Threat detection rule processing method and device

Abstract

The present invention discloses a method and device for processing threat detection rules. The method includes: extracting the rule name of the threat detection rule, and pre-classifying the threat detection rule based on the extracted rule name of the threat detection rule to obtain a pre-classification result; each rule category corresponds to at least one threat detection rule; for each rule category in at least one rule category, determining the attack scenario corresponding to the rule category; applying at least one threat detection rule corresponding to the rule category to the attack scenario to obtain the threat detection result corresponding to each threat detection rule in the rule category; based on the threat detection result corresponding to each threat detection rule in the rule category, verifying and adjusting the classification of the threat detection rules in the rule category. The adoption of this solution can realize the accurate classification of threat detection rules, thereby facilitating the management of threat detection rules, thereby reducing storage overhead and system overhead.

Description

Technical Field

[0001] The present invention relates to the field of security technology, and in particular to a method and device for processing threat detection rules. Background Art

[0002] With the continuous development of science and technology and society, the emergence of various computer or Internet products has greatly facilitated people's work and life. However, security threats to computers or Internet products are also constantly occurring. Therefore, in order to facilitate the timely handling of security threats and reduce user losses, it is usually necessary to implement the detection of security threats through corresponding threat detection rules.

[0003] However, during the implementation process, the inventors found that the prior art has the following defects: in the prior art, there are differences in the description of the same threat detection rule, which is not conducive to the management and use of the threat detection rule, and easily causes a waste of storage resources and system resources. Summary of the invention

[0004] In view of the above problems, the present invention is proposed to provide a method and device for processing threat detection rules that overcome the above problems or at least partially solve the above problems.

[0005] According to one aspect of the present invention, a method for processing threat detection rules is provided, which includes:

[0006] Extracting a rule name of the threat detection rule, and pre-classifying the threat detection rule based on the extracted rule name of the threat detection rule to obtain a pre-classification result; wherein the pre-classification result includes at least one rule category, and each rule category corresponds to at least one threat detection rule;

[0007] For each rule category in at least one rule category in the pre-classification result, determining an attack scenario corresponding to the rule category;

[0008] Applying at least one threat detection rule corresponding to the rule category to the attack scenario to obtain a threat detection result corresponding to each threat detection rule in the rule category;

[0009] Based on the threat detection result corresponding to each threat detection rule in the rule category, the classification of the threat detection rules in the rule category is verified and adjusted to obtain a final classification result.

[0010] According to another aspect of the present invention, there is provided a device for processing threat detection rules, comprising:

[0011] A pre-classification module, adapted to extract the rule name of the threat detection rule, and pre-classify the threat detection rule based on the extracted rule name of the threat detection rule to obtain a pre-classification result; wherein the pre-classification result includes at least one rule category, and each rule category corresponds to at least one threat detection rule;

[0012] An attack scenario determination module, adapted to determine, for each rule category in at least one rule category in the pre-classification result, an attack scenario corresponding to the rule category;

[0013] a detection result acquisition module, adapted to apply at least one threat detection rule corresponding to the rule category to the attack scenario to obtain a threat detection result corresponding to each threat detection rule in the rule category;

[0014] The verification and adjustment module is adapted to verify and adjust the classification of the threat detection rules in the rule category based on the threat detection results corresponding to each threat detection rule in the rule category to obtain a final classification result.

[0015] According to another aspect of the present invention, there is provided a computing device, comprising: a processor, a memory, a communication interface and a communication bus, wherein the processor, the memory and the communication interface communicate with each other via the communication bus;

[0016] The memory is used to store at least one executable instruction, and the executable instruction enables the processor to execute an operation corresponding to the processing method of the threat detection rule.

[0017] According to another aspect of the present invention, a computer storage medium is provided, wherein the storage medium stores at least one executable instruction, and the executable instruction enables a processor to execute operations corresponding to the above-mentioned threat detection rule processing method.

[0018] According to the method and device for processing threat detection rules provided by the present invention, the rule name of the threat detection rule is first extracted, and based on the extracted rule name of the threat detection rule, the threat detection rule is pre-classified to obtain a pre-classification result; wherein the pre-classification result contains at least one rule category, and each rule category corresponds to at least one threat detection rule; further, for each rule category in at least one rule category in the pre-classification result, the attack scenario corresponding to the rule category is determined; and then at least one threat detection rule corresponding to the rule category is applied to the attack scenario to obtain the threat detection result corresponding to each threat detection rule in the rule category; finally, based on the threat detection result corresponding to each threat detection rule in the rule category, the classification of the threat detection rule in the rule category is verified and adjusted to obtain the final classification result. The adoption of this scheme can realize the accurate classification of threat detection rules, thereby facilitating the management of threat detection rules, thereby reducing storage overhead and system overhead.

[0019] The above description is only an overview of the technical solution of the present invention. In order to more clearly understand the technical means of the present invention, it can be implemented according to the contents of the specification. In order to make the above and other purposes, features and advantages of the present invention more obvious and easy to understand, the specific implementation methods of the present invention are listed below. BRIEF DESCRIPTION OF THE DRAWINGS

[0020] Various other advantages and benefits will become apparent to those of ordinary skill in the art by reading the detailed description of the preferred embodiments below. The accompanying drawings are only for the purpose of illustrating the preferred embodiments and are not to be considered as limiting the present invention. Moreover, the same reference symbols are used throughout the accompanying drawings to represent the same components. In the accompanying drawings:

[0021] Figure 1 A flowchart of a method for processing threat detection rules provided according to an embodiment of the present invention is shown;

[0022] Figure 2 A flowchart of a method for processing threat detection rules provided according to another embodiment of the present invention is shown;

[0023] Figure 3 A functional structure diagram of a threat detection rule processing device provided according to an embodiment of the present invention is shown;

[0024] Figure 4 A schematic diagram of the structure of a computing device provided according to an embodiment of the present invention is shown. DETAILED DESCRIPTION

[0025] The exemplary embodiments of the present invention will be described in more detail below with reference to the accompanying drawings. Although the exemplary embodiments of the present invention are shown in the accompanying drawings, it should be understood that the present invention can be implemented in various forms and should not be limited by the embodiments set forth herein. On the contrary, these embodiments are provided in order to enable a more thorough understanding of the present invention and to enable the scope of the present invention to be fully communicated to those skilled in the art.

