Blocking method and device, storage medium and electronic device

Abstract

The present invention provides a blocking method and device, a storage medium and an electronic device, the method comprising: determining a blocking request set corresponding to a target blocked object; determining a confidence value corresponding to each blocking request in the blocking request set; calculating a blocking score according to the confidence value corresponding to each blocking request; judging whether the target blocked object meets the preset blocking condition according to the blocking score, and if so, performing information integration processing on each blocking request to obtain blocked object information; determining multiple blocked execution objects, generating a blocking execution request corresponding to each blocked execution object according to the request data format and blocked object information corresponding to each blocked execution object; sending each blocking execution request to its corresponding blocking execution object, so that each blocked execution object blocks the target blocked object. Applying the method of the present invention, further evaluation is performed based on the blocking request to determine whether to execute the blocking, which is conducive to reducing the false blocking rate.

Description

Technical Field

[0001] The present invention relates to the field of Internet security technology, and in particular to a blocking method and device, a storage medium and an electronic device. Background Art

[0002] The Internet has become one of the important electronic transaction channels for financial institutions. In the operation of Internet-based business platforms, it is necessary to prevent network attacks to ensure transaction security. In the security system of financial institutions, network attacks are usually prevented based on security products for detecting network attack incidents and IP ban execution systems for blocking access.

[0003] In the existing blocking process, when the security product detects a network attack of a certain threat level, the access IP corresponding to the network attack is sent to the IP blocking execution system of the relevant business platform, so that the IP blocking execution system will block the access IP, thereby blocking access.

[0004] Security products usually use a general strategy to detect network attacks. In the business scenarios of financial institutions, normal business access is often identified as a network attack. Based on the existing blocking methods, when security products identify normal business access as an attack, the IP blocking execution system will mistakenly block normal business access, affecting the normal operation of the business platform and resulting in a poor customer experience. Summary of the invention

[0005] In view of this, an embodiment of the present invention provides a blocking method to solve the problem that the existing blocking method is prone to mistakenly block normal business access in special business scenarios, affecting the normal operation of the business platform and causing poor customer experience.

[0006] The embodiment of the present invention also provides a blocking device to ensure the actual implementation and application of the above method.

[0007] To achieve the above objectives, the embodiments of the present invention provide the following technical solutions:

[0008] A blocking method, comprising:

[0009] In the case where a target banned object needs to be banned, a ban request set corresponding to the target banned object is determined; the ban request set includes at least one ban request, and each of the ban requests is a ban request submitted by each preset security product when a network attack corresponding to the target banned object is detected;

[0010] Determining a confidence value corresponding to each of the blocking requests;

[0011] Calculating a ban score corresponding to the target banned object according to the confidence value corresponding to each of the ban requests;

[0012] According to the ban score, judging whether the target banned object meets the preset ban condition;

[0013] If the target banned object meets the preset ban condition, then perform information integration processing on each of the ban requests to obtain banned object information;

[0014] Determine a plurality of banned execution objects, and determine a request data format corresponding to each banned execution object;

[0015] Generate a prohibition execution request corresponding to each of the prohibition execution objects according to the request data format corresponding to each of the prohibition execution objects and the prohibition object information;

[0016] Each of the ban execution requests is sent to its corresponding ban execution object, so that each of the ban execution objects bans the target banned object, thereby completing the ban processing process of the target banned object.

[0017] In the above method, optionally, determining the confidence value corresponding to each of the blocking requests includes:

[0018] For each of the ban requests, the ban request is parsed to obtain a confidence value included in the ban request, and the confidence value included in the ban request is used as the confidence value corresponding to the ban request.

[0019] In the above method, optionally, calculating the ban score corresponding to the target banned object according to the confidence value corresponding to each of the ban requests includes:

[0020] Determine a weight corresponding to each of the blocking requests;

[0021] According to the weights corresponding to the ban requests, the confidence values ​​corresponding to the ban requests are weighted and summed, and the calculation result is used as the ban score corresponding to the target banned object.

[0022] In the above method, optionally, determining the weight corresponding to each of the blocking requests includes:

[0023] According to the confidence value corresponding to each of the ban requests and a preset normalized exponential function, a normalized calculation is performed on the confidence value corresponding to each of the ban requests to obtain a normalized value corresponding to the confidence value corresponding to each of the ban requests, and the normalized value corresponding to the confidence value corresponding to each of the ban requests is used as the weight corresponding to each of the ban requests.

[0024] In the above method, optionally, judging whether the target banned object meets the preset ban condition based on the ban score includes:

[0025] Comparing the ban score with a preset score threshold;

[0026] If the ban score is greater than or equal to the score threshold, it is determined that the target banned object meets the preset ban condition;

[0027] If the blocking score is less than the score threshold, it is determined that the target blocking object does not meet the preset blocking condition.

[0028] In the above method, optionally, the multiple blocking execution objects include: multiple preset cloud platforms, content distribution networks CDNs, and device blocking systems; the multiple cloud platforms include private cloud type cloud platforms and public cloud type cloud platforms.

[0029] The above method may optionally further include:

[0030] If the target banned object does not meet the preset ban condition, the ban processing process of the target banned object is ended.

