A method and system for converting WAF rules to IPS rules

Abstract

The application provides a method and system for converting WAF rules to IPS rules, including reading WAF rules; the WAF rules include a plurality of phrase sets; parsing all phrase sets, defining the identification rules and processing actions of each phrase in the phrase sets to obtain a lexical file; defining phrase combinations between all phrases and conversion actions between phrase combinations to obtain a syntax file; generating lexical conversion code according to the lexical file and exporting to a lexical interface; generating syntax conversion code according to the syntax file and exporting to a syntax interface; generating a WAF rule conversion program according to the lexical interface, the syntax interface and an internal interface; and converting the WAF rules to IPS rules according to the IPS rule format obtained in advance through the WAF rule conversion program. Thus, after extracting the lexical file and the syntax file from the WAF rules, the WAF rules can be efficiently converted to IPS rules through the conversion program with only a small amount of code.

Description

Technical Field

[0001] This application relates to the field of web security, and in particular to a method and system for converting WAF rules to IPS rules. Background Technology

[0002] An IPS (Intrusion Prevention System) is a technology for maintaining web security. It monitors the network data transmission behavior of networks or network devices and maintains web security by immediately interrupting, adjusting, or isolating abnormal and dangerous network data transmission behavior. The advantage of IPS lies in its general web attack detection, but it cannot provide targeted protection.

[0003] With the development of the internet, web attacks are becoming increasingly diverse, and protection by IPS alone is insufficient. Therefore, it is necessary to improve the targeting capabilities of IPS to enhance its web attack detection capabilities. To this end, the highly targeted nature of WAF (Web Application Firewall) can be leveraged by converting WAF rules into IPS rules, enabling IPS to possess the web attack detection capabilities required by WAF rules.

[0004] Currently, converting WAF rules to IPS rules is done by writing code, which requires referring to the semantics of the WAF rules. The advantage of this method is its simplicity and ease of operation in rule parsing and conversion. However, WAF rules are very complex, with a total of 194 attributes. Therefore, generating escape codes for WAF rules is a huge undertaking, and the escape codes have low extensibility and are verbose, resulting in a long implementation cycle for converting a WAF rule to an IPS rule.

[0005] In summary, the existing methods for converting WAF rules into IPS rules are too inefficient and not conducive to rapidly enhancing the web attack detection capabilities of IPS. Summary of the Invention

[0006] This application provides a method and system for converting WAF rules to IPS rules, which can be used to solve the technical problem that the existing methods for converting WAF rules to IPS rules are too inefficient and not conducive to rapidly enhancing the web attack detection capabilities of IPS.

[0007] Firstly, this application provides a method for converting WAF rules to IPS rules, the method comprising:

[0008] Read WAF rules; the WAF rules include multiple phrase sets; wherein, the phrase sets include variable phrase sets, operator phrase sets, and action phrase sets; the variable phrase set includes multiple variable phrases; the operator phrase set includes multiple operator phrases; the action phrase set includes multiple action phrases;

[0009] Parse all phrase sets, define the recognition rules for each phrase in the phrase sets and the processing actions for each phrase, and obtain the lexical file;

[0010] Define all phrase combinations and the transformation actions between phrase combinations to obtain a syntax file;

[0011] Generate lexical conversion code based on the lexical file, and export the lexical conversion code to the lexical interface;

[0012] Generate syntax conversion code based on the syntax file, and export the syntax conversion code to the syntax interface;

[0013] A WAF rule conversion program is generated based on the lexical interface, the syntax interface, and the internal interface; the internal interface is an interface that provides services to the lexical interface and the syntax interface.

[0014] The WAF rule conversion program converts the WAF rules into IPS rules according to the pre-acquired IPS rule format.

[0015] In one possible implementation of the first aspect, parsing all phrase sets, defining the recognition rules for each phrase in the phrase sets and the processing actions for each phrase, and obtaining a lexical file includes:

[0016] Define a lexical declaration; the lexical declaration is used to parse external functions or variables that are invoked in WAF rules;

[0017] Define a regular expression for each word group, and a processing action for each word group; the regular expression is used to identify the word group.

[0018] Define the start function that begins parsing all phrase sets, and the end function that ends parsing all phrase sets;

[0019] The lexical declaration, the regular expression, the processing action, the start call function, and the end call function are collectively defined as the lexical file.

