Firewall control method and device, storage medium and firewall equipment

Abstract

The present disclosure relates to a firewall control method and device, a storage medium and a firewall device to guarantee the normality of data transmission services as much as possible. The method comprises: acquiring running data of the main firewall; predicting the running data by a pre-trained state prediction model to obtain a prediction state parameter output by the state prediction model for representing a performance state of the main firewall; and in response to the prediction state parameter satisfying an early warning condition, controlling the main firewall to send an announcement packet at an early warning sending frequency, wherein the early warning sending frequency is greater than a sending frequency of the main firewall in a normal primary-backup state.

Description

TECHNICAL FIELD

[0001] The present disclosure relates to the technical field of network, in particular, to a firewall control method and device, a storage medium and a firewall equipment. BACKGROUND

[0002] The firewall is of great significance to network security and is widely used in networks. In the dual-machine hot backup architecture of the firewall, the normal master-slave state is the basic guarantee for the normal operation of the network. However, the master-slave election mechanism of the currently used protocol can only ensure that the master-slave state is normal in most cases, and lacks reliable guarantee measures for special scenarios, which makes the abnormal switching between the firewall devices easy to occur and affects the normal data transmission business. SUMMARY

[0003] The purpose of the present disclosure is to provide a firewall control method, device, storage medium and firewall equipment, which can improve the efficiency of date input and improve the versatility.

[0004] In order to achieve the above-mentioned purpose, in a first aspect, the present disclosure provides a firewall control method applied to a master firewall in a dual-machine hot backup architecture, the method comprising:

[0005] obtaining running data of the master firewall;

[0006] predicting the running data by using a pre-trained state prediction model to obtain a prediction state parameter output by the state prediction model, the prediction state parameter being used to represent the performance state of the master firewall;

[0007] in response to the prediction state parameter satisfying an early warning condition, controlling the master firewall to send an announcement packet at an early warning sending frequency, wherein the early warning sending frequency is greater than the sending frequency of the master firewall in a normal master-slave state.

[0008] Optionally, the step of controlling the master firewall to send an announcement packet at an early warning sending frequency comprises:

[0009] determining a target early warning sending frequency corresponding to the prediction state parameter according to the association relationship between the state parameter and the early warning sending frequency;

[0010] controlling the master firewall to send an announcement packet at the target early warning sending frequency.

[0011] Optionally, the state prediction model comprises an encoder, a decoder and a state parameter calculator, and the step of predicting the running data by using a pre-trained state prediction model to obtain the prediction state parameter output by the state prediction model comprises:

[0012] processing each sub-running data included in the running data by using the encoder to obtain a latent variable;

[0013] processing the latent variable by the decoder to obtain the reconstruction data corresponding to each sub-operation data;

[0014] processing the each sub-operation data and the reconstruction data corresponding to the each sub-operation data by the state parameter calculator to obtain the predicted state parameter.

[0015] Optionally, the training method of the state prediction model comprises:

[0016] obtaining a sample data set, the sample data set comprising a plurality of operation data of the main firewall in a normal master-backup state;

[0017] processing each sample sub-operation data included in one sample operation data in the sample data by a to-be-trained encoder to obtain a latent variable corresponding to the sample operation data;

[0018] processing the latent variable corresponding to the sample operation data by a to-be-trained decoder to obtain reconstruction data corresponding to each sample sub-operation data included in the sample operation data;

[0019] constructing a loss function based on the difference between the each sample sub-operation data and the reconstruction data corresponding to the each sample sub-operation data, and performing one update on model parameters in the to-be-trained encoder and the to-be-trained decoder by minimizing the loss function, so that the state prediction model is obtained after multiple updates of the to-be-trained encoder and the to-be-trained decoder.

[0020] Optionally, the encoder is represented as: h = σ e (W e x + b e );

[0021] the decoder is represented as: y = σ d (W d h + b d );

[0022] the state parameter calculator is represented as:

[0023] wherein, x represents operation data, x i represents the i-th sub-operation data included in the operation data, h represents the latent variable of the hidden layer, y represents reconstruction data, y i represents the reconstruction data corresponding to the i-th sub-operation data, S represents the state parameter, σ e is a nonlinear transformation function of the encoder, σ d is a nonlinear transformation function of the decoder, W eis a weight of the encoder, W d is a weight of the decoder, b e is a bias of the encoder, b d is a bias of the decoder, n represents a number of sub-operation data included in the operation data.

[0024] Optionally, the method further comprises:

[0025] determining that the predicted state parameter satisfies a preset condition when the predicted state parameter is greater than a preset warning threshold;

[0026] controlling the master firewall to send the announcement packet at a sending frequency in a normal master-standby state when the predicted state parameter is less than a preset recovery threshold, wherein the preset recovery threshold is less than or equal to the preset warning threshold.

[0027] Optionally, the method further comprises:

[0028] obtaining a plurality of predicted state parameters output by a state parameter calculator in a state prediction model training process;

[0029] determining a preset warning threshold and / or a preset recovery threshold based on a distribution of the plurality of predicted state parameters.