[0031] A blocking device, comprising:

[0032] A first determining unit is used to determine a blocking request set corresponding to the target blocked object when it is necessary to block the target blocked object; the blocking request set includes at least one blocking request, each of which is a blocking request submitted by each preset security product when a network attack corresponding to the target blocked object is detected;

[0033] A second determining unit, configured to determine a confidence value corresponding to each of the blocking requests;

[0034] A calculation unit, configured to calculate a ban score corresponding to the target banned object according to the confidence value corresponding to each of the ban requests;

[0035] A judging unit, configured to judge whether the target banned object meets a preset ban condition according to the ban score;

[0036] an integration unit, configured to integrate information of each of the blocking requests to obtain blocked object information if the target blocked object meets the preset blocking condition;

[0037] A third determining unit, configured to determine a plurality of prohibited execution objects, and determine a request data format corresponding to each prohibited execution object;

[0038] A generating unit, configured to generate a prohibition execution request corresponding to each of the prohibition execution objects according to a request data format corresponding to each of the prohibition execution objects and the prohibition object information;

[0039] The sending unit is used to send each of the ban execution requests to its corresponding ban execution object, so that each of the ban execution objects bans the target banned object and completes the ban processing process of the target banned object.

[0040] A storage medium includes stored instructions, wherein when the instructions are executed, the device where the storage medium is located is controlled to execute the above-mentioned blocking method.

[0041] An electronic device includes a memory and one or more instructions, wherein the one or more instructions are stored in the memory and configured to be executed by one or more processors as the above-mentioned blocking method.

[0042] A blocking method provided based on the above-mentioned embodiment of the present invention includes: when it is necessary to block a target blocked object, determining a blocking request set corresponding to the target blocked object; the blocking request set includes at least one blocking request, and each blocking request is a blocking request submitted by each preset security product when a network attack corresponding to the target blocked object is detected; determining a confidence value corresponding to each blocking request; calculating a blocking score corresponding to the target blocked object according to the confidence value corresponding to each blocking request; judging whether the target blocked object meets the preset blocking condition according to the blocking score; if the target blocked object meets the preset blocking condition, performing information integration processing on each blocking request to obtain blocked object information; determining multiple blocking execution objects, and determining a request data format corresponding to each blocking execution object; generating a blocking execution request corresponding to each blocking execution object according to the request data format corresponding to each blocking execution object and the blocking object information; sending each blocking execution request to its corresponding blocking execution object, so that each blocking execution object blocks the target blocked object, and completes the blocking processing process of the target blocked object. By applying the method provided by the embodiment of the present invention, when a ban request for a certain object is received, a ban score can be calculated based on all ban requests for the object, and whether to execute the ban can be determined based on the ban score. During the ban processing, whether to execute the ban not only depends on the risk identification of the security product, but also requires further evaluation of the credibility of the ban request to finally determine whether to execute the ban, which is conducive to avoiding the mistaken blocking of normal business access in special business scenarios, can reduce the error rate of the ban, and is conducive to ensuring the normal operation of the business system and improving the customer experience. BRIEF DESCRIPTION OF THE DRAWINGS

[0043] In order to more clearly illustrate the embodiments of the present invention or the technical solutions in the prior art, the drawings required for use in the embodiments or the description of the prior art will be briefly introduced below. Obviously, the drawings described below are only embodiments of the present invention. For ordinary technicians in this field, other drawings can be obtained based on the provided drawings without paying creative work.

[0044] Figure 1 A method flow chart of a blocking method provided by an embodiment of the present invention;

[0045] Figure 2 A flowchart of another method of a blocking method provided by an embodiment of the present invention;

[0046] Figure 3 An example diagram of a blocking process provided by an embodiment of the present invention;

[0047] Figure 4 A schematic diagram of the structure of a blocking device provided by an embodiment of the present invention;

[0048] Figure 5 A schematic diagram of the structure of an electronic device provided by an embodiment of the present invention. DETAILED DESCRIPTION

[0049] The following will be combined with the drawings in the embodiments of the present invention to clearly and completely describe the technical solutions in the embodiments of the present invention. Obviously, the described embodiments are only part of the embodiments of the present invention, not all of the embodiments. Based on the embodiments of the present invention, all other embodiments obtained by ordinary technicians in this field without creative work are within the scope of protection of the present invention.

[0050] In this application, the terms "comprises", "comprising" or any other variations thereof are intended to cover non-exclusive inclusion, so that a process, method, article or device comprising a series of elements includes not only those elements, but also other elements not explicitly listed, or also includes elements inherent to such process, method, article or device. In the absence of further restrictions, an element defined by the sentence "comprising a ..." does not exclude the presence of other identical elements in the process, method, article or device comprising the element.

[0051] As can be seen from the background technology, various security products usually adopt a general strategy for the detection of network attacks, that is, to identify whether a business access is a network attack according to the standards commonly used in the Internet security system. The business scenarios of financial institutions are relatively special compared to ordinary businesses based on the Internet. For example, business access to financial transactions usually carries a large amount of sensitive information. Security products often regard normal business access in financial scenarios as network attacks, and in the existing blocking process, as long as a network attack is detected, it will be blocked, resulting in normal business access being easily blocked by mistake, and the normal business transactions of customers fail, which has a negative impact on the normal service of the business system and reduces customer experience. Secondly, when a security product detects a network attack, it usually only sends the corresponding blocking request to the business platform associated with the network attack for blocking. And with the continuous escalation of network attack methods, attackers may continuously attack other business platforms in the network. In the existing blocking process, when a security product detects a network attack, it cannot be directly synchronized to all business platforms in the network, which is easy to cause blocking delays and adversely affect network security.