[0020] In one possible implementation of the first aspect, defining the regular expression for each phrase and the processing action for each phrase includes:

[0021] Define the regular expression for each variable phrase, and the processing action for each variable phrase;

[0022] Define the regular expression for each operator phrase, and the processing action for each operator phrase;

[0023] Define the regular expression for each action phrase, and the action to be processed for each action phrase.

[0024] In one possible implementation of the first aspect, the definition of all phrase combinations and the transformation actions between phrase combinations yields a grammar file, including:

[0025] Define the semantic parameters for each phrase set; the semantic parameters include phrase declaration symbols, phrase semantic value data type sets, phrase specification start symbols, and other declarations;

[0026] Define grammar rules; the grammar rules include all word combinations and the transformation actions between word combinations;

[0027] Configure the implementation code of the external function;

[0028] The semantic parameters, the syntax rules, and the implementation code are collectively defined as the syntax file.

[0029] In one possible implementation of the first aspect, generating lexical conversion code based on the lexical file and exporting the lexical conversion code to the lexical interface includes:

[0030] A lexical rule source file is generated based on the lexical file; the lexical rule source file includes the lexical transformation code.

[0031] Export the lexical transformation code from the lexical rule source file to the lexical interface.

[0032] In one possible implementation of the first aspect, generating a lexical rule source file from the lexical file includes:

[0033] Configure the flex tool;

[0034] Set up the lexical rule source file to generate code;

[0035] Code is generated based on the lexical file and the lexical rule source file, and the lexical rule source file is generated using the flex tool.

[0036] In one possible implementation of the first aspect, generating syntax transformation code based on the syntax file and exporting the syntax transformation code to the syntax interface includes:

[0037] A syntax rule source file is generated based on the syntax file; the syntax rule source file includes the syntax transformation code.

[0038] Export the syntax transformation code from the syntax rule source file to the syntax interface.

[0039] In one possible implementation of the first aspect, generating a grammar rule source file based on the grammar file includes:

[0040] Configure the Bison tool;

[0041] Set syntax rules to generate code from source files;

[0042] Code is generated based on the grammar file and the grammar rule source file, and the grammar rule source file is generated using the Bison tool.

[0043] In one possible implementation of the first aspect, generating the WAF rule conversion program based on the lexical interface, the syntax interface, and the internal interface includes:

[0044] Set up the compilation tools;

[0045] The compilation tool is used to package and compile the lexical interface, the syntax interface, and the internal interface to generate the WAF rule conversion program.

[0046] Secondly, this application provides a system for converting WAF rules to IPS rules, the system being used to execute a method for converting WAF rules to IPS rules as described in the first aspect and various implementable methods, the system comprising:

[0047] The WAF rule reading module is used to read WAF rules; the WAF rules include multiple phrase sets; wherein, the phrase sets include variable phrase sets, operator phrase sets, and action phrase sets; the variable phrase set includes multiple variable phrases; the operator phrase set includes multiple operator phrases; the action phrase set includes multiple action phrases.

[0048] The lexical file definition module is used to parse all phrase sets, define the recognition rules for each phrase in the phrase set and the processing actions for each phrase, and obtain the lexical file.

[0049] The grammar file definition module is used to define all word combinations and the transformation actions between word combinations to obtain the grammar file;

[0050] The lexical conversion code generation module is used to generate lexical conversion code based on the lexical file and export the lexical conversion code to the lexical interface;

[0051] The syntax conversion code generation module is used to generate syntax conversion code based on the syntax file and export the syntax conversion code to the syntax interface;

[0052] The WAF rule conversion program generation module is used to generate a WAF rule conversion program based on the lexical interface, the syntax interface, and the internal interface; the internal interface is an interface that provides services to the lexical interface and the syntax interface.

[0053] The IPS rule conversion module is used to convert the WAF rules into IPS rules according to the pre-acquired IPS rule format through the WAF rule conversion program.