[0030] Optionally, the method further comprises:

[0031] in a case where the master firewall receives an announcement packet, obtaining packet information of the received announcement packet;

[0032] determining a state of a master-standby switchover of the master firewall based on the packet information, the state of the master-standby switchover including an abnormal switchover state and a normal switchover state;

[0033] when it is determined that the state of the master-standby switchover is the abnormal switchover state, sending a target packet to a target network device connected to the master firewall and the standby firewall, the target packet being used to refresh a neighbor table of the target network device, wherein the refreshed neighbor table records an interface of the master firewall, and / or

[0034] when it is determined that the state of the master-standby switchover is the abnormal switchover state, increasing a sending frequency of the master firewall in sending the announcement packet, wherein the increased sending frequency is greater than a sending frequency in a normal master-standby state.

[0035] Optionally, the determining the state of the master-standby switchover of the master firewall based on the packet information comprises:

[0036] when the received announcement message is a preset-protocol-compliant announcement message sent by a backup firewall in the dual-machine hot backup architecture, and the priority of the backup firewall is equal to the priority of the master firewall, if the IP address of the backup firewall interface is less than or equal to the IP address of the master firewall interface, the state of the master-backup switchover is determined as an abnormal switchover state.

[0037] when the received announcement message is a preset-protocol-compliant announcement message sent by a backup firewall in the dual-machine hot backup architecture, and the priority of the backup firewall is equal to the priority of the master firewall, if the IP address of the backup firewall interface is less than or equal to the IP address of the master firewall interface, the state of the master-backup switchover is determined as an abnormal switchover state.

[0038] Optionally, the method further comprises:

[0039] when the state of the master-backup switchover is determined as an abnormal switchover state, obtaining abnormal operation data of the master firewall;

[0040] predicting, by a pre-trained state prediction model, the abnormal operation data to obtain a candidate state parameter output by the state prediction model;

[0041] if the candidate state parameter satisfies a preset condition, generating a network diagnosis report based on the abnormal operation data;

[0042] if the candidate state parameter does not satisfy the preset condition, generating an indication of an external network fault or generating an indication of optimizing the pre-trained state prediction model.

[0043] Optionally, the operation data comprises at least one of CPU occupancy, memory utilization, service port traffic data, fan rotation speed, and hardware packet loss data.

[0044] In a second aspect, the present disclosure provides a firewall control device applied to a master firewall in a dual-machine hot backup architecture, the device comprising:

[0045] a first obtaining module configured to obtain operation data of the master firewall;

[0046] a prediction module configured to predict, by a pre-trained state prediction model, the operation data to obtain a prediction state parameter output by the state prediction model and used to represent a performance state of the master firewall;

[0047] a first control module configured to, in response to the prediction state parameter satisfying an early warning condition, control the master firewall to send an announcement message at an early warning sending frequency, wherein the early warning sending frequency is greater than a sending frequency of the master firewall in a normal master-backup state.

[0048] In a third aspect, the present disclosure provides a non-transitory computer readable storage medium having stored thereon a computer program, which when executed by a processor, implements the steps of the method of any one of the first aspect.

[0049] In a fourth aspect, the present disclosure provides a firewall device, comprising:

[0050] a memory having stored thereon a computer program;

[0051] a processor configured to execute the computer program in the memory to implement the steps of the method of any one of the first aspect.

[0052] Through the above technical solution, the running data of the main firewall can be acquired and processed by the state prediction model obtained by pre-training to obtain the prediction state parameters corresponding to the main firewall, and when the prediction state parameters meet the preset condition, the announcement message is sent at a frequency greater than the sending frequency of the main firewall in the normal master-slave state, so that the occurrence of abnormal switching can be effectively prevented, and the normal data transmission service is ensured as much as possible.

[0053] Other features and advantages of the present disclosure will be described in detail in the following detailed description. BRIEF DESCRIPTION OF DRAWINGS

[0054] The accompanying drawings are included to provide a further understanding of the present disclosure and constitute a part of the specification, and are used together with the following detailed description to explain the present disclosure, but do not constitute a limitation on the present disclosure. In the drawings:

[0055] Figure 1 is a flowchart of a firewall control method according to an exemplary embodiment of the present disclosure;

[0056] Figure 2 is a structural schematic diagram of a firewall according to an exemplary embodiment of the present disclosure;

[0057] Figure 3 is a flowchart of step S120 according to an exemplary embodiment of the present disclosure;

[0058] Figure 4 is a flowchart of determining the state of master-slave switching according to an exemplary embodiment of the present disclosure;

[0059] Figure 5 is a block diagram of a firewall control device according to an exemplary embodiment of the present disclosure;

[0060] Figure 6 is a block diagram of a firewall device according to an exemplary embodiment of the present disclosure. DETAILED DESCRIPTION

[0061] The specific embodiments of the present disclosure are described in detail below with reference to the accompanying drawings. It should be understood that the specific embodiments described herein are merely intended for illustration and explanation of the present disclosure and are not intended to limit the present disclosure.