[0052] Therefore, an embodiment of the present invention provides a banning method. When a banning request for a target banned object is received, a confidence assessment can be further performed in combination with all banning requests for the target banned object to determine whether to ultimately execute the ban, which is beneficial to reducing the false blocking rate, ensuring the normal service of the business system, and improving customer experience.

[0053] The embodiment of the present invention provides a blocking method, which can be applied to a blocking system, and the execution subject can be a server of the system. The method flow chart of the method is as follows: Figure 1 As shown, including:

[0054] S101: When a target banned object needs to be banned, determine a ban request set corresponding to the target banned object; the ban request set includes at least one ban request, each of which is a ban request submitted by each preset security product when a network attack corresponding to the target banned object is detected;

[0055] In the method provided in the embodiment of the present invention, the blocking system can be divided into an attack detection module, a blocking forwarding module and a blocking execution module. The attack detection module includes a security product for detecting network attacks, and the blocking execution module includes various blocking execution objects, that is, the execution end that actually blocks the access object. The method provided in the embodiment of the present invention can be applied to the blocking forwarding module in the blocking system.

[0056] In the method provided by the embodiment of the present invention, a plurality of security products are pre-set in the blocking system, such as security monitoring products, intelligent security equipment systems, etc. Each security product can independently detect the service access of the service platform. When the security product regards a certain service access as a network attack, it can generate a corresponding blocking request based on the relevant information of the service access, and send the blocking request to the blocking forwarding module.

[0057] When the ban forwarding module receives the ban requests currently submitted by various security products, it can parse the banned objects targeted by each ban request. The banned objects targeted by the ban request refer to the objects requested to be banned, which are associated with the network attack corresponding to the ban request. Specifically, they can be IP addresses or MAC addresses, etc. When the objects requested to be banned by the ban requests submitted by different security products are the same, they can be integrated and regarded as one banned object. When the attack source IP or attack target IP carried in different ban requests are the same, it can be considered that the objects requested to be banned are the same. For each banned object corresponding to each current ban request, each banned object can be treated as a target banned object for banning.

[0058] In the method provided by the embodiment of the present invention, when a target banned object is banned, the ban request requesting to ban the target banned object among the currently received ban requests may be used as the ban request corresponding to the target banned object to obtain a ban request set.

[0059] It should be noted that the ban request set corresponding to the target banned object may contain only one ban request or multiple ban requests, which is determined by the number of requests for the target banned object in the ban requests submitted by each current security product. The ban requests submitted by each security product preset in the ban system are determined by the attack detection results of each security product. For the target banned object, there may be only one security product that detects its corresponding business access as a network attack, in which case its corresponding ban request set therefore contains one ban request. There may also be some security products or all security products that detect their corresponding business access as a network attack, in which case its corresponding ban request set contains multiple ban requests. The number of ban requests in the ban request set and the security product that submits the ban request are determined by the actual attack detection situation and do not affect the function of the method provided in the embodiment of the present invention.

[0060] S102: Determine a confidence value corresponding to each of the blocking requests;

[0061] In the method provided by an embodiment of the present invention, for each ban request in a ban request set, a confidence value corresponding to the ban request can be determined. The confidence value represents the confidence of the corresponding security product in detecting the network attack corresponding to the ban request. For example, it may be a value obtained by converting the alarm level according to a preset conversion rule.

[0062] S103: Calculating a ban score corresponding to the target banned object according to the confidence value corresponding to each of the ban requests;

[0063] In the method provided by the embodiment of the present invention, an evaluation strategy can be set according to actual evaluation requirements. According to the preset evaluation strategy, the ban score corresponding to the target banned object is calculated based on the confidence value corresponding to each ban request. That is, the confidence values ​​of all ban requests for the target banned object are combined to comprehensively evaluate the credibility of the attack detection results for the target banned object.

[0064] S104: judging whether the target banned object meets the preset ban condition according to the ban score;

[0065] In the method provided by the embodiment of the present invention, a blocking condition can be preset to determine how to process the blocking request of the target blocked object. During the blocking process, it can be determined whether the target blocked object meets the blocking condition by determining whether the current blocking score meets the preset blocking condition.

[0066] S105: If the target banned object meets the preset ban condition, perform information integration processing on each of the ban requests to obtain banned object information;

[0067] In the method provided by the embodiment of the present invention, if the target banned object meets the preset ban conditions, each ban request is parsed to obtain the request data of each ban request, and the information is integrated, and the same request data is merged to obtain the banned object information. For example, in the scenario of attack access from the external network to the internal network, the request data of the ban request 1 carries the attack source IP-A, the ban request 2 carries the attack source IP-A and the attack target IP-B, and the ban request 3 carries the attack source IP-A and the MAC address-C of the device that initiated the attack. The attack target IP-B is the IP of the intranet business system, and the attack source IP-A may launch attacks on other business systems. The above-mentioned ban requests are processed by information integration, and the IP of the internal business system, that is, the attack target IP-B, is filtered out, and the attack source IP-A and the MAC address-C of the device that initiated the attack are integrated, and these data are used as the banned object information. If the illegal external attack is from the intranet to the extranet, information integration is performed based on the request data of the above-mentioned blocking request, and the obtained blocking object information includes the attack target IP-B and the MAC address-C of the device that initiated the attack.