[0054] This application provides a method and system for converting WAF rules to IPS rules. The method includes reading WAF rules; the WAF rules include multiple phrase sets; wherein, the phrase sets include variable phrase sets, operator phrase sets, and action phrase sets; the variable phrase sets include multiple variable phrases; the operator phrase sets include multiple operator phrases; the action phrase sets include multiple action phrases; parsing all phrase sets, defining the recognition rules for each phrase in the phrase sets and the processing actions for each phrase, to obtain a lexical file; defining phrase combinations between all phrases, and the conversion actions between phrase combinations, to obtain a syntax file; generating lexical conversion code based on the lexical file, and exporting the lexical conversion code to a lexical interface; generating syntax conversion code based on the syntax file, and exporting the syntax conversion code to a syntax interface; generating a WAF rule conversion program based on the lexical interface, the syntax interface, and an internal interface; the internal interface is an interface that provides services to the lexical interface and the syntax interface; and converting the WAF rules into IPS rules according to a pre-acquired IPS rule format through the WAF rule conversion program.

[0055] As can be seen from the above technical solution, this application extracts the lexical and grammar files from the WAF rules and then converts the WAF rules into IPS rules through a conversion program. In this way, only a small amount of code is needed to efficiently convert WAF rules into IPS rules. Attached Figure Description

[0056] To more clearly illustrate the technical solution of this application, the drawings used in the embodiments will be briefly introduced below. Obviously, for those skilled in the art, other drawings can be obtained based on these drawings without creative effort.

[0057] Figure 1 A flowchart of a method for converting WAF rules to IPS rules provided in this application;

[0058] Figure 2 A schematic diagram illustrating the WAF rule conversion program for a method of converting WAF rules to IPS rules provided in this application;

[0059] Figure 3 A schematic diagram illustrating the code processing logic for converting existing WAF rules to IPS rules;

[0060] Figure 4 This diagram illustrates the code call relationships for converting existing WAF rules to IPS rules.

[0061] Figure 5 A diagram illustrating the code derivation of the existing WAF rule to IPS rule conversion method;

[0062] Figure 6 A schematic diagram of the code processing logic for a method of converting WAF rules to IPS rules provided in this application;

[0063] Figure 7 This is a schematic diagram illustrating the rule definition for a method of converting WAF rules to IPS rules provided in this application. Detailed Implementation

[0064] To make the objectives, technical solutions, and advantages of this application clearer, the embodiments of this application will be described in further detail below with reference to the accompanying drawings.

[0065] The terminology used in the following embodiments is for the purpose of describing particular embodiments only and is not intended to be limiting of this application. As used in the specification and appended claims of this application, the singular expressions “a,” “an,” “the,” “the,” “the,” and “this” are intended to also include expressions such as “one or more,” unless the context clearly indicates otherwise. It should also be understood that in the following embodiments of this application, “at least one,” “one or more” refers to one, two, or more than two, and “multiple” refers to two or more. The term “and / or” is used to describe the relationship between related objects, indicating that three relationships can exist; for example, A and / or B can indicate: A alone, A and B simultaneously, or B alone, where A and B can be singular or plural. The character “ / ” generally indicates that the preceding and following related objects are in an “or” relationship.

[0066] References to "one embodiment" or "some embodiments" as described in this specification mean that one or more embodiments of this application include a specific feature, structure, or characteristic described in connection with that embodiment. Therefore, the phrases "in one embodiment," "in some embodiments," "in other embodiments," "in still other embodiments," etc., appearing in different parts of this specification do not necessarily refer to the same embodiment, but rather mean "one or more, but not all, embodiments," unless otherwise specifically emphasized. The terms "comprising," "including," "having," and variations thereof mean "including but not limited to," unless otherwise specifically emphasized.

[0067] The first embodiment of this application discloses a method for converting WAF rules to IPS rules. The method for converting WAF rules to IPS rules disclosed in the first embodiment of this application will be described in detail below with reference to the accompanying drawings.

[0068] See Figure 1 The flowchart below illustrates a method for converting WAF rules to IPS rules, as provided in this application.

[0069] Depend on Figure 1 As can be seen, the method for converting WAF rules to IPS rules provided in the first embodiment of this application includes:

[0070] Step 101: Read the WAF rules; the WAF rules include multiple phrase sets; wherein, the phrase sets include the variable phrase set VARIABLES, the operator phrase set OPERATOR, and the action phrase set ACTIONS; the variable phrase set VARIABLES includes multiple variable phrases VARIABLE; the operator phrase set OPERATOR includes multiple operator phrases OPERATOR; the action phrase set ACTIONS includes multiple action phrases ACTION.