[0026] Figure 1 A flowchart of a method for processing threat detection rules provided according to an embodiment of the present invention is shown. The method is applied to a computing device with corresponding processing capabilities, and the present embodiment does not limit the type of specific computing device. For example, the method can be run as an application software in a mobile terminal device (such as a mobile phone, a tablet computer, a smart watch, etc.), or it can be run in a fixed computing device such as a server.

[0027] like Figure 1 As shown, the method comprises the following steps:

[0028] Step S110 : extracting the rule names of the threat detection rules, and pre-classifying the threat detection rules based on the extracted rule names of the threat detection rules to obtain pre-classification results.

[0029] In this embodiment, the threat detection rules can be accurately categorized, wherein this embodiment does not limit the specific types of threat detection rules. For example, the threat detection rules can be threat detection rules for terminals or threat detection rules for the network side; they can also be threat detection rules for a certain type of specific information or application, such as threat detection rules for emails and text messages, etc.

[0030] In the specific implementation process, since the rule name can reflect the core content of the threat detection rule, the present application first extracts the rule name of the threat detection rule. This embodiment does not limit the specific rule name extraction method.

[0031] Further, based on the extracted rule names of the threat detection rules, the threat detection rules are pre-classified to obtain a pre-classification result. Specifically, after extracting the rule names of the threat detection rules, this embodiment first uses the rule names to pre-classify the threat detection rules. The pre-classification result is not the final classification result. The pre-classification result includes at least one rule category, and each rule category corresponds to at least one threat detection rule.

[0032] This step can achieve preliminary classification of threat detection rules. In order to further improve the accuracy of threat detection rule classification, this embodiment further verifies and adjusts the pre-classification results through subsequent steps S120-S140 to obtain the final classification results.

[0033] Step S120: for each rule category in at least one rule category in the pre-classification result, determine the attack scenario corresponding to the rule category.

[0034] In the process of verifying and adjusting the pre-classification results, this embodiment first configures a corresponding attack scenario for each rule category in at least one rule category in the pre-classification results (e.g., the attack scenario corresponding to the "port attack" rule category may be "the number of attacks on a certain port exceeds a preset threshold"). The attack scenario can simulate real attack behaviors, and one rule category may correspond to one or more attack scenarios. This embodiment does not limit the configuration method of the attack scenario corresponding to each rule category, and those skilled in the art may configure the corresponding attack scenario for the corresponding rule category according to the actual business situation.

[0035] Step S130: Apply at least one threat detection rule corresponding to the rule category to the attack scenario to obtain a threat detection result corresponding to each threat detection rule in the rule category.

[0036] After the attack scenario corresponding to the rule category is determined, the threat detection rule corresponding to the rule category can be run in the attack scenario, thereby obtaining the threat detection result corresponding to each threat detection rule in the rule category.

[0037] For example, the attack scenario corresponding to the "port attack" rule category is "the number of attacks on a certain port exceeds a preset threshold", and in the pre-classification results, the "port attack" rule category corresponds to threat detection rule A, threat detection rule B, and threat detection rule C. In this step, in the operating environment of "the number of attacks on a certain port exceeds a preset threshold", threat detection is performed using threat detection rule A, threat detection rule B, and threat detection rule C, respectively, to obtain corresponding threat detection results.

[0038] In an optional implementation, in the process of verifying and adjusting the pre-classification results, in order to avoid affecting the actual object to be threatened and detected and improve the user experience, this embodiment may apply at least one threat detection rule corresponding to the rule category to the attack scenario in a sandbox environment to obtain the threat detection results corresponding to each threat detection rule in the rule category.

[0039] Step S140 , based on the threat detection result corresponding to each threat detection rule in the rule category, the classification of the threat detection rules in the rule category is verified and adjusted to obtain a final classification result.

[0040] After obtaining the threat detection results corresponding to each threat detection rule in the rule category, the threat detection results of each threat detection rule in the rule category are matched with the standard detection results corresponding to the rule category, so that the classification of the threat detection rules in the rule category can be verified and adjusted according to the matching results to obtain the final classification result.

[0041] Continuing with the above example, if the threat detection result corresponding to threat detection rule A matches the standard detection result corresponding to the "port attack" rule category, then the pre-classification result of threat detection rule A is determined to be accurate, and threat detection rule A is classified into the "port attack" rule category; if the threat detection result corresponding to threat detection rule B does not match the standard detection result corresponding to the "port attack" rule category, then the pre-classification result of threat detection rule B is determined to be incorrect, and threat detection rule B is no longer classified into the "port attack" rule category.

[0042] It can be seen that this embodiment first extracts the rule name of the threat detection rule, and based on the extracted rule name of the threat detection rule, pre-classifies the threat detection rule to obtain a pre-classification result; and further verifies the pre-classification result through the threat detection result of the threat detection rule corresponding to the rule category in the pre-classification result in the corresponding attack scenario, so as to obtain the final classification result. Therefore, the adoption of this solution can realize the accurate classification of threat detection rules, thereby facilitating the management of threat detection rules, and further reducing storage overhead and system overhead.