[0068] S106: determining a plurality of banned execution objects, and determining a request data format corresponding to each banned execution object;

[0069] In the method provided by the embodiment of the present invention, the request data format corresponding to each service platform in the network that can execute the ban can be pre-set, that is, the data format of the request required to be sent when requesting the service platform to execute the ban. The service platform can be a service system that provides service services, such as a cloud platform that provides various cloud services. Specifically, the banning process can be performed by the banning execution system in the service platform, and the service platform can also be a platform that specifically executes the ban. In the banning process scenario, each service platform in the network that can ban the current target banned object is used as a banning execution object, and the corresponding preset request data format is used as the request data format corresponding to each banning execution object. For example, the banning object information only includes the MAC address, and not all service platforms can perform the banning of this type of address, so the service platform that can ban the MAC address is used as the banning execution object. It should be noted that in the specific implementation process, there can be only one banning execution object in the banning process, which is determined by the platform deployment in the network and the relevant information of the current target banned object, and does not affect the function of the method provided by the embodiment of the present invention.

[0070] S107: generating a ban execution request corresponding to each of the ban execution objects according to the request data format corresponding to each of the ban execution objects and the ban object information;

[0071] In the method provided by the embodiment of the present invention, the ban execution request corresponding to each banned execution object can be encapsulated based on the request data format corresponding to each banned execution object and the banned object information. For example, the banned object information includes the attack source IP-A and the MAC address-C of the device that initiated the attack, the request data format of banned execution object A includes the attack source IP, and the request data format of banned execution object B includes the MAC address of the device that initiated the attack, then based on the attack source IP-A in the banned object information, the ban execution request corresponding to banned execution object A is encapsulated, and based on the MAC address-C of the device that initiated the attack in the banned object information, the ban execution request corresponding to banned execution object B is encapsulated.

[0072] S108: Send each of the ban execution requests to its corresponding ban execution object, so that each of the ban execution objects bans the target banned object, completing the ban processing process of the target banned object.

[0073] In the method provided by the embodiment of the present invention, for each ban execution request, the ban execution request can be sent to the ban execution object corresponding to the ban execution request. When each ban execution object receives the ban execution request, the target banned object can be banned according to the request data. Specifically, the service access associated with the target banned object can be blocked, and the corresponding IP address or MAC address can be blacklisted. When the relevant service access is received again, the ban can be directly matched and implemented to block the access again.

[0074] Based on the method provided by the embodiment of the present invention, when it is necessary to perform a banning process on the target banned object, determine the banning request set corresponding to the target banned object; determine the confidence value corresponding to each banning request in the banning request set; calculate the banning score corresponding to the target banned object according to the confidence value corresponding to each banning request; determine whether the target banned object meets the preset banning condition according to the banning score; if the target banned object meets the preset banning condition, perform information integration processing on each banning request to obtain the banned object information; determine multiple banned execution objects, and determine the request data format corresponding to each banned execution object; generate a banned execution request corresponding to each banned execution object according to the request data format corresponding to each banned execution object and the banned object information; send each banned execution request to its corresponding banned execution object, so that each banned execution object bans the target banned object, and complete the banning process of the target banned object. Applying the method provided by the embodiment of the present invention, when a banning request for an object is received, it can be evaluated whether to perform the ban based on all the banning requests for the object. In the process of blocking, whether to execute the ban not only depends on the risk identification of security products, but also requires further comprehensive evaluation of the credibility of the ban request to finally determine whether to execute the ban, which is conducive to avoiding the mistaken blocking of normal business access in special business scenarios, reducing the error rate of blocking, ensuring the normal operation of the business system, and improving customer experience. Secondly, the corresponding ban execution request can be sent to all ban execution objects that can execute the ban on the target banned object, and the ban request can be synchronized in the network, which is conducive to avoiding ban delays, further improving network security, and improving ban efficiency.

[0075] exist Figure 1 On the basis of the method shown, in the method provided by the embodiment of the present invention, the process of determining the confidence value corresponding to each of the blocking requests mentioned in step S102 includes:

[0076] For each of the ban requests, the ban request is parsed to obtain a confidence value included in the ban request, and the confidence value included in the ban request is used as the confidence value corresponding to the ban request.

[0077] In the method provided by the embodiment of the present invention, each blocking request submitted by a security product carries the detection confidence value of the security product on the network attack corresponding to the target blocked object. Each blocking request can be parsed to extract the carried confidence value as the confidence value corresponding to the blocking request.

[0078] The embodiment of the present invention provides another blocking method. Figure 1 Based on the method shown in reference Figure 2As shown in the flowchart, in the method provided by the embodiment of the present invention, the process of calculating the ban score corresponding to the target banned object according to the confidence value corresponding to each of the ban requests mentioned in step S103 includes:

[0079] S201: Determine a weight corresponding to each of the blocking requests;

[0080] In the method provided in the embodiment of the present invention, a weight determination strategy may be preset, for example, the weight may be calculated based on the confidence value, or the weight corresponding to each type of security product may be preset, and the weight may be determined based on the preset weight information. The weight corresponding to each blocking request may be determined according to the preset weight determination strategy.