[0062] Firewall technology is a technology that helps to build a relatively isolated protective barrier between the internal and external networks of a computer network by organically combining various software and hardware devices for security management and screening, so as to protect the security of user data and information.

[0063] In the firewall technology, in order to avoid network failure, a firewall dual-hardware hot backup architecture composed of at least two firewall devices is proposed, one of which is called a master firewall, and the remaining firewall devices can be called standby firewalls.

[0064] As mentioned in the background, in the firewall dual-hardware hot backup architecture, the normal master-slave state is the basic guarantee for the normal operation of the network, and the master-slave election mechanism of the protocol itself can only ensure that the master-slave state is normal in most cases, and lacks reliable guarantee measures for special scenarios. For example, in a large flow scenario, when the firewall or the uplink and downlink network devices are under great pressure, it is likely to cause the loss of announcement messages, leading to abnormal switching, network shock, delay, packet loss, and even interruption, thereby affecting normal network business.

[0065] For example, in the VRRP (Virtual Router Redundancy Protocol) protocol, if the standby firewall fails to receive an announcement message for more than a set number of announcement periods, for example, fails to receive an announcement message for more than 3 announcement periods, it will abnormally switch to the Master state (active state).

[0066] In order to avoid abnormal switching, in related technologies, the number of announcement periods is usually increased by modifying the configuration, for example, changing from failing to receive an announcement message for more than 3 announcement periods to abnormally switching to the Master state to failing to receive an announcement message for more than 6 announcement periods to abnormally switching to the Master state, that is, it is expected to prevent abnormal switching by prolonging the switching waiting time of the standby firewall, but this way will prolong the switching time, and if the master firewall does indeed fail, the standby firewall will need more time to take over the network, which is unacceptable to many users, in addition, the frequency of the master firewall sending announcement messages will also be reduced, and it will be more sensitive to packet loss.

[0067] In addition, a delay switching function is proposed, which can configure a delay switching time length for the backup firewall, and prolong the preemption time of the backup firewall without reducing the sending frequency of the announcement message of the main firewall, but this way will also make the network recovery time longer when the main firewall fails, which does not meet the actual demand of users for the fault recovery time.

[0068] It can be seen that the method for dealing with abnormal switching of the firewall in the above special scenario in the related technology has limitations, therefore, the present disclosure provides a firewall control method, device, storage medium and electric firewall equipment to guarantee the normality of data transmission service as much as possible.

[0069] Please refer to Figure 1 , Figure 1 is a flow chart of a firewall control method according to an exemplary embodiment of the present disclosure. The method can be applied to the main firewall in a dual-machine hot standby architecture, as shown in Figure 1 , the firewall control method comprises:

[0070] S110, obtaining running data of the main firewall.

[0071] The running data of the main firewall can be understood as the data when the main firewall is running.

[0072] In some embodiments, the running data can include at least one of CPU occupancy rate, memory utilization rate, service port traffic data, fan speed and hardware packet loss data.

[0073] In some embodiments, as shown in Figure 2 , the main firewall and the backup firewall can each include a firewall OS, a dual-machine hot standby module, a state detection module, a database and a display platform, etc.

[0074] The firewall OS refers to a firewall basic operating system based on underlying hardware, which has the most core function set of the security gateway system, mainly including data forwarding, security control and other functions; the dual-machine hot standby module is realized based on the VRRP protocol, and mainly completes the main and backup state election and switching control; the state detection module realizes the detection, information processing and pushing of necessary states of the firewall itself, and the detected information includes CPU occupancy rate, memory utilization rate, service port traffic data, fan speed and hardware packet loss data, etc.; the display platform is used for firewall configuration issuing and device information display; the database can be used for storing various information.

[0075] In some embodiments, the running data of the main firewall can be obtained from the firewall OS by the state detection module of the main firewall.

[0076] In addition, considering that the operation data of the firewall in the embodiment of the present disclosure is used for fault early warning of the firewall, therefore, in some embodiments, the operation data of the master firewall can be current operation data of the master firewall.

[0077] In S120, the operation data is predicted by the pre-trained state prediction model to obtain a prediction state parameter output by the state prediction model and used for representing the performance state of the master firewall.

[0078] In the embodiment of the present disclosure, the obtained operation data can be input into the pre-trained state prediction model, and then the operation data can be predicted by the pre-trained state prediction model to obtain a prediction state parameter output by the state prediction model and used for representing the performance state of the master firewall.

[0079] In S130, in response to the prediction state parameter satisfying the early warning condition, the master firewall is controlled to send the announcement packet at an early warning sending frequency, wherein the early warning sending frequency is greater than a sending frequency of the master firewall in a normal master-standby state.

[0080] In the embodiment of the present disclosure, the prediction state parameter satisfying the preset condition indicates that the performance pressure of the master firewall is relatively large, and there is a risk of delay or loss of the announcement packet to a certain extent, which can cause abnormal switching of the master firewall and the standby firewall.

