the first detection result is different from the second detection result, extracting traffic features related to the network attack from the traffic to be detected using a feature detection model, where the feature detection model is a machine learning model for analyzing network traffic and extracting traffic features related to the network attack; The traffic characteristics and the attack load of the traffic data to be detected are transmitted to the cloud for manual analysis, and the model parameters of the WAF feature library or the white traffic model are adjusted based on the manual analysis results.

2. The method according to claim 1, characterized in that The feature detection model is obtained by training the firewall ModSecurity grammar rules, the existing WAF features and the black traffic matching the existing WAF features in a large language model.

3. The method according to claim 1, characterized in that If the first detection result is that the traffic data is black traffic, and the second detection result is that the traffic data is white traffic, transmitting the traffic features and the attack payload of the traffic data to be detected to the cloud for manual analysis, and adjusting the model parameters of the WAF feature library or the white traffic model based on the manual analysis result specifically includes: If the manual judgment result is that the traffic data to be detected is black traffic, the traffic feature is stored in the WAF feature library; If the manual judgment result is that the flow data to be detected is white flow, the model parameters of the white flow model are adjusted, and the flow characteristics are deleted.

4. The method according to claim 1 or 3, characterized in that: The method further comprises: If the hit count of the traffic feature within a preset time period is less than a preset threshold, the traffic feature is stored in the WAF feature library.

5. The method according to claim 1, characterized in that If the first detection result is that the traffic data is white traffic, and the second detection result is that the traffic data is black traffic, transmitting the traffic features and the attack payload of the traffic data to be detected to the cloud for manual analysis, and adjusting the model parameters of the WAF feature library or the white traffic model based on the manual analysis result specifically includes: If the manual judgment result is that the traffic data to be detected is black traffic, adjusting the model parameters of the white traffic model; If the manual analysis result is that the traffic data to be detected is white traffic, the traffic feature in the WAF feature library is deleted.

6. The method according to claim 1, characterized in that The method further comprises: If the first detection result is that the flow data to be detected is black flow, and the second detection result is that the flow data to be detected is black flow, the flow data to be detected is blocked from passing.

7. A network security protection device, characterized in that: The device comprises: A communication module, used for acquiring traffic data to be detected; a processing module, configured to input the traffic data to be detected into a white traffic model to obtain a first detection result, wherein the first detection result is used to indicate whether the traffic data is white traffic, wherein the white traffic model performs traffic classification based on the time series characteristics of network traffic, and the white traffic is data traffic without threat or malicious intent during network transmission; The processing module is further used to input the traffic data to be detected into a network application firewall (WAF) detection engine to obtain a second detection result, wherein the second detection result is used to indicate whether the traffic data is not identified as black traffic, wherein the black traffic is malicious, illegal or unauthorized data traffic during network transmission, and the WAF detection engine performs traffic classification based on the WAF feature library matching traffic features; The processing module is further configured to, if the first detection result is different from the second detection result, extract traffic features related to the network attack from the traffic to be detected using a feature detection model, wherein the feature detection model is a machine learning model for analyzing network traffic and extracting traffic features related to the network attack; The communication module is further used to transmit the traffic characteristics and the attack payload of the traffic data to be detected to the cloud for manual analysis; The processing module is further used to adjust the model parameters of the WAF feature library or the white traffic model based on the manual analysis result.

8. An electronic device comprising a memory, a processor and a computer program stored in the memory and executable on the processor, characterized in that: When the processor executes the computer program, the method according to any one of claims 1 to 6 is implemented.

9. A computer-readable storage medium, characterized in that: The computer-readable storage medium stores a computer program, and the computer program is used to cause the computer to execute the method according to any one of claims 1 to 6.

10. A computer program product, characterized in that When the computer program product is called by a computer, the computer executes the method according to any one of claims 1 to 6.

Images