[0081] S202: performing weighted sum calculation on the confidence values ​​corresponding to the ban requests according to the weights corresponding to the ban requests, and using the calculation result as the ban score corresponding to the target banned object.

[0082] In the method provided by the embodiment of the present invention, based on the weights corresponding to the ban requests, the confidence values ​​corresponding to the ban requests are weighted and summed, and the sum result is used as the ban score of the target ban object. Specifically, the ban score Z can be calculated according to the following formula:

[0083]

[0084] Where n represents the number of blocking requests in the blocking request set corresponding to the target blocking object, and y i represents the weight corresponding to the i-th ban request, x i Indicates the confidence value corresponding to the i-th ban request.

[0085] Further, based on the method provided in the above embodiment, in the method provided in the embodiment of the present invention, the process of determining the weight corresponding to each of the blocking requests mentioned in step S201 includes:

[0086] According to the confidence value corresponding to each of the ban requests and a preset normalized exponential function, a normalized calculation is performed on the confidence value corresponding to each of the ban requests to obtain a normalized value corresponding to the confidence value corresponding to each of the ban requests, and the normalized value corresponding to the confidence value corresponding to each of the ban requests is used as the weight corresponding to each of the ban requests.

[0087] In the method provided by the embodiment of the present invention, the weight corresponding to the ban request is determined by a normalized exponential function, and the normalized exponential function refers to a softmax function, which is an existing function and will not be introduced in detail here. Normalizing the confidence value corresponding to each ban request refers to calculating the softmax value corresponding to the confidence value, and the softmax value is the normalized value. The softmax value corresponding to the confidence value is used as the weight corresponding to the ban request. Specifically, it can be calculated according to the following formula:

[0088]

[0089] The meaning of each parameter in the formula is the same as that in formula 1, and can be found in the previous description.

[0090] exist Figure 1 On the basis of the method shown, an embodiment of the present invention provides another blocking method. In the method provided by the embodiment of the present invention, the process of judging whether the target blocked object meets the preset blocking condition according to the blocking score mentioned in step S104 includes:

[0091] Comparing the ban score with a preset score threshold;

[0092] If the ban score is greater than or equal to the score threshold, it is determined that the target banned object meets the preset ban condition;

[0093] If the blocking score is less than the score threshold, it is determined that the target blocking object does not meet the preset blocking condition.

[0094] In the method provided in the embodiment of the present invention, a scoring threshold can be set according to the actual banning requirements. During the banning process, the banning score corresponding to the current target banned object is compared with the preset scoring threshold. If the banning score is greater than or equal to the scoring threshold, the target banned object is deemed to meet the banning conditions; otherwise, the target banned object is deemed to not meet the banning conditions. For example, the scoring threshold can be set to 60, and when the banning score is greater than or equal to 60, it is determined that the target banned object meets the banning conditions. It should be noted that the scoring threshold can be determined based on factors such as the actual banning requirements and the evaluation method of the banning score, and does not affect the function of the method provided in the embodiment of the present invention.

[0095] Further, in Figure 1 On the basis of the method shown, in the method provided by the embodiment of the present invention, the multiple ban execution objects mentioned in step S106 include: multiple preset cloud platforms, content distribution networks CDN and device ban systems; the multiple cloud platforms include private cloud type cloud platforms and public cloud type cloud platforms.

[0096] In the method provided in the embodiment of the present invention, the blocking execution objects to which the blocking execution request can be sent include various types of cloud platforms, content delivery networks (CDNs), and device blocking systems. The cloud platform refers to the cloud that provides cloud services, which can be a private cloud or a public cloud. The device blocking system refers to a system that can block the MAC address of a device.

[0097] Based on the method provided in the embodiment of the present invention, when it is necessary to ban the target banned object, it can be automatically synchronized to the cloud, CDN side and device ban system isolated by different networks. When CDN acceleration is added to the cloud business, the local ban execution process in the cloud can only obtain the CDN source address, not the real attacker address. If the ban is executed locally, it is easy to ban the CDN source address, making normal business inaccessible. Based on the method provided in the embodiment of the present invention, the ban can be performed through the CDN side, further reducing the false blocking rate.

[0098] exist Figure 1 On the basis of the method shown, the method provided in the embodiment of the present invention further includes:

[0099] If the target banned object does not meet the preset ban condition, the ban processing process of the target banned object is ended.

[0100] In the method provided by the embodiment of the present invention, if it is determined in the judgment process of step S104 that the target banned object does not meet the ban condition, the processing process is terminated, that is, the target banned object is not banned.

[0101] In order to better illustrate the method provided by the embodiment of the present invention, in combination with actual application scenarios, the embodiment of the present invention provides another blocking method. Figure 3 The example diagram of the blocking process shown in the figure, the blocking process provided by the embodiment of the present invention mainly includes three stages: attack detection, blocking forwarding and blocking execution. The specific processing flow includes:

[0102] When the security product (security monitoring product or intelligent security device system) in the attack detection module detects a network attack, it can submit a blocking request to the blocking forwarding module according to a preset API format.

[0103] After receiving the ban requests submitted by different security products through a unified API interface, the ban forwarding module calculates the ban score through the softmax function, compares the ban score with the preset threshold, and decides whether to send a ban execution request (that is, forward the ban request).