[0071] In this embodiment, the phrase set can refer to the phrase set in the CRS core rule set. The CRS core rule set contains 110 variable phrases (VARIABLE), 37 operator phrases (OPERATOR), and 48 action phrases (ACTION), totaling 194 phrases. The WAF rule may contain at most the same number of phrases as the CRS core rule set.

[0072] Step 102: Parse all phrase sets, define the recognition rules for each phrase in the phrase set and the processing actions for each phrase, and obtain the lexical file;

[0073] In this embodiment of the application, step 102 parses all phrase sets, defines the recognition rules for each phrase in the phrase set and the processing actions for each phrase, and obtains a lexical file, including:

[0074] Step 201, define a lexical declaration; the lexical declaration is used to parse external functions or variables that can be called in WAF rules;

[0075] In this embodiment of the application, this part is enclosed in %{ and %} and defines the variables and function declarations for generating WAF rules. Its purpose is to parse the external functions or variables that can be called in the WAF rules.

[0076] Step 202: Define the regular expression for each word group and the processing action for each word group; the regular expression is used to identify the word group.

[0077] In this embodiment, this section begins and ends with a %% indicator. It defines the processing action to be performed if a certain phrase appears in the WAF rules. The regular expression is a regular expression matching condition used to identify the type of the appearing phrase.

[0078] Specifically, the regular expression defining each word group, and the processing action for each word group, include:

[0079] Step 2021: Define the regular expression for each variable phrase and the processing action for each variable phrase;

[0080] In this embodiment of the application, if the WAF rule has 110 variable phrases VARIABLE, then it is necessary to define regular expression matching conditions and related conversion and processing actions for these 110 variable phrases VARIABLE.

[0081] Step 2022: Define the regular expression for each operator phrase and the processing action for each operator phrase;

[0082] In this embodiment of the application, if the WAF rule has 37 operator phrases, then it is necessary to define regular expression matching conditions and related conversion and processing actions for these 37 operator phrases.

[0083] Step 2023: Define the regular expression for each action phrase and the processing action for each action phrase.

[0084] In this embodiment of the application, if the WAF rule has 48 action phrases, then it is necessary to define regular expression matching conditions and related conversion and processing actions for these 48 action phrases.

[0085] In this embodiment of the application, this part only needs to define the corresponding transformation and processing actions for the phrases in the rules. The definition of the combination relationship between phrases will be defined in the syntax analysis step.

[0086] Step 203: Define the start function for parsing all phrase sets and the end function for parsing all phrase sets.

[0087] In this embodiment, this part directly copies the C code from the DOC analyzer.

[0088] For example, the following defines a start function to begin parsing all phrase sets and a finish function to end parsing all phrase sets:

[0089]

[0090] Step 204: The lexical declaration, the regular expression, the processing action, the start call function, and the end call function are collectively determined as the lexical file.

[0091] In this embodiment, the process of determining the lexical file only requires defining the recognition rules and corresponding processing actions for each phrase appearing in the WAF rules, in preparation for subsequent syntax analysis. Furthermore, since phrase recognition is accomplished through regular expressions, new phrases can be added at any time using regular expressions, resulting in strong scalability.

[0092] Step 103: Define all word combinations and the conversion actions between word combinations to obtain the syntax file;

[0093] In this embodiment of the application, step 103 defines all phrase combinations and the conversion actions between each phrase combination to obtain a grammar file, including:

[0094] Step 301: Define the semantic parameters for each phrase set; the semantic parameters include phrase declaration symbols, phrase semantic value data type sets, phrase specification start symbols, and other declarations;

[0095] In this embodiment, this part is enclosed in %{ and %}, and mainly includes the declaration symbols related to WAF rule semantics, the set of semantic value data types, the definition of the specified start symbol and other declarations, etc. The text block exists between %{ and %} and is copied as is to the syntax generation file.

[0096] Step 302, define grammar rules; the grammar rules include word combinations between all word groups, and transformation actions between word combinations;

[0097] In this embodiment of the application, this part begins with %% and ends with %% and defines the relevant processing actions when encountering words or phrases appearing in certain WAF rules.