[0043] Figure 2 A flowchart of a method for processing threat detection rules according to another embodiment of the present invention is shown. The method is applied to a computing device with corresponding processing capabilities. This embodiment does not limit the type of specific computing device. For example, the method can be run as an application software in a mobile terminal device (such as a mobile phone, a tablet computer, a smart watch, etc.), or it can be run in a fixed computing device such as a server. The method for processing threat detection rules provided in this embodiment is for Figure 1 Further optimization of the method shown.

[0044] like Figure 2 As shown, the method comprises the following steps:

[0045] Step S210: extract the rule name of the threat detection rule, and based on the extracted rule name of the threat detection rule, use a machine learning model to pre-classify the threat detection rule.

[0046] In this embodiment, in order to improve the accuracy of the pre-classification result, a machine learning method is used to pre-classify the rule names of the extracted threat detection rules. The pre-classification result includes at least one rule category, and each rule category corresponds to at least one threat detection rule.

[0047] In the process of pre-classifying threat detection rules using a machine learning model, it is first necessary to construct a machine learning model. Among them, this embodiment does not limit the specific type of the machine learning model. For example, it can use a supervised machine learning algorithm to construct the machine learning model. The machine learning model may include an input layer, a connection layer, and an output layer. This embodiment does not limit the specific number of connection layers. In the initial machine learning model training process, training samples can be pre-configured. The samples may include positive samples and / or negative samples. Through the training of the training samples, when the loss function value is less than the preset loss threshold, the trained machine learning model is obtained.

[0048] Furthermore, in the process of pre-classification using the trained machine learning model, the rule name of the extracted threat detection rule can be converted into a corresponding feature vector, and then the corresponding feature vector is input into the trained machine learning model, thereby realizing the pre-classification of the threat detection rule.

[0049] Step S220, for each rule category in at least one rule category in the pre-classification result, determine the attack scenario corresponding to the rule category, and apply at least one threat detection rule corresponding to the rule category to the attack scenario to obtain a threat detection result corresponding to each threat detection rule in the rule category.

[0050] The specific implementation process of this step may refer to the description of the corresponding parts in step S120 and step S130, and will not be described in detail in this embodiment.

[0051] In an optional implementation, if in the pre-classification results, a rule category corresponds to multiple threat detection rules, and among the multiple threat detection rules, more than a preset proportion (such as 90 percent, etc.) or a preset number of threat detection rules have the same threat detection results, but the threat detection results of the threat detection rules that exceed the preset proportion or the preset number are different from the standard threat detection results corresponding to the rule category, corresponding abnormal information is fed back to adjust the standard threat detection results corresponding to the rule category, or to adjust the name of the rule category, and the threat detection rules that exceed the preset proportion or the preset number can be further clustered into a new rule category, and the category name of the new rule category is obtained according to the rule name of the threat detection rules that exceed the preset proportion or the preset number.

[0052] Step S230 , based on the threat detection result corresponding to each threat detection rule in the rule category, the classification of the threat detection rules in the rule category is verified and adjusted to obtain a final classification result.

[0053] Among them, if the threat detection result corresponding to the threat detection rule in the rule category matches the rule category, it is determined that the pre-classification verification of the threat detection rule is successful, and the pre-classification category of the threat detection rule is used as the final classification; if the threat detection result corresponding to the threat detection rule in the rule category does not match the rule category, it is determined that the pre-classification verification of the threat detection rule is unsuccessful, and the classification of the threat detection rule is adjusted. Optionally, after obtaining the final classification result, a corresponding category label can be assigned to each threat detection rule to facilitate the subsequent management and use of the threat detection rule.

[0054] Optionally, in the process of determining that the pre-classification verification of the threat detection rule is unsuccessful and adjusting the classification of the threat detection rule, in order to quickly and accurately redetermine the classification of the threat detection rule, the classification of the threat detection rule may be adjusted based on the matching degree of the threat detection result corresponding to the threat detection rule and other rule categories, and / or, based on the matching degree of the rule name of the threat detection rule and other rule categories. For example, the final classification of the threat detection rule may be determined by weighted summation based on the matching degree of the threat detection result corresponding to the threat detection rule and other rule categories and the threat detection result weight value, as well as the matching degree of the rule name of the threat detection rule and other rule categories and the rule name weight value; or, after partially deleting or supplementing the rule name of the threat detection rule (such as removing corresponding special symbols, etc.), it is re-entered into the machine learning model for pre-classification, and further verified and adjusted based on the pre-classification results.

[0055] In an optional embodiment, after obtaining the final classification result, the classification result of the verified and adjusted threat detection rule can be further fed back to the machine learning model in step S210 so that the machine learning model can adaptively adjust its relevant parameters to achieve the purpose of optimizing the machine learning model and improving the accuracy of subsequent pre-classification results.

[0056] In another optional implementation, after obtaining the final threat detection rule classification result, in order to further reduce system storage overhead and improve the convenience of users using threat detection rules, this embodiment can deduplicate the threat detection rules contained in the rule category when there are multiple threat detection rules corresponding to the rule category. In the actual implementation process, in the final classification result of this embodiment, the rule names of the threat detection rules corresponding to the same rule category are similar, and the threat detection results of the threat detection rules corresponding to the same rule category are the same, which means that the multiple threat detection rules corresponding to the same rule category in this embodiment are only different in expression, and their functions are often the same. Based on this, this embodiment can only retain a certain threat detection rule in the rule category, and can eliminate other threat detection rules in the rule category, so that after deduplication, only one threat detection rule is included in the same rule category.