[0081] It can be understood that in the normal master-standby state of the dual-machine hot standby architecture, the master firewall corresponds to a sending frequency of the announcement packet, and when it is known that the master firewall and the standby firewall can be abnormally switched according to the prediction state parameter satisfying the preset condition, the master firewall can be controlled to send the announcement packet at an early warning sending frequency. Since the early warning sending frequency is greater than the sending frequency of the master firewall in the normal master-standby state, the sending frequency of the master firewall for sending the announcement packet is increased, so that the increased sending frequency is greater than the sending frequency in the normal master-standby state. Since the sending frequency of the announcement packet is increased, the possibility of the standby firewall receiving the announcement packet can be increased, so as to reduce the case that the standby firewall cannot receive the announcement packet within a set time and performs master-standby state switching, reduce the possibility of abnormal switching of the firewall, and thus guarantee the normality of data transmission service as much as possible.

[0082] With the above method, the running data of the main firewall can be obtained and processed by the state prediction model obtained by pre-training to obtain the predicted state parameters corresponding to the main firewall, and when it is known that the main firewall and the standby firewall may be abnormally switched according to the predicted state parameters satisfying the preset condition, the announcement message is sent at a frequency greater than the sending frequency of the main firewall in the normal master-slave state, that is, the sending frequency of the main firewall sending the announcement message is increased, so that the occurrence of abnormal switching can be effectively prevented, and the normal data transmission service is ensured as much as possible. At the same time, since the time delay processing method is not used, the time of normal switching is not affected.

[0083] In some embodiments, the pre-warning sending frequency can be a preset fixed sending frequency, which is greater than the sending frequency of the main firewall in the normal master-slave state, so that the main firewall can control the main firewall to send the announcement message at the preset pre-warning sending frequency in response to the predicted state parameters satisfying the pre-warning condition.

[0084] In addition, in some embodiments, the step of controlling the main firewall to send the announcement message at the pre-warning sending frequency can further include the following steps:

[0085] According to the association between the state parameters and the pre-warning sending frequency, determine the target pre-warning sending frequency corresponding to the predicted state parameters;

[0086] Control the main firewall to send the announcement message at the target pre-warning sending frequency.

[0087] In this embodiment, considering that in the case of satisfying the pre-warning condition, the performance of the main firewall also has high and low, in this case, corresponding pre-warning sending frequencies can be set for different performances. The predicted state parameters are used to represent the performance state of the main firewall, so the association between the state parameters and the pre-warning sending frequency can be established in advance. Therefore, the main firewall can determine the target pre-warning sending frequency corresponding to the predicted state parameters according to the association between the state parameters and the pre-warning sending frequency in response to the predicted state parameters satisfying the pre-warning condition, and control the main firewall to send the announcement message at the target pre-warning sending frequency.

[0088] Since the appropriate pre-warning sending frequency can be determined according to the performance of the main firewall to send the announcement message, the performance of the main firewall can be balanced between the performance of the main firewall and the prevention of abnormal switching of the firewall, so that the performance of the main firewall can be improved as much as possible in the case of preventing abnormal switching of the firewall.

[0089] In some embodiments, the state prediction model includes an encoder, a decoder, and a state parameter calculator, in which case, as shown in Figure 3 The predicted state parameters output by the state prediction model can include the following steps:

[0090] S121, processing each sub-operation data included in the operation data by the encoder to obtain a latent variable.

[0091] S122, processing the latent variable by the decoder to obtain the reconstruction data corresponding to each sub-operation data.

[0092] S123, processing each sub-operation data and the reconstruction data corresponding to each sub-operation data by the state parameter calculator to obtain the predicted state parameter.

[0093] In the embodiments of the present disclosure, a group of operation data can be input into the encoder of the prediction model, each sub-data included in the group of operation data is processed by the encoder to obtain a latent variable, then the obtained latent variable is processed by the decoder of the prediction model to obtain the reconstruction data corresponding to each sub-operation data, finally, the reconstruction data corresponding to each sub-operation data can be input into the state parameter calculator, each sub-operation data and the reconstruction data corresponding to each sub-operation data are processed by the state parameter calculator to obtain the predicted state parameter.

[0094] Exemplarily, assuming that a group of operation data includes CPU occupancy rate, memory utilization rate, service port traffic data, fan speed and hardware packet loss data 5 sub-operation data collected at the same time, the 5 sub-operation data can be input into the encoder of the prediction model, the 5 sub-operation data are processed by the encoder to obtain a latent variable, then the obtained latent variable is processed by the decoder of the prediction model to obtain the reconstruction data corresponding to the 5 sub-operation data, finally, the reconstruction data corresponding to the 5 sub-operation data can be input into the state parameter calculator, the 5 sub-operation data and the reconstruction data corresponding to the 5 sub-operation data are processed by the state parameter calculator to obtain the predicted state parameter.