[0104] If a ban needs to be sent (i.e., a ban execution request is sent), the data is encapsulated in the ban request format required by different ban execution objects to obtain various ban execution requests, and the ban execution requests are sent separately to different ban devices or systems. The banned object can be an IP or device MAC address.

[0105] The blocking execution module blacklists the IP or device MAC. When the attack comes again, it will directly match and block the access. The blocking execution objects in the blocking execution module can include private cloud, public cloud, content distribution network CDN, and device blocking system, etc.

[0106] In the method provided by the embodiment of the present invention, the request parameters of the blocking request submitted by the security product by calling the API interface may be as shown in Table 1:

[0107] Table 1

[0108]

[0109] Among them, one of the three items ip_src, ip_dst, and mac must be filled in, that is, at least one item is not empty. When ip_src is not empty, it means that the source IP is blocked, when ip_dst is not empty, it means that the destination IP is blocked, and when mac is not empty, it means that the block is executed when the device MAC address matches.

[0110] The API return parameters can be shown in Table 2:

[0111] Table 2

[0112]

[0113]

[0114] In the method provided in the embodiment of the present invention, the ban score is calculated by the softmax function. Assuming that an attack is banned by n security monitoring products or intelligent security device systems, the confidence value of each ban is x i First, according to the formula 2 mentioned above, calculate the softmax value y of each product (i.e. each ban) in these n products i As the weight of the ban confidence of the product, the final ban score is then calculated according to Formula 1. Since the softmax function will amplify the ban confidence, in order to reduce the service misblocking rate, the score threshold for sending a ban can be set to 60. When the threshold is greater than or equal to 60, the ban request is forwarded (i.e., a ban execution request is sent) to the ban system (ban execution object).

[0115] The method provided by the embodiment of the present invention can integrate the ban confidence values ​​submitted by different security monitoring products or intelligent security device systems, and the score calculated by the softmax function can increase the weight of the final ban score occupied by products with high confidence and reduce the weight of the final ban score occupied by products with low confidence. When a product detects a high-risk alarm, the total ban score value will not be lowered by low-risk alarms generated by other products that have not yet deployed the alarm detection rule.

[0116] Based on the method provided by the embodiment of the present invention, a unified API interface is used to simultaneously receive ban requests submitted by security monitoring products and intelligent security device systems, and a strong correlation strategy is used to reduce the false blocking rate. Ban requests can be automatically synchronized to multiple network-isolated cloud service platforms to improve ban efficiency. Ban requests can be automatically synchronized to the CDN side, and the CDN will ban the real attacker to ensure that the services on the CDN are not affected.

[0117] and Figure 1 Corresponding to the blocking method shown in FIG. 1 , an embodiment of the present invention further provides a blocking device for blocking Figure 1 The specific implementation of the method shown in is shown in the structural diagram Figure 4 As shown, including:

[0118] The first determining unit 301 is used to determine a blocking request set corresponding to the target blocked object when it is necessary to block the target blocked object; the blocking request set includes at least one blocking request, each of which is a blocking request submitted by each preset security product when a network attack corresponding to the target blocked object is detected;

[0119] A second determining unit 302, configured to determine a confidence value corresponding to each of the blocking requests;

[0120] A calculation unit 303 is used to calculate a ban score corresponding to the target banned object according to the confidence value corresponding to each of the ban requests;

[0121] A judging unit 304 is used to judge whether the target banned object meets a preset ban condition according to the ban score;

[0122] The integration unit 305 is configured to integrate the information of each of the blocking requests to obtain the blocking object information if the target blocking object meets the preset blocking condition;

[0123] The third determining unit 306 is used to determine a plurality of forbidden execution objects, and determine a request data format corresponding to each of the forbidden execution objects;

[0124] A generating unit 307, configured to generate a prohibition execution request corresponding to each prohibition execution object according to a request data format corresponding to each prohibition execution object and the prohibition object information;

[0125] The sending unit 308 is used to send each of the ban execution requests to its corresponding ban execution object, so that each of the ban execution objects bans the target banned object, thereby completing the ban processing process of the target banned object.

[0126] Based on the method and device provided by the embodiment of the present invention, when it is necessary to perform a banning process on the target banned object, determine the banning request set corresponding to the target banned object; determine the confidence value corresponding to each banning request in the banning request set; calculate the banning score corresponding to the target banned object according to the confidence value corresponding to each banning request; judge whether the target banned object meets the preset banning condition according to the banning score; if the target banned object meets the preset banning condition, perform information integration processing on each banning request to obtain the banned object information; determine multiple banned execution objects, and determine the request data format corresponding to each banned execution object; generate the banning execution request corresponding to each banned execution object according to the request data format corresponding to each banned execution object and the banned object information; send each banned execution request to its corresponding banned execution object, so that each banned execution object bans the target banned object, and complete the banning process of the target banned object. Applying the device provided by the embodiment of the present invention, when receiving a banning request for a certain object, it can evaluate whether to perform the ban based on all the banning requests for the object. In the process of blocking, whether to execute the ban not only depends on the risk identification of security products, but also requires further comprehensive evaluation of the credibility of the ban request to finally determine whether to execute the ban, which is conducive to avoiding the mistaken blocking of normal business access in special business scenarios, reducing the error rate of blocking, ensuring the normal operation of the business system, and improving customer experience. Secondly, the corresponding ban execution request can be sent to all ban execution objects that can execute the ban on the target banned object, and the ban request can be synchronized in the network, which is conducive to avoiding ban delays, further improving network security, and improving ban efficiency.