[0057] It can be seen that this embodiment first extracts the rule name of the threat detection rule, and based on the extracted rule name of the threat detection rule, uses the machine learning model to pre-classify the threat detection rule to obtain accurate pre-classification results; and further verifies the pre-classification results through the threat detection results of the threat detection rules corresponding to the rule categories in the pre-classification results in the corresponding attack scenarios, so as to obtain the final classification results. Therefore, the use of this solution can achieve accurate classification of threat detection rules, thereby facilitating the management of threat detection rules, and further reducing storage overhead and system overhead; and this embodiment can deduplicate threat detection results under the same rule category, further saving system storage overhead and improving the convenience of using threat detection rules.

[0058] Figure 3 FIG. 2 is a functional structure diagram of a threat detection rule processing device according to an embodiment of the present invention. Figure 3 As shown, the device includes: a pre-classification module 31, an attack scenario determination module 32, a detection result acquisition module 33, and a verification and adjustment module 34.

[0059] A pre-classification module 31 is adapted to extract a rule name of a threat detection rule, and pre-classify the threat detection rule based on the extracted rule name of the threat detection rule to obtain a pre-classification result; wherein the pre-classification result includes at least one rule category, and each rule category corresponds to at least one threat detection rule;

[0060] An attack scenario determination module 32, adapted to determine, for each rule category in at least one rule category in the pre-classification result, an attack scenario corresponding to the rule category;

[0061] A detection result acquisition module 33, adapted to apply at least one threat detection rule corresponding to the rule category to the attack scenario to obtain a threat detection result corresponding to each threat detection rule in the rule category;

[0062] The verification and adjustment module 34 is adapted to verify and adjust the classification of the threat detection rules in the rule category based on the threat detection result corresponding to each threat detection rule in the rule category to obtain a final classification result.

[0063] Optionally, the pre-classification module 31 is further adapted to: based on the extracted rule names of the threat detection rules, use a machine learning model to pre-classify the threat detection rules.

[0064] Optionally, the pre-classification module 31 is further adapted to: convert the rule name of the extracted threat detection rule into a corresponding feature vector; and input the feature vector into the machine learning model to pre-classify the threat detection rule.

[0065] Optionally, the device also includes: a feedback module (not shown in the figure), which is suitable for feeding back the classification results of the verified and adjusted threat detection rules to the machine learning model after verifying and adjusting the classification of the threat detection rules in the rule category, so as to optimize the machine learning model.

[0066] Optionally, the verification adjustment module 34 is further adapted to: determine that the pre-classification verification of the threat detection rule is successful if the threat detection result corresponding to the threat detection rule in the rule category matches the rule category;

[0067] If the threat detection result corresponding to the threat detection rule in the rule category does not match the rule category, it is determined that the pre-classification check of the threat detection rule is unsuccessful, and the classification of the threat detection rule is adjusted.

[0068] Optionally, the verification and adjustment module 34 is further adapted to: adjust the classification of the threat detection rule according to the matching degree between the threat detection result corresponding to the threat detection rule and other rule categories, and / or according to the matching degree between the rule name of the threat detection rule and other rule categories.

[0069] Optionally, the device also includes: a deduplication module (not shown in the figure), which is suitable for deduplicating the threat detection rules contained in the rule category after the classification of the threat detection rules in the rule category is verified and adjusted, if the threat detection rules corresponding to the rule category contain multiple rules.

[0070] The specific implementation process of each device in this embodiment can be referred to Figure 1 and / or Figure 2The description of the corresponding parts in the method embodiment will not be repeated in this embodiment.

[0071] It can be seen that this embodiment first extracts the rule name of the threat detection rule, and based on the extracted rule name of the threat detection rule, pre-classifies the threat detection rule to obtain a pre-classification result; and further verifies the pre-classification result through the threat detection result of the threat detection rule corresponding to the rule category in the pre-classification result in the corresponding attack scenario, so as to obtain the final classification result. Therefore, the use of this solution can realize the accurate classification of threat detection rules, thereby facilitating the management of threat detection rules, and further reducing storage overhead and system overhead.

[0072] According to an embodiment of the present invention, a non-volatile computer storage medium is provided, wherein the computer storage medium stores at least one executable instruction, and the computer executable instruction can execute the method for processing threat detection rules in any of the above method embodiments.

[0073] The executable instructions may be specifically used to cause the processor to perform the following operations:

[0074] Extracting a rule name of the threat detection rule, and pre-classifying the threat detection rule based on the extracted rule name of the threat detection rule to obtain a pre-classification result; wherein the pre-classification result includes at least one rule category, and each rule category corresponds to at least one threat detection rule;

[0075] For each rule category in at least one rule category in the pre-classification result, determining an attack scenario corresponding to the rule category;

[0076] Applying at least one threat detection rule corresponding to the rule category to the attack scenario to obtain a threat detection result corresponding to each threat detection rule in the rule category;

[0077] Based on the threat detection result corresponding to each threat detection rule in the rule category, the classification of the threat detection rules in the rule category is verified and adjusted to obtain a final classification result.

[0078] In an optional implementation, the executable instructions may be specifically used to cause the processor to perform the following operations:

[0079] Based on the extracted rule names of the threat detection rules, a machine learning model is used to pre-classify the threat detection rules.

[0080] In an optional implementation, the executable instructions may be specifically used to cause the processor to perform the following operations:

[0081] Convert the rule names of the extracted threat detection rules into corresponding feature vectors;

[0082] The feature vector is input into the machine learning model to pre-classify threat detection rules.