[0095] In some embodiments, the encoder and the decoder included in the state prediction model can be the encoder and the decoder in the auto-encoder neural network in the machine learning algorithm.

[0096] In some embodiments, the encoder is represented as: h = σ e (W e x + b e );

[0097] The decoder is represented as: y = σ d (W d h + B d );

[0098] The state parameter calculator is represented as:

[0099] wherein x represents the running data, x i represents the i-th sub-running data included in the running data, h represents the hidden variable of the hidden layer, y represents the reconstructed data, y i represents the reconstructed data corresponding to the i-th sub-running data, S represents the state parameter, σ e is a nonlinear transformation function of the encoder, σ d is a nonlinear transformation function of the decoder, w e is a weight of the encoder, W d is a weight of the decoder, b e is a bias of the encoder, b d is a bias of the decoder, and n represents the number of sub-running data included in the running data.

[0100] In some embodiments, the training method of the state prediction model can include the following steps:

[0101] obtaining a sample data set, the sample data set including a plurality of running data of the primary firewall in a normal primary-standby state;

[0102] training the neural network model to be trained through the sample data set to obtain the state prediction model.

[0103] In the embodiments of the present disclosure, considering that the prediction model is used to predict the state parameter of the primary firewall at a certain time, and whether to perform early warning control is determined according to whether the state parameter meets a preset condition, therefore, in order to improve the accuracy of the prediction of the prediction model, a plurality of running data of the primary firewall in a normal primary-standby state can be selected to construct a training sample data set, and the neural network model to be trained is trained through the sample data set to obtain the state prediction model. The plurality of running data of the primary firewall in an abnormal primary-standby state is not selected to construct the training sample data set.

[0104] As can be known from the foregoing, the encoder and the decoder included in the state prediction model can be the encoder and the decoder in the autoencoder neural network, in which case, the neural network model to be trained is trained through the sample data set to obtain the state prediction model, and the specific steps can include the following steps:

[0105] processing each sample sub-running data included in a sample running data in the sample data set through the encoder to be trained to obtain the hidden variable corresponding to the sample running data;

[0106] processing the hidden variable corresponding to the sample running data through the decoder to be trained to obtain the reconstructed data corresponding to each sample sub-running data included in the sample running data;

[0107] Based on the difference between each sample sub-run data and the corresponding reconstructed data of each sample sub-run data, a loss function is constructed, and the model parameters in the to-be-trained encoder and the to-be-trained decoder are updated once by minimizing the loss function. After the to-be-trained encoder and the to-be-trained decoder are updated for multiple times, the state prediction model is obtained.

[0108] In the embodiments of the present disclosure, when training the state prediction model, only the model parameters of the encoder and the decoder part, i.e., the weights and biases of the encoder and the decoder part, can be trained. When training, a loss function is constructed based on the difference between each sample sub-run data included in a set of sample run data and the corresponding reconstructed data of each sample sub-run data, and the model parameters in the to-be-trained encoder and the to-be-trained decoder are updated once by minimizing the loss function.

[0109] It should be noted that when using the pre-trained state prediction model, the type of sub-run data included in the input run data is the same as the type of sub-run data included in the run data in the sample data set when training the to-be-trained neural network model.

[0110] In some embodiments, the predicted state parameter can be compared with a preset warning threshold to determine whether the predicted state parameter meets the warning condition. Therefore, the method of the embodiments of the present disclosure can further include the following steps:

[0111] When the predicted state parameter is greater than the preset warning threshold, it is determined that the state parameter meets the warning condition.

[0112] In the embodiments of the present disclosure, if the predicted state parameter is greater than the preset warning threshold, it is determined that the predicted state parameter meets the warning condition, and it is considered that the primary firewall and the standby firewall may have abnormal switching.

[0113] In addition, in some embodiments, in addition to setting a preset warning threshold, a preset recovery threshold can also be set. In this case, the method of the embodiments of the present disclosure can further include the following steps:

[0114] When the predicted state parameter is less than the preset recovery threshold, the primary firewall is controlled to send the announcement packet at the sending frequency in the normal master-slave state.

[0115] In the embodiments of the present disclosure, when the predicted state parameter is less than the preset recovery threshold, it can be considered that the primary firewall and the standby firewall will not have abnormal switching, and at this time, the primary firewall can be controlled to send the announcement packet at the sending frequency in the normal master-slave state.

[0116] In some embodiments, the method of the present disclosure can further include a process of determining the preset warning threshold and / or the preset recovery threshold. That is, the method of the present disclosure can further include the following steps:

[0117] obtaining a plurality of predicted state parameters output by the state parameter calculator in the state prediction model training process;

[0118] determining the preset warning threshold and / or the preset recovery threshold based on the distribution of the plurality of predicted state parameters.