[0127] exist Figure 4 On the basis of the device shown in the figure, in the device provided by the embodiment of the present invention, the second determining unit 302 includes:

[0128] The parsing subunit is used to parse each of the ban requests, obtain the confidence value included in the ban request, and use the confidence value included in the ban request as the confidence value corresponding to the ban request.

[0129] exist Figure 4On the basis of the device shown in the figure, in the device provided by the embodiment of the present invention, the calculation unit 303 includes:

[0130] A first determining subunit, configured to determine a weight corresponding to each of the blocking requests;

[0131] The first calculation subunit is used to perform weighted sum calculation on the confidence values ​​corresponding to the ban requests according to the weights corresponding to the ban requests, and use the calculation result as the ban score corresponding to the target banned object.

[0132] exist Figure 4 On the basis of the device shown in the figure, in the device provided by the embodiment of the present invention, the first determining subunit includes:

[0133] The second calculation sub-unit is used to perform normalization calculation on the confidence value corresponding to each of the ban requests based on the confidence value corresponding to each of the ban requests and a preset normalized exponential function, to obtain a normalized value corresponding to the confidence value corresponding to each of the ban requests, and to use the normalized value corresponding to the confidence value corresponding to each of the ban requests as the weight corresponding to each of the ban requests.

[0134] exist Figure 4 On the basis of the device shown in the figure, in the device provided by the embodiment of the present invention, the judging unit 304 includes:

[0135] A comparison subunit, used for comparing the ban score with a preset score threshold;

[0136] The second determining subunit is configured to determine that the target banned object meets the preset banned condition if the ban score is greater than or equal to the score threshold; and to determine that the target banned object does not meet the preset banned condition if the ban score is less than the score threshold.

[0137] exist Figure 4 Based on the device shown, in the device provided by an embodiment of the present invention, the multiple ban execution objects include: multiple preset cloud platforms, content distribution networks CDN and device ban systems; the multiple cloud platforms include private cloud type cloud platforms and public cloud type cloud platforms.

[0138] exist Figure 4 On the basis of the device shown, the device provided in the embodiment of the present invention further includes:

[0139] The fourth determining unit is configured to terminate the blocking process of the target blocked object if the target blocked object does not meet the preset blocking condition.

[0140] An embodiment of the present invention further provides a storage medium, which includes stored instructions, wherein when the instructions are executed, the device where the storage medium is located is controlled to execute the above-mentioned blocking method.

[0141] The embodiment of the present invention further provides an electronic device, the structural diagram of which is shown in FIG. Figure 5 As shown, it specifically includes a memory 401 and one or more instructions 402, wherein the one or more instructions 402 are stored in the memory 401 and are configured to be executed by one or more processors 403 to perform the following operations:

[0142] In the case where a target banned object needs to be banned, a ban request set corresponding to the target banned object is determined; the ban request set includes at least one ban request, and each of the ban requests is a ban request submitted by each preset security product when a network attack corresponding to the target banned object is detected;

[0143] Determining a confidence value corresponding to each of the blocking requests;

[0144] Calculating a ban score corresponding to the target banned object according to the confidence value corresponding to each of the ban requests;

[0145] According to the ban score, judging whether the target banned object meets the preset ban condition;

[0146] If the target banned object meets the preset ban condition, then perform information integration processing on each of the ban requests to obtain banned object information;

[0147] Determine a plurality of banned execution objects, and determine a request data format corresponding to each banned execution object;

[0148] Generate a prohibition execution request corresponding to each of the prohibition execution objects according to the request data format corresponding to each of the prohibition execution objects and the prohibition object information;

[0149] Each of the ban execution requests is sent to its corresponding ban execution object, so that each of the ban execution objects bans the target banned object, thereby completing the ban processing process of the target banned object.

[0150] Each embodiment in this specification is described in a progressive manner, and the same or similar parts between the embodiments can refer to each other, and each embodiment focuses on the differences from other embodiments. In particular, for the system or system embodiment, since it is basically similar to the method embodiment, the description is relatively simple, and the relevant parts can refer to the partial description of the method embodiment. The system and system embodiments described above are merely schematic, wherein the units described as separate components may or may not be physically separated, and the components displayed as units may or may not be physical units, that is, they may be located in one place, or they may be distributed on multiple network units. Some or all of the modules may be selected according to actual needs to achieve the purpose of the scheme of this embodiment. Ordinary technicians in this field can understand and implement it without creative work.

[0151] Professionals may further appreciate that the units and algorithm steps of each example described in conjunction with the embodiments disclosed herein can be implemented in electronic hardware, computer software, or a combination of the two. In order to clearly illustrate the interchangeability of hardware and software, the composition and steps of each example have been generally described in the above description according to function. Whether these functions are performed in hardware or software depends on the specific application and design constraints of the technical solution. Professionals and technicians may use different methods to implement the described functions for each specific application, but such implementation should not be considered to be beyond the scope of the present invention.