[0083] In an optional implementation, the executable instructions may be specifically used to cause the processor to perform the following operations:

[0084] The classification results of the verified and adjusted threat detection rules are fed back to the machine learning model to optimize the machine learning model.

[0085] In an optional implementation, the executable instructions may be specifically used to cause the processor to perform the following operations:

[0086] If the threat detection result corresponding to the threat detection rule in the rule category matches the rule category, it is determined that the pre-classification verification of the threat detection rule is successful;

[0087] If the threat detection result corresponding to the threat detection rule in the rule category does not match the rule category, it is determined that the pre-classification check of the threat detection rule is unsuccessful, and the classification of the threat detection rule is adjusted.

[0088] In an optional implementation, the executable instructions may be specifically used to cause the processor to perform the following operations:

[0089] The classification of the threat detection rule is adjusted according to the matching degree between the threat detection result corresponding to the threat detection rule and other rule categories, and / or according to the matching degree between the rule name of the threat detection rule and other rule categories.

[0090] In an optional implementation, the executable instructions may be specifically used to cause the processor to perform the following operations:

[0091] If a rule category corresponds to multiple threat detection rules, duplicate removal is performed on the threat detection rules included in the rule category.

[0092] It can be seen that this embodiment first extracts the rule name of the threat detection rule, and based on the extracted rule name of the threat detection rule, uses the machine learning model to pre-classify the threat detection rule to obtain accurate pre-classification results; and further verifies the pre-classification results through the threat detection results of the threat detection rules corresponding to the rule categories in the pre-classification results in the corresponding attack scenarios, so as to obtain the final classification results. Therefore, the use of this solution can achieve accurate classification of threat detection rules, thereby facilitating the management of threat detection rules, and further reducing storage overhead and system overhead; and this embodiment can deduplicate threat detection results under the same rule category, further saving system storage overhead and improving the convenience of using threat detection rules.

[0093] Figure 4 A schematic diagram of the structure of a computing device provided according to an embodiment of the present invention is shown, and the specific embodiment of the present invention does not limit the specific implementation of the computing device.

[0094] like Figure 4 As shown, the computing device may include: a processor (processor) 402 , a communications interface (Communications Interface) 404 , a memory (memory) 406 , and a communication bus 408 .

[0095] The processor 402, the communication interface 404, and the memory 406 communicate with each other via the communication bus 408. The communication interface 404 is used to communicate with other devices such as a client or other server network elements. The processor 402 is used to execute the program 410, which can specifically execute the relevant steps in the above-mentioned embodiment of the processing method for threat detection rules.

[0096] Specifically, the program 410 may include program codes, which include computer operation instructions.

[0097] The processor 402 may be a central processing unit (CPU), or an application-specific integrated circuit (ASIC), or one or more integrated circuits configured to implement the embodiments of the present invention. The one or more processors included in the computing device may be processors of the same type, such as one or more CPUs, or may be processors of different types, such as one or more CPUs and one or more ASICs.

[0098] The memory 406 is used to store the program 410. The memory 406 may include a high-speed RAM memory, and may also include a non-volatile memory (non-volatile memory), such as at least one disk memory.

[0099] The program 410 may be specifically configured to enable the processor 402 to perform the following operations:

[0100] Extracting a rule name of the threat detection rule, and pre-classifying the threat detection rule based on the extracted rule name of the threat detection rule to obtain a pre-classification result; wherein the pre-classification result includes at least one rule category, and each rule category corresponds to at least one threat detection rule;

[0101] For each rule category in at least one rule category in the pre-classification result, determining an attack scenario corresponding to the rule category;

[0102] Applying at least one threat detection rule corresponding to the rule category to the attack scenario to obtain a threat detection result corresponding to each threat detection rule in the rule category;

[0103] Based on the threat detection result corresponding to each threat detection rule in the rule category, the classification of the threat detection rules in the rule category is verified and adjusted to obtain a final classification result.

[0104] In an optional implementation, the program 410 may be specifically configured to enable the processor 402 to perform the following operations:

[0105] Based on the extracted rule names of the threat detection rules, a machine learning model is used to pre-classify the threat detection rules.

[0106] In an optional implementation, the program 410 may be specifically configured to enable the processor 402 to perform the following operations:

[0107] Convert the rule names of the extracted threat detection rules into corresponding feature vectors;

[0108] The feature vector is input into the machine learning model to pre-classify threat detection rules.

[0109] In an optional implementation, the program 410 may be specifically configured to enable the processor 402 to perform the following operations:

[0110] The classification results of the verified and adjusted threat detection rules are fed back to the machine learning model to optimize the machine learning model.

[0111] In an optional implementation, the program 410 may be specifically configured to enable the processor 402 to perform the following operations:

[0112] If the threat detection result corresponding to the threat detection rule in the rule category matches the rule category, it is determined that the pre-classification verification of the threat detection rule is successful;

[0113] If the threat detection result corresponding to the threat detection rule in the rule category does not match the rule category, it is determined that the pre-classification check of the threat detection rule is unsuccessful, and the classification of the threat detection rule is adjusted.

[0114] In an optional implementation, the program 410 may be specifically configured to enable the processor 402 to perform the following operations:

[0115] The classification of the threat detection rule is adjusted according to the matching degree between the threat detection result corresponding to the threat detection rule and other rule categories, and / or according to the matching degree between the rule name of the threat detection rule and other rule categories.

[0116] In an optional implementation, the program 410 may be specifically configured to enable the processor 402 to perform the following operations:

[0117] If a rule category corresponds to multiple threat detection rules, duplicate removal is performed on the threat detection rules included in the rule category.