[0119] In the present disclosure, in the process of updating the model parameters in the to-be-trained encoder and the to-be-trained decoder once, the input sample running data in the updating process can be obtained, the sample running data includes each sample sub-running data, and the reconstruction data corresponding to each sample sub-running data included in the sample running data output by the to-be-trained decoder can also be obtained. Then, the sample running data including each sample sub-running data and the reconstruction data corresponding to each sample sub-running data included in the sample running data can be input into the state parameter calculator, and a corresponding predicted state parameter can be output by the state parameter calculator. Thus, after multiple iterations, a plurality of predicted state parameters in the training stage can be obtained. Then, the preset warning threshold and / or the preset recovery threshold can be determined based on the distribution of the plurality of predicted state parameters.

[0120] In some embodiments, the preset warning threshold and / or the preset recovery threshold can be selected by the idea of normal distribution.

[0121] It can be understood that, in the present disclosure, the model is trained by the running data of the main firewall in the normal master-backup state, and thus the predicted state parameter value output by the state parameter calculator in the training process basically reflects the range interval of the predicted state parameter value that the main firewall can possibly distribute in the normal master-backup state. Therefore, in some embodiments, the preset warning threshold and / or the preset recovery threshold can be selected according to the interval of the predicted state parameter value distribution. For example, assuming that 90% of the predicted state parameter values are distributed in interval 1, and 10% of the predicted state parameter values are distributed in interval 2, the boundary between interval 1 and interval 2 can be determined as the preset warning threshold. Similarly, the preset recovery threshold can be determined according to another proportion.

[0122] In addition, in the above embodiments, the state parameters included in the association between the state parameters and the warning sending frequency can also be selected by referring to the idea of normal distribution, for example, interval 2 can be further subdivided to obtain various state parameters.

[0123] In addition, in some embodiments, to prevent the sending frequency of the announcement message sent by the master firewall from repeatedly changing in a particular scenario, causing a ping-pong effect and unnecessary overhead of the device constantly performing message pushing, message processing, and announcement message sending frequency switching, a preset recovery threshold can be set to be less than the preset warning threshold by a certain value.

[0124] In addition, in some cases, the preset warning threshold and the preset recovery threshold can also be the same.

[0125] That is, in the embodiments of the present disclosure, the preset recovery threshold is less than or equal to the preset warning threshold.

[0126] In the foregoing embodiments, in the normal master-standby state, the sending frequency of the announcement message sent by the master firewall is increased by predicting the prediction state parameter of the master firewall, and when the prediction state parameter meets the preset condition, the data transmission service is guaranteed as much as possible.

[0127] It can be understood that in some special cases, abnormal switching may still occur, and therefore, the method of the subsequent embodiments of the present disclosure further provides a firewall control method in the case of actual abnormal switching to further guarantee the data transmission service.

[0128] Therefore, in some embodiments, the firewall control method of the embodiments of the present disclosure can further include the following steps:

[0129] In the case where the master firewall receives the announcement message, the message information of the received announcement message is acquired;

[0130] Based on the message information, the state of the master-standby switching of the master firewall is determined, and the state of the master-standby switching includes an abnormal switching state and a normal switching state;

[0131] When it is determined that the state of the master-standby switching is the abnormal switching state,

[0132] A target message is sent to the target network device connected to the master firewall and the standby firewall, and the target message is used to refresh the neighbor table of the target network device, wherein the refreshed neighbor table records the interface of the master firewall, and / or

[0133] When it is determined that the state of the master-standby switching is the abnormal switching state, the sending frequency of the announcement message sent by the master firewall is increased, and the increased sending frequency is greater than the sending frequency in the normal master-standby state.

[0134] In the normal master-backup state, only the master firewall sends the announcement message, and thus it can be considered that if the master firewall receives the announcement message, it indicates that abnormal switching of the backup firewall can occur. At this time, the state of the master-backup switching of the master firewall can be determined based on the message information, i.e., whether the state of the master-backup switching is in the abnormal switching state or the normal switching state.

[0135] The target network device connected to the master firewall and the backup firewall can be understood as the upstream and downstream network devices connected to the master firewall and the backup firewall.

[0136] If it is determined that the state of the master-backup switching is the abnormal switching state, a target message can be sent to the target network device connected to the master firewall and the backup firewall, so that the target network device refreshes the neighbor table according to the target message, so that the traffic on the backup firewall is restored to the master firewall as soon as possible, the impact on the data transmission service is reduced, and / or the sending frequency of the announcement message sent by the master firewall is increased to promote the restoration of the normal master-backup state and prevent abnormal switching from occurring again as much as possible.

[0137] It can be understood that in the normal master-backup state, the interface information of the master firewall is recorded in the neighbor table of the upstream and downstream network devices, so that the traffic of the upstream and downstream network devices can be sent to the master firewall through the neighbor table recorded in the upstream and downstream network devices. When abnormal switching occurs, the interface information of the backup firewall is recorded in the neighbor table of the upstream and downstream network devices, and at this time, the traffic of the upstream and downstream network devices is sent to the backup firewall. Therefore, in order to avoid the traffic of the upstream and downstream network devices from being mistakenly sent to the backup firewall and to ensure the normal data transmission service as much as possible, a target message for refreshing the neighbor table of the upstream and downstream network devices connected to the master firewall and the backup firewall can be sent.