[0098] For example, when encountering the syntax of an action and the actions processed in sequence, it is as follows:

[0099]

[0100] Step 303: Set the implementation code for the external function;

[0101] In this embodiment of the application, this part can be directly copied word for word to the end of the generated code file for implementing some previously declared functions.

[0102] For example, the implementation code of the external function is set as follows:

[0103] void yy::seclang_parser::error(const location_type&1,const std::string&m){

[0104] driver.error(l,m);

[0105] }

[0106] Step 304: The semantic parameters, the syntax rules, and the implementation code are collectively determined as the syntax file.

[0107] In this embodiment, the syntax file mainly defines the word combinations appearing in WAF rules and the actions for converting between these word combinations. By defining semantics through rules, the amount of code for conversion can be greatly reduced.

[0108] See Figure 2 This is a schematic diagram of the WAF rule conversion program for a method of converting WAF rules to IPS rules provided in this application.

[0109] Depend on Figure 2 As can be seen, in this embodiment of the application, the WAF rule conversion program is generated through the following steps:

[0110] Step 104: Generate lexical conversion code based on the lexical file, and export the lexical conversion code to the lexical interface;

[0111] In this embodiment of the application, step 104 specifically includes:

[0112] Step 401: Generate a lexical rule source file based on the lexical file; the lexical rule source file includes the lexical conversion code;

[0113] Step 401, which generates a lexical rule source file based on the lexical file, includes:

[0114] Step 4011, set the flex tool;

[0115] Step 4012: Set up the code to generate the lexical rule source file;

[0116] In this embodiment of the application, the command for generating code using the Flex tool is: flex waf.l, which will generate the waf.lex.c file.

[0117] Step 4013: Generate code based on the lexical file and the lexical rule source file, and generate the lexical rule source file using the flex tool.

[0118] In this embodiment of the application, the flex tool generates the lexical rule source file seclang-scanner.cc according to the command flex waf.l.

[0119] Step 402: Export the lexical transformation code in the lexical rule source file to the lexical interface.

[0120] Step 105: Generate syntax conversion code based on the syntax file, and export the syntax conversion code to the syntax interface;

[0121] In this embodiment of the application, step 105 specifically includes:

[0122] Step 501: Generate a syntax rule source file based on the syntax file; the syntax rule source file includes the syntax transformation code;

[0123] Step 501, which generates a syntax rule source file based on the syntax file, includes:

[0124] Step 5011, set up the Bison tool;

[0125] Step 5012: Set the syntax rules source file to generate code;

[0126] In this embodiment of the application, the command for generating code using the bison tool is: bison waf.y, which will generate waf.tab.c and waf.tab.h files.

[0127] Step 5013: Generate code based on the grammar file and the grammar rule source file, and generate the grammar rule source file using the bison tool.

[0128] In this embodiment of the application, the bison tool generates the lexical rule source files seclang-parser.cc and seclang-parser.hh according to the command bison waf.y.

[0129] Step 502: Export the syntax transformation code in the syntax rule source file to the syntax interface.

[0130] Step 106: Generate a WAF rule conversion program based on the lexical interface, the syntax interface, and the internal interface; the internal interface is an interface that provides services to the lexical interface and the syntax interface.

[0131] In this embodiment of the application, step 106, which involves generating a WAF rule conversion program based on the lexical interface, the syntax interface, and the internal interface, includes:

[0132] Step 601, set up the compilation tools;

[0133] In this embodiment of the application, the compilation tool may be gcc.

[0134] Step 602: Using the compilation tool, the lexical interface, the syntax interface, and the internal interface are packaged and compiled to generate the WAF rule conversion program.

[0135] Step 107: The WAF rules are converted into IPS rules according to the pre-acquired IPS rule format through the WAF rule conversion program.

[0136] To better illustrate the beneficial effects of this application, the following describes the code processing logic for converting WAF rules to IPS rules using existing pure code:

[0137] See Figure 3 This is a schematic diagram of the code processing logic for converting existing WAF rules to IPS rules;

[0138] Depend on Figure 3 As can be seen, in the existing pure code writing logic, the rule file, i.e., the WAF rule file, is loaded first; then the following steps are executed:

[0139] Step 1: When a WAF rule is loaded, the parse module is first called to parse the rule;

[0140] Step 2: In the parse module, based on the composition of the rule, first parse the action field and save the action field information into the rule structure;

[0141] Step 3: If the action contains a transaction attribute, then the transaction attribute needs to be parsed.