[0152] The above description of the disclosed embodiments enables one skilled in the art to implement or use the present invention. Various modifications to these embodiments will be apparent to one skilled in the art, and the general principles defined herein may be implemented in other embodiments without departing from the spirit or scope of the present invention. Therefore, the present invention will not be limited to the embodiments shown herein, but rather to the widest scope consistent with the principles and novel features disclosed herein.

Claims

1. A blocking method, characterized in that: include: In the case where a target banned object needs to be banned, determining a ban request set corresponding to the target banned object; The blocking request set includes at least one blocking request, each of which is a blocking request submitted by each preset security product when a network attack corresponding to the target blocking object is detected; Determining a confidence value corresponding to each of the blocking requests; Calculating a ban score corresponding to the target banned object according to the confidence value corresponding to each of the ban requests; According to the ban score, judging whether the target banned object meets the preset ban condition; If the target banned object meets the preset ban condition, then perform information integration processing on each of the ban requests to obtain banned object information; Determine a plurality of banned execution objects, and determine a request data format corresponding to each banned execution object; Generate a prohibition execution request corresponding to each of the prohibition execution objects according to the request data format corresponding to each of the prohibition execution objects and the prohibition object information; Sending each of the ban execution requests to its corresponding ban execution object, so that each of the ban execution objects bans the target banned object, completing the ban processing process of the target banned object; The step of calculating the ban score corresponding to the target banned object according to the confidence values ​​corresponding to the ban requests includes: determining the weight corresponding to each of the ban requests; performing weighted sum calculation on the confidence values ​​corresponding to the ban requests according to the weights corresponding to the ban requests, and using the calculation result as the ban score corresponding to the target banned object; The determining of the weight corresponding to each of the ban requests includes: performing normalized calculation on the confidence value corresponding to each of the ban requests based on the confidence value corresponding to each of the ban requests and a preset normalized exponential function, obtaining a normalized value corresponding to the confidence value corresponding to each of the ban requests, and using the normalized value corresponding to the confidence value corresponding to each of the ban requests as the weight corresponding to each of the ban requests.

2. The method according to claim 1, characterized in that: The determining the confidence value corresponding to each of the blocking requests includes: For each of the ban requests, the ban request is parsed to obtain a confidence value included in the ban request, and the confidence value included in the ban request is used as the confidence value corresponding to the ban request.

3. The method according to claim 1, characterized in that: The determining, based on the ban score, whether the target banned object meets a preset ban condition includes: Comparing the ban score with a preset score threshold; If the ban score is greater than or equal to the score threshold, it is determined that the target banned object meets the preset ban condition; If the blocking score is less than the score threshold, it is determined that the target blocking object does not meet the preset blocking condition.

4. The method according to claim 1, characterized in that The multiple blocking execution objects include: multiple preset cloud platforms, content distribution networks CDNs, and device blocking systems; the multiple cloud platforms include private cloud-type cloud platforms and public cloud-type cloud platforms.

5. The method according to claim 1, characterized in that Also includes: If the target banned object does not meet the preset ban condition, the ban processing process of the target banned object is ended.

6. A blocking device, characterized in that: include: A first determining unit, configured to determine a set of blocking requests corresponding to a target blocked object when a blocking process is required for the target blocked object; The blocking request set includes at least one blocking request, each of which is a blocking request submitted by each preset security product when a network attack corresponding to the target blocking object is detected; A second determining unit, configured to determine a confidence value corresponding to each of the blocking requests; A calculation unit, configured to calculate a ban score corresponding to the target banned object according to the confidence value corresponding to each of the ban requests; A judging unit, configured to judge whether the target banned object meets a preset ban condition according to the ban score; an integration unit, configured to integrate information of each of the blocking requests to obtain blocked object information if the target blocked object meets the preset blocking condition; A third determining unit, configured to determine a plurality of prohibited execution objects, and determine a request data format corresponding to each prohibited execution object; A generating unit, configured to generate a prohibition execution request corresponding to each of the prohibition execution objects according to a request data format corresponding to each of the prohibition execution objects and the prohibition object information; A sending unit, used for sending each of the ban execution requests to its corresponding ban execution object, so that each of the ban execution objects bans the target banned object, completing the ban processing process of the target banned object; Wherein, the computing unit comprises: A first determining subunit, configured to determine a weight corresponding to each of the blocking requests; A first calculation subunit is used to perform weighted sum calculation on the confidence values ​​corresponding to the ban requests according to the weights corresponding to the ban requests, and use the calculation result as the ban score corresponding to the target banned object; The first determining subunit includes: The second calculation sub-unit is used to perform normalization calculation on the confidence value corresponding to each of the ban requests based on the confidence value corresponding to each of the ban requests and a preset normalized exponential function, to obtain a normalized value corresponding to the confidence value corresponding to each of the ban requests, and to use the normalized value corresponding to the confidence value corresponding to each of the ban requests as the weight corresponding to each of the ban requests.

7. A storage medium, characterized in that: The storage medium includes stored instructions, wherein when the instructions are executed, the device where the storage medium is located is controlled to execute the blocking method according to any one of claims 1 to 5.

8. An electronic device, characterized in that: The device comprises a memory and one or more instructions, wherein the one or more instructions are stored in the memory and configured to be executed by one or more processors to execute the blocking method according to any one of claims 1 to 5.

Images