[0118] It can be seen that this embodiment first extracts the rule name of the threat detection rule, and based on the extracted rule name of the threat detection rule, uses the machine learning model to pre-classify the threat detection rule to obtain accurate pre-classification results; and further verifies the pre-classification results through the threat detection results of the threat detection rules corresponding to the rule categories in the pre-classification results in the corresponding attack scenarios, so as to obtain the final classification results. Therefore, the use of this solution can achieve accurate classification of threat detection rules, thereby facilitating the management of threat detection rules, and further reducing storage overhead and system overhead; and this embodiment can deduplicate threat detection results under the same rule category, further saving system storage overhead and improving the convenience of using threat detection rules.

[0119] The algorithm or display provided herein is not inherently related to any particular computer, virtual system or other equipment. Various general purpose systems can also be used together with the teachings based on this. According to the above description, it is obvious to construct the structure required for this type of system. In addition, the embodiment of the present invention is not directed to any specific programming language yet. It should be understood that various programming languages ​​can be utilized to realize the content of the present invention described herein, and the description made to specific languages ​​above is for disclosing the best mode of the present invention.

[0120] In the description provided herein, a large number of specific details are described. However, it is understood that embodiments of the present invention can be practiced without these specific details. In some instances, well-known methods, structures and techniques are not shown in detail so as not to obscure the understanding of this description.

[0121] Similarly, it should be understood that in order to streamline the present invention and aid in understanding one or more of the various inventive aspects, in the above description of exemplary embodiments of the present invention, the various features of the embodiments of the present invention are sometimes grouped together into a single embodiment, figure, or description thereof. However, this disclosed method should not be interpreted as reflecting the following intention: that the claimed invention requires more features than the features explicitly recited in each claim. More specifically, as reflected in the claims below, inventive aspects lie in less than all the features of the individual embodiments disclosed above. Therefore, the claims that follow the specific embodiment are hereby expressly incorporated into the specific embodiment, with each claim itself serving as a separate embodiment of the present invention.

[0122] Those skilled in the art will appreciate that the modules in the devices in the embodiments may be adaptively changed and arranged in one or more devices different from the embodiments. The modules or units or components in the embodiments may be combined into one module or unit or component, and in addition they may be divided into a plurality of submodules or subunits or subcomponents. Except that at least some of such features and / or processes or units are mutually exclusive, all features disclosed in this specification (including the accompanying claims, abstracts and drawings) and all processes or units of any method or device disclosed in this manner may be combined in any combination. Unless otherwise expressly stated, each feature disclosed in this specification (including the accompanying claims, abstracts and drawings) may be replaced by an alternative feature providing the same, equivalent or similar purpose.

[0123] In addition, those skilled in the art will appreciate that, although some embodiments herein include certain features included in other embodiments but not other features, the combination of features of different embodiments is meant to be within the scope of the present invention and form different embodiments. For example, in the claims below, any one of the claimed embodiments may be used in any combination.

[0124] The various component embodiments of the present invention can be implemented in hardware, or in software modules running on one or more processors, or in a combination thereof. It should be understood by those skilled in the art that a microprocessor or digital signal processor (DSP) can be used in practice to implement some or all functions of some or all components according to embodiments of the present invention. The present invention can also be implemented as a device or apparatus program (e.g., computer program and computer program product) for executing part or all of the methods described herein. Such a program implementing the present invention can be stored on a computer-readable medium, or can have the form of one or more signals. Such a signal can be downloaded from an Internet website, or provided on a carrier signal, or provided in any other form.

[0125] It should be noted that the above embodiments illustrate the present invention rather than limit it, and that those skilled in the art may devise alternative embodiments without departing from the scope of the appended claims. In the claims, any reference symbol between brackets shall not be construed as a limitation on the claims. The word "comprising" does not exclude the presence of elements or steps not listed in the claims. The word "one" or "an" preceding an element does not exclude the presence of a plurality of such elements. The present invention may be implemented by means of hardware comprising a number of different elements and by means of a suitably programmed computer. In a unit claim enumerating a number of devices, several of these devices may be embodied by the same hardware item. The use of the words first, second, and third, etc. does not indicate any order. These words may be interpreted as names. The steps in the above embodiments, unless otherwise specified, should not be understood as limitations on the order of execution.

[0126] The present invention discloses: A1. A method for processing threat detection rules, comprising:

[0127] Extracting a rule name of the threat detection rule, and pre-classifying the threat detection rule based on the extracted rule name of the threat detection rule to obtain a pre-classification result; wherein the pre-classification result includes at least one rule category, and each rule category corresponds to at least one threat detection rule;

[0128] For each rule category in at least one rule category in the pre-classification result, determining an attack scenario corresponding to the rule category;

[0129] Applying at least one threat detection rule corresponding to the rule category to the attack scenario to obtain a threat detection result corresponding to each threat detection rule in the rule category;

[0130] Based on the threat detection result corresponding to each threat detection rule in the rule category, the classification of the threat detection rules in the rule category is verified and adjusted to obtain a final classification result.

[0131] A2. The method according to A1, wherein the pre-classifying the threat detection rules based on the rule names of the extracted threat detection rules further comprises:

[0132] Based on the extracted rule names of the threat detection rules, a machine learning model is used to pre-classify the threat detection rules.

[0133] A3. The method according to A2, wherein the pre-classifying the threat detection rules based on the rule names of the extracted threat detection rules further comprises:

[0134] Convert the rule names of the extracted threat detection rules into corresponding feature vectors;

[0135] The feature vector is input into the machine learning model to pre-classify threat detection rules.