[0142] Step 4: Parse the Variable attribute in the rule and save it in the Variable information of the rule;

[0143] Step 5: Parse the matching methods (operators) of the rules and save them to the rule information;

[0144] Step 6: Then, summarize the action, variable, and operator information into rule information and format it as an IPS rule.

[0145] See Figure 4 This is a diagram illustrating the code call relationships for converting existing WAF rules to IPS rules.

[0146] Depend on Figure 4 It is evident that when performing the conversion using pure code, it is necessary to implement separate code for parsing different phrases based on the structure of the WAF rules. For example, separate code is needed for parsing action, transaction, variable, and operators. Furthermore, the aforementioned code needs to implement features such as... Figure 4 The call relationship is shown.

[0147] See Figure 5 This is a schematic diagram illustrating the code derivation of the existing WAF rule to IPS rule conversion method;

[0148] Depend on Figure 5 As can be seen, pure code implementation requires implementing base classes for three categories: Action, Variable, and Operator. Then, based on actual functionality, 110 VARIABLES variable phrase subclasses, 37 OPERATOR operator phrase subclasses, and 47 Action phrase subclasses are derived. Because WAF rules involve 110 VARIABLES variable phrases, 37 OPERATOR operator phrases, and 47 Action phrases, this method, using parse to connect the rule transformation logic, results in a very large amount of code.

[0149] The following, with reference to the accompanying diagrams, illustrates the specific implementation effects of the WAF rule to IPS rule conversion method provided in this application:

[0150] See Figure 6 This is a schematic diagram of the code processing logic for a method of converting WAF rules to IPS rules provided in this application;

[0151] Depend on Figure 6 As can be seen, this application uses flex and bison for encoding, and the specific logic is as follows:

[0152] Step 1: After loading the WAF rules, read one of the rules and then call the Drvier class to parse and transform the WAF rules;

[0153] Step 2: In the Driver class function, the parse function is called. This function performs two operations: first, it performs lexical analysis on the rule;

[0154] In this embodiment, Driver is a class function that only needs to provide callback functions during lexical and syntactic parsing and transformation processes, especially for the new structured rule data after rule transformation is complete. Figure 6 As can be seen above, the conversion process is handled by lexical analysis and syntax analysis according to rules, which is very simple to implement.

[0155] Step 3, the second step of the Parse function is to perform syntax parsing;

[0156] Step 4: After the syntax parsing is complete, the Driver's addSecRule function will be called back;

[0157] Step 5: In the addSecRule function, we can already obtain the various semantic information that the rule needs to embody. At the same time, the rule information has been saved in the internal data structure. The IPS rule can be obtained by formatting the IPS rule.

[0158] See Figure 7 This is a schematic diagram of the rule definition for a method of converting WAF rules to IPS rules provided in this application;

[0159] Depend on Figure 7 As can be seen, the process of converting WAF rules to IPS rules in this application is not implemented by manually writing code. Instead, it involves defining lexical and syntactic rules for 110 VARIABLES variable phrases, 37 OPERATOR operator phrases, and 47 Action phrases within the WAF rules, and then automatically generating the code using Flex and Bison. Thus, the amount of code involved in the entire conversion process is minimal, and the expression form for defining the rules is simple. Furthermore, this invention uses only one engine to achieve functional detection for both IDS / IPS and WAF, avoiding redundant traffic parsing in the business logic and preventing the need for multiple matching of the same traffic when using multiple engines, resulting in simpler matching logic.

[0160] As can be seen from the above technical solution, this application provides a method and system for converting WAF rules to IPS rules. The method includes reading WAF rules; the WAF rules include multiple phrase sets; wherein, the phrase sets include variable phrase sets, operator phrase sets, and action phrase sets; the variable phrase set includes multiple variable phrases; the operator phrase set includes multiple operator phrases; the action phrase set includes multiple action phrases; parsing all phrase sets, defining the recognition rules for each phrase in the phrase sets and the processing actions for each phrase, to obtain a lexical file; defining phrase combinations between all phrases, The process involves converting between word combinations to obtain a lexical file; generating lexical conversion code based on the lexical file and exporting the lexical conversion code to the lexical interface; generating syntax conversion code based on the syntax file and exporting the syntax conversion code to the syntax interface; generating a WAF rule conversion program based on the lexical interface, the syntax interface, and the internal interface; the internal interface is an interface that provides services to the lexical interface and the syntax interface; and converting the WAF rules into IPS rules according to the pre-acquired IPS rule format through the WAF rule conversion program.