[0138] In some embodiments, the master firewall sends the target message, which can be a Gratuitous ARP / Unsolicited NA message containing a virtual MAC and a virtual IP sent through a service port of a virtual router.

[0139] In some embodiments, determining the state of the master-backup switching of the master firewall based on the message information can include the following steps:

[0140] When the received announcement message is an announcement message sent by the backup firewall in the dual-hot-standby architecture and conforming to the preset protocol, if the priority of the backup firewall is less than the priority of the master firewall, it is determined that the state of the master-backup switching is the abnormal switching state; or

[0141] In a case that the received announcement message is an announcement message conforming to a preset protocol and sent from a backup firewall in a dual-machine hot backup architecture, and the priority of the backup firewall is equal to the priority of the master firewall, if the IP address of the interface of the backup firewall is less than or equal to the IP address of the interface of the master firewall, it is determined that the state of the master-backup switching is an abnormal switching state.

[0142] As shown in FIG. 1, Figure 4 After receiving the announcement message, the master firewall can first determine the legality of the announcement message, which includes two parts: one is whether the announcement message itself conforms to the protocol specification, for example, whether it meets the VRRP protocol, and the other is whether the source of the announcement message is from the backup firewall in the dual-machine hot backup architecture according to the content of the announcement message. If both are met, the priority of the backup firewall sending the announcement message and the priority of the master firewall can be determined.

[0143] If the priority of the backup firewall is greater than the priority of the master firewall, it is determined that a normal switching state occurs, and if the priority of the backup firewall is less than the priority of the master firewall, it is determined that the state of the master-backup switching is an abnormal switching state. If the priority of the backup firewall is equal to the priority of the master firewall, the size of the IP address of the interface of the backup firewall and the IP address of the interface of the master firewall is determined. If the IP address of the interface of the backup firewall is less than or equal to the IP address of the interface of the master firewall, it is determined that the state of the master-backup switching is an abnormal switching state. If the IP address of the interface of the backup firewall is greater than the IP address of the interface of the master firewall, it is determined that the state of the master-backup switching is a normal switching state.

[0144] In addition, in some embodiments, the method of the present disclosure can further include the following steps:

[0145] When it is determined that the state of the master-backup switching is an abnormal switching state, abnormal running data of the master firewall is acquired;

[0146] The abnormal running data is predicted by a pre-trained state prediction model to obtain a candidate state parameter output by the state prediction model;

[0147] If the candidate state parameter meets a preset condition, a network diagnosis report is generated based on the abnormal running data;

[0148] If the candidate state parameter does not meet the preset condition, an indication of an external network fault is generated or an indication of optimizing the pre-trained state prediction model is generated.

[0149] The abnormal running data can be understood as running data collected when the state of the master-backup switching is an abnormal switching state. The candidate state parameter can be understood as a parameter obtained by predicting the abnormal running data by the state prediction model.

[0150] In the embodiments of the present disclosure, after the abnormal running data of the master firewall is acquired, the abnormal running data can be predicted by the pre-trained state prediction model to obtain candidate state parameters output by the state prediction model, and then it is determined whether the candidate state parameters meet the preset condition. If the candidate state parameters meet the preset condition, it means that the state prediction model prediction is accurate, at this time, a network diagnosis report including the abnormal running data can be generated for the operation and maintenance personnel to check. If it is determined that the candidate state parameters do not meet the preset condition, it means that the state prediction model prediction is wrong, at this time, there can be three situations:

[0151] The first kind can be caused by external factors, such as packet loss or delay of the router node, causing abnormal switching.

[0152] The second kind can be caused by the deviation of the specific sample used to train the state prediction model.

[0153] The third kind can be caused by the related running data of the dual-machine hot backup, that is, the input features of the state prediction model are not complete.

[0154] Therefore, if it is determined that the candidate state parameters do not meet the preset condition, an indication of external network failure can be generated, or an indication of optimizing the pre-trained state prediction model can be generated.

[0155] In addition, considering that the abnormal running data is acquired after the abnormal switching occurs, at this time, the performance of the master firewall can be insufficient, therefore, in some embodiments, the step of predicting the abnormal running data by the pre-trained state prediction model to obtain the candidate state parameters output by the state prediction model can be performed after the normal master-backup state is restored.

[0156] In addition, it should be understood that, for the above method embodiments, in order to simply describe, they are all expressed as a series of action combinations, but those skilled in the art should know that the present disclosure is not limited to the action sequence described above. Secondly, those skilled in the art should know that the above-described embodiments belong to preferred embodiments, and the steps involved are not necessarily required by the present disclosure.

[0157] Based on the same idea, the present disclosure also provides a firewall control device, which can be part or all of the firewall device through software, hardware or a combination of both. The device is applied to the master firewall in the dual-machine hot backup architecture. Referring to Figure 5 The firewall control device 500 can include:

[0158] The first acquisition module 510 is configured to acquire the running data of the master firewall.