[0136] A4. The method according to A2 or A3, wherein after verifying and adjusting the classification of the threat detection rules in the rule category, the method further comprises:

[0137] The classification results of the verified and adjusted threat detection rules are fed back to the machine learning model to optimize the machine learning model.

[0138] A5. A method according to any one of A1-A4, wherein the verifying and adjusting the classification of the threat detection rules in the rule category based on the threat detection results corresponding to each threat detection rule in the rule category further comprises:

[0139] If the threat detection result corresponding to the threat detection rule in the rule category matches the rule category, it is determined that the pre-classification verification of the threat detection rule is successful;

[0140] If the threat detection result corresponding to the threat detection rule in the rule category does not match the rule category, it is determined that the pre-classification check of the threat detection rule is unsuccessful, and the classification of the threat detection rule is adjusted.

[0141] A6. The method according to A5, wherein adjusting the classification of the threat detection rule further comprises:

[0142] The classification of the threat detection rule is adjusted according to the matching degree between the threat detection result corresponding to the threat detection rule and other rule categories, and / or according to the matching degree between the rule name of the threat detection rule and other rule categories.

[0143] A7. A method according to any one of A1-A6, wherein after verifying and adjusting the classification of the threat detection rule in the rule category, the method further comprises:

[0144] If a rule category corresponds to multiple threat detection rules, duplicate removal is performed on the threat detection rules included in the rule category.

[0145] The present invention also discloses: B8. A device for processing threat detection rules, comprising:

[0146] A pre-classification module, adapted to extract the rule name of the threat detection rule, and pre-classify the threat detection rule based on the extracted rule name of the threat detection rule to obtain a pre-classification result; wherein the pre-classification result includes at least one rule category, and each rule category corresponds to at least one threat detection rule;

[0147] An attack scenario determination module, adapted to determine, for each rule category in at least one rule category in the pre-classification result, an attack scenario corresponding to the rule category;

[0148] a detection result acquisition module, adapted to apply at least one threat detection rule corresponding to the rule category to the attack scenario to obtain a threat detection result corresponding to each threat detection rule in the rule category;

[0149] The verification and adjustment module is adapted to verify and adjust the classification of the threat detection rules in the rule category based on the threat detection results corresponding to each threat detection rule in the rule category to obtain a final classification result.

[0150] B9. An apparatus according to B8, wherein the pre-classification module is further adapted to: pre-classify the threat detection rules based on the rule names of the extracted threat detection rules using a machine learning model.

[0151] B10. The apparatus according to B9, wherein the pre-classification module is further adapted to: convert the rule name of the extracted threat detection rule into a corresponding feature vector;

[0152] The feature vector is input into the machine learning model to pre-classify threat detection rules.

[0153] B11. The device according to B9 or B10, wherein the device further comprises:

[0154] The feedback module is adapted to feed back the classification results of the threat detection rules after verification and adjustment to the machine learning model to optimize the machine learning model.

[0155] B12. The apparatus according to any one of B8-B11, wherein the calibration adjustment module is further adapted to:

[0156] If the threat detection result corresponding to the threat detection rule in the rule category matches the rule category, it is determined that the pre-classification verification of the threat detection rule is successful;

[0157] If the threat detection result corresponding to the threat detection rule in the rule category does not match the rule category, it is determined that the pre-classification check of the threat detection rule is unsuccessful, and the classification of the threat detection rule is adjusted.

[0158] B13. The apparatus according to B12, wherein the calibration adjustment module is further adapted to:

[0159] The classification of the threat detection rule is adjusted according to the matching degree between the threat detection result corresponding to the threat detection rule and other rule categories, and / or according to the matching degree between the rule name of the threat detection rule and other rule categories.

[0160] B14. The device according to any one of B8-B13, wherein the device further comprises:

[0161] The deduplication module is adapted to perform deduplication processing on the threat detection rules contained in the rule category after checking and adjusting the classification of the threat detection rules in the rule category, if the threat detection rules corresponding to the rule category include multiple rules.

[0162] The present invention also discloses: C15. A computing device, comprising: a processor, a memory, a communication interface and a communication bus, wherein the processor, the memory and the communication interface communicate with each other via the communication bus;

[0163] The memory is used to store at least one executable instruction, and the executable instruction enables the processor to perform operations corresponding to the method for processing threat detection rules as described in any one of A1-A7.

[0164] The present invention also discloses: D16. A computer storage medium, wherein at least one executable instruction is stored in the storage medium, and the executable instruction enables a processor to execute an operation corresponding to the method for processing threat detection rules as described in any one of A1-A7.

Claims

1. A method for processing threat detection rules, comprising: Extracting a rule name of the threat detection rule, and pre-classifying the threat detection rule based on the extracted rule name of the threat detection rule to obtain a pre-classification result; wherein the pre-classification result includes at least one rule category, and each rule category corresponds to at least one threat detection rule; For each rule category in at least one rule category in the pre-classification result, determining an attack scenario corresponding to the rule category; Applying at least one threat detection rule corresponding to the rule category to the attack scenario to obtain a threat detection result corresponding to each threat detection rule in the rule category; Based on the threat detection result corresponding to each threat detection rule in the rule category, verify and adjust the classification of the threat detection rules in the rule category to obtain a final classification result; The checking and adjusting the classification of the threat detection rules in the rule category based on the threat detection result corresponding to each threat detection rule in the rule category to obtain a final classification result includes: If the threat detection result corresponding to the threat detection rule in the rule category does not match the rule category, it is determined that the pre-classification check of the threat detection rule is unsuccessful. The final classification of the threat detection rule is determined by weighted summation based on the matching degree of the threat detection result corresponding to the threat detection rule with other rule categories and the threat detection result weight value, as well as the matching degree of the rule name of the threat detection rule with other rule categories and the rule name weight value.