[0161] This application extracts lexical and grammar files from WAF rules and then converts the WAF rules into IPS rules using a conversion program. Thus, by defining lexical rules using Flex, the lexical structure of the WAF rules and the actions for converting these phrases are defined, resulting in high scalability, ease of maintenance, and high efficiency. Similarly, by defining grammar rules using Bison, the combination of WAF rules and their conversion actions are defined, also resulting in high scalability, ease of maintenance, and high efficiency. Finally, the conversion of WAF rules is completed by combining Bison and Flex. In summary, the method for converting WAF rules to IPS rules in this application has less code, higher overall efficiency, and is easier to maintain and extend.

[0162] Corresponding to the method for converting WAF rules to IPS rules provided in the first embodiment of this application, the second embodiment of this application provides a system for converting WAF rules to IPS rules, the system comprising:

[0163] The WAF rule reading module is used to read WAF rules; the WAF rules include multiple phrase sets; wherein, the phrase sets include variable phrase sets, operator phrase sets, and action phrase sets; the variable phrase set includes multiple variable phrases; the operator phrase set includes multiple operator phrases; the action phrase set includes multiple action phrases.

[0164] The lexical file definition module is used to parse all phrase sets, define the recognition rules for each phrase in the phrase set and the processing actions for each phrase, and obtain the lexical file.

[0165] The grammar file definition module is used to define all word combinations and the transformation actions between word combinations to obtain the grammar file;

[0166] The lexical conversion code generation module is used to generate lexical conversion code based on the lexical file and export the lexical conversion code to the lexical interface;

[0167] The syntax conversion code generation module is used to generate syntax conversion code based on the syntax file and export the syntax conversion code to the syntax interface;

[0168] The WAF rule conversion program generation module is used to generate a WAF rule conversion program based on the lexical interface, the syntax interface, and the internal interface; the internal interface is an interface that provides services to the lexical interface and the syntax interface.

[0169] The IPS rule conversion module is used to convert the WAF rules into IPS rules according to the pre-acquired IPS rule format through the WAF rule conversion program.

[0170] The effects of the above-mentioned device in the execution of the method can be found in the description of the method above, and will not be repeated here.

[0171] Other embodiments of the invention will readily occur to those skilled in the art upon consideration of the specification and practice of the invention disclosed herein. This application is intended to cover any variations, uses, or adaptations of the invention that follow the general principles of the invention and include common knowledge or customary techniques in the art not disclosed herein; the specification and examples are to be considered exemplary only, and the true scope and spirit of the invention are indicated by the following claims.

[0172] It should be understood that the present invention is not limited to the precise structure described above and shown in the accompanying drawings, and various modifications and changes can be made without departing from its scope; the scope of the invention is limited only by the appended claims.

Claims

1. A method for converting WAF rules to IPS rules, the method comprising: receiving a WAF rule; determining a corresponding IPS rule for the WAF rule; and outputting the corresponding IPS rule. The method includes: Read WAF rules; the WAF rules include multiple phrase sets; wherein, the phrase sets include variable phrase sets, operator phrase sets, and action phrase sets; the variable phrase set includes multiple variable phrases; the operator phrase set includes multiple operator phrases; the action phrase set includes multiple action phrases; Parse all phrase sets, define the recognition rules for each phrase in the phrase sets and the processing actions for each phrase, and obtain the lexical file; Define all phrase combinations and the transformation actions between phrase combinations to obtain a syntax file; Generate lexical conversion code based on the lexical file, and export the lexical conversion code to the lexical interface; Generate syntax conversion code based on the syntax file, and export the syntax conversion code to the syntax interface; A WAF rule conversion program is generated based on the lexical interface, the syntax interface, and the internal interface; the internal interface is an interface that provides services to the lexical interface and the syntax interface. The WAF rule conversion program converts the WAF rules into IPS rules according to the pre-acquired IPS rule format.

2. The method of claim 1, wherein, The process involves parsing all phrase sets, defining the recognition rules for each phrase in the phrase set, and defining the processing actions for each phrase, resulting in a lexical file, including: Define a lexical declaration; the lexical declaration is used to parse external functions or variables that are invoked in WAF rules; Define a regular expression for each word group, and a processing action for each word group; the regular expression is used to identify the word group. Define the start function that begins parsing all phrase sets, and the end function that ends parsing all phrase sets; The lexical declaration, the regular expression, the processing action, the start call function, and the end call function are collectively defined as the lexical file.

3. The method of claim 2, wherein, The regular expression defining each phrase, and the processing action for each phrase, include: Define the regular expression for each variable phrase, and the processing action for each variable phrase; Define the regular expression for each operator phrase, and the processing action for each operator phrase; Define the regular expression for each action phrase, and the action to be processed for each action phrase.

4. The method for converting WAF rules to IPS rules according to claim 2, wherein, The definition of all phrase combinations and the transformation actions between phrase combinations results in a grammar file, including: Define the semantic parameters for each phrase set; the semantic parameters include phrase declaration symbols, phrase semantic value data type sets, phrase specification start symbols, and other declarations; Define grammar rules; the grammar rules include all word combinations and the transformation actions between word combinations; Configure the implementation code of the external function; The semantic parameters, the syntax rules, and the implementation code are collectively defined as the syntax file.

5. The method of claim 1, wherein, The step of generating lexical conversion code based on the lexical file and exporting the lexical conversion code to the lexical interface includes: A lexical rule source file is generated based on the lexical file; the lexical rule source file includes the lexical transformation code. Export the lexical transformation code from the lexical rule source file to the lexical interface.

6. The method for converting WAF rules to IPS rules according to claim 5, wherein, The step of generating a lexical rule source file based on the lexical file includes: Configure the flex tool; Set up the lexical rule source file to generate code; Code is generated based on the lexical file and the lexical rule source file, and the lexical rule source file is generated using the flex tool.

7. The method for converting WAF rules to IPS rules according to claim 1, characterized in that, The step of generating syntax conversion code based on the syntax file and exporting the syntax conversion code to the syntax interface includes: A syntax rule source file is generated based on the syntax file; the syntax rule source file includes the syntax transformation code. Export the syntax transformation code from the syntax rule source file to the syntax interface.

8. The method for converting WAF rules to IPS rules according to claim 7, wherein, The step of generating a syntax rule source file based on the syntax file includes: Configure the Bison tool; Set syntax rules to generate code from source files; Code is generated based on the grammar file and the grammar rule source file, and the grammar rule source file is generated using the Bison tool.

9. The method of claim 1, wherein, The step of generating a WAF rule conversion program based on the lexical interface, the syntax interface, and the internal interface includes: Set up the compilation tools; The compilation tool is used to package and compile the lexical interface, the syntax interface, and the internal interface to generate the WAF rule conversion program.

10. A system for converting WAF rules to IPS rules, the system comprising: The system is used to execute a method for converting WAF rules to IPS rules as described in any one of claims 1-9, the system comprising: The WAF rule reading module is used to read WAF rules; the WAF rules include multiple phrase sets; wherein, the phrase sets include variable phrase sets, operator phrase sets, and action phrase sets; the variable phrase set includes multiple variable phrases; the operator phrase set includes multiple operator phrases; the action phrase set includes multiple action phrases. The lexical file definition module is used to parse all phrase sets, define the recognition rules for each phrase in the phrase set and the processing actions for each phrase, and obtain the lexical file. The grammar file definition module is used to define all word combinations and the transformation actions between word combinations to obtain the grammar file; The lexical conversion code generation module is used to generate lexical conversion code based on the lexical file and export the lexical conversion code to the lexical interface; The syntax conversion code generation module is used to generate syntax conversion code based on the syntax file and export the syntax conversion code to the syntax interface; The WAF rule conversion program generation module is used to generate a WAF rule conversion program based on the lexical interface, the syntax interface, and the internal interface; the internal interface is an interface that provides services to the lexical interface and the syntax interface. The IPS rule conversion module is used to convert the WAF rules into IPS rules according to the pre-acquired IPS rule format through the WAF rule conversion program.

Images