2. The method according to claim 1, wherein: The pre-classifying the threat detection rules based on the extracted rule names of the threat detection rules further includes: Based on the extracted rule names of the threat detection rules, a machine learning model is used to pre-classify the threat detection rules.

3. The method according to claim 2, wherein: The pre-classifying the threat detection rules based on the extracted rule names of the threat detection rules further includes: Convert the rule names of the extracted threat detection rules into corresponding feature vectors; The feature vector is input into the machine learning model to pre-classify threat detection rules.

4. The method according to claim 2 or 3, wherein: After verifying and adjusting the classification of the threat detection rules in the rule category, the method further includes: The classification results of the verified and adjusted threat detection rules are fed back to the machine learning model to optimize the machine learning model.

5. The method according to any one of claims 1 to 4, wherein: The verifying and adjusting the classification of the threat detection rules in the rule category based on the threat detection result corresponding to each threat detection rule in the rule category further includes: If the threat detection result corresponding to the threat detection rule in the rule category matches the rule category, it is determined that the pre-classification verification of the threat detection rule is successful; If the threat detection result corresponding to the threat detection rule in the rule category does not match the rule category, it is determined that the pre-classification check of the threat detection rule is unsuccessful, and the classification of the threat detection rule is adjusted.

6. The method according to claim 5, wherein: The adjusting the classification of the threat detection rule further includes: The classification of the threat detection rule is adjusted according to the matching degree between the threat detection result corresponding to the threat detection rule and other rule categories, and / or according to the matching degree between the rule name of the threat detection rule and other rule categories.

7. The method according to any one of claims 1 to 6, wherein: After verifying and adjusting the classification of the threat detection rules in the rule category, the method further includes: If a rule category corresponds to multiple threat detection rules, duplicate removal is performed on the threat detection rules included in the rule category.

8. A threat detection rule processing device, comprising: A pre-classification module, adapted to extract the rule name of the threat detection rule, and pre-classify the threat detection rule based on the extracted rule name of the threat detection rule to obtain a pre-classification result; wherein the pre-classification result includes at least one rule category, and each rule category corresponds to at least one threat detection rule; An attack scenario determination module, adapted to determine, for each rule category in at least one rule category in the pre-classification result, an attack scenario corresponding to the rule category; a detection result acquisition module, adapted to apply at least one threat detection rule corresponding to the rule category to the attack scenario to obtain a threat detection result corresponding to each threat detection rule in the rule category; A verification and adjustment module is suitable for verifying and adjusting the classification of threat detection rules in the rule category based on the threat detection results corresponding to each threat detection rule in the rule category to obtain a final classification result; the verification and adjustment of the classification of threat detection rules in the rule category based on the threat detection results corresponding to each threat detection rule in the rule category to obtain a final classification result includes: if the threat detection result corresponding to the threat detection rule in the rule category does not match the rule category, it is determined that the pre-classification verification of the threat detection rule is unsuccessful, and the final classification of the threat detection rule is determined by weighted summation according to the matching degree of the threat detection result corresponding to the threat detection rule with other rule categories and the threat detection result weight value, as well as the matching degree of the rule name of the threat detection rule with other rule categories and the rule name weight value.

9. The device according to claim 8, wherein: The pre-classification module is further adapted to: pre-classify the threat detection rules using a machine learning model based on the extracted rule names of the threat detection rules.

10. The device according to claim 9, wherein: The pre-classification module is further adapted to: convert the rule name of the extracted threat detection rule into a corresponding feature vector; The feature vector is input into the machine learning model to pre-classify threat detection rules.

11. The device according to claim 9 or 10, wherein: The device also includes: The feedback module is adapted to feed back the classification result of the threat detection rule after verification and adjustment to the machine learning model to optimize the machine learning model after verification and adjustment of the classification of the threat detection rule in the rule category.

12. The device according to any one of claims 8 to 11, wherein: The calibration adjustment module is further adapted to: If the threat detection result corresponding to the threat detection rule in the rule category matches the rule category, it is determined that the pre-classification verification of the threat detection rule is successful; If the threat detection result corresponding to the threat detection rule in the rule category does not match the rule category, it is determined that the pre-classification check of the threat detection rule is unsuccessful, and the classification of the threat detection rule is adjusted.

13. The device according to claim 12, wherein: The calibration adjustment module is further adapted to: The classification of the threat detection rule is adjusted according to the matching degree between the threat detection result corresponding to the threat detection rule and other rule categories, and / or according to the matching degree between the rule name of the threat detection rule and other rule categories.

14. The device according to any one of claims 8 to 13, wherein: The device also includes: The deduplication module is adapted to perform deduplication processing on the threat detection rules contained in the rule category after checking and adjusting the classification of the threat detection rules in the rule category, if the threat detection rules corresponding to the rule category include multiple rules.

15. A computing device comprising: A processor, a memory, a communication interface and a communication bus, wherein the processor, the memory and the communication interface communicate with each other via the communication bus; The memory is used to store at least one executable instruction, and the executable instruction enables the processor to execute an operation corresponding to the method for processing threat detection rules according to any one of claims 1 to 7.

16. A computer storage medium, wherein at least one executable instruction is stored in the storage medium, and the executable instruction enables a processor to execute an operation corresponding to the method for processing threat detection rules according to any one of claims 1 to 7.

Images