[0159] The prediction module 520 is configured to perform prediction on the operation data by using a pre-trained state prediction model to obtain a prediction state parameter output by the state prediction model, the prediction state parameter being used to represent a performance state of the main firewall.

[0160] The first control module 530 is configured to control the main firewall to send the announcement packet at a pre-warning sending frequency in response to the prediction state parameter satisfying a pre-warning condition, the pre-warning sending frequency being greater than a sending frequency of the main firewall in a normal master-slave state.

[0161] Optionally, the first control module 530 is further configured to determine a target pre-warning sending frequency corresponding to the prediction state parameter according to an association between the state parameter and the pre-warning sending frequency, and control the main firewall to send the announcement packet at the target pre-warning sending frequency.

[0162] Optionally, the state prediction model comprises an encoder, a decoder and a state parameter calculator, and the prediction module 520 comprises:

[0163] A first processing sub-module is configured to perform processing on each sub-operation data included in the operation data by using the encoder to obtain a latent variable;

[0164] A second processing sub-module is configured to perform processing on the latent variable by using the decoder to obtain reconstructed data corresponding to the each sub-operation data;

[0165] A third processing sub-module is configured to perform processing on the each sub-operation data and the reconstructed data corresponding to the each sub-operation data by using the state parameter calculator to obtain the prediction state parameter.

[0166] Optionally, the firewall control apparatus 500 further comprises:

[0167] A second acquisition module is configured to acquire a sample data set, the sample data set comprising a plurality of operation data of the main firewall in a normal master-slave state;

[0168] A training module is configured to perform training on a neural network model to be trained by using the sample data set to obtain the state prediction model.

[0169] Optionally, the training module is further configured to: process each sample sub-run data included in the sample run data by the to-be-trained encoder to obtain a latent variable corresponding to the sample run data; process the latent variable corresponding to the sample run data by the to-be-trained decoder to obtain reconstructed data corresponding to each sample sub-run data included in the sample run data; construct a loss function based on a difference between the each sample sub-run data and the reconstructed data corresponding to the each sample sub-run data, and update model parameters in the to-be-trained encoder and the to-be-trained decoder by minimizing the loss function, so as to obtain the state prediction model after multiple updates of the to-be-trained encoder and the to-be-trained decoder.

[0170] The encoder is represented as: h = σ e (W e x + b e );

[0171] The decoder is represented as: y = σ d (W d h + b d );

[0172] The state parameter calculator is represented as:

[0173] wherein, x represents run data, x i represents an i-th sub-run data included in the run data, h represents a latent variable of a hidden layer, y represents reconstructed data, y i represents reconstructed data corresponding to the i-th sub-run data, S represents a state parameter, σ e is a nonlinear transformation function of the encoder, σ d is a nonlinear transformation function of the decoder, W e is a weight of the encoder, W d is a weight of the decoder, b e is a bias of the encoder, b d is a bias of the decoder, and n represents a number of sub-run data included in the run data.

[0174] Optionally, the firewall control device 500 further comprises:

[0175] The first determination module is configured to determine that the predicted state parameter satisfies a preset condition when the predicted state parameter is greater than a preset warning threshold.

[0176] The second control module is configured to control the master firewall to send the announcement packet at a sending frequency in a normal master-standby state when the predicted state parameter is less than the preset recovery threshold, wherein the preset recovery threshold is less than or equal to the preset warning threshold.

[0177] Optionally, the firewall control device 500 further comprises:

[0178] a third obtaining module, configured to obtain a plurality of predicted state parameters output by the state parameter calculator in the state prediction model training process;

[0179] a second determining module, configured to determine a preset warning threshold and / or a preset recovery threshold based on a distribution of the plurality of predicted state parameters.

[0180] Optionally, the firewall control device 500 further comprises:

[0181] a fourth obtaining module, configured to obtain, in a case where the main firewall receives an announcement packet, packet information of the received announcement packet;

[0182] a third determining module, configured to determine a state of a master-slave switchover of the main firewall based on the packet information, the state of the master-slave switchover including an abnormal switchover state and a normal switchover state;

[0183] a processing module, configured to send a target packet to a target network device connected to the main firewall and the standby firewall when it is determined that the state of the master-slave switchover is the abnormal switchover state, the target packet being used to refresh a neighbor table of the target network device, wherein the refreshed neighbor table records an interface of the main firewall, and / or increase a sending frequency of the announcement packet sent by the main firewall when it is determined that the state of the master-slave switchover is the abnormal switchover state, wherein the increased sending frequency is greater than a sending frequency in a normal master-slave state.

[0184] Optionally, the third determining module comprises:

[0185] a first determining submodule, configured to, when the received announcement packet is an announcement packet conforming to a preset protocol sent by the standby firewall in the dual-machine hot standby architecture and the priority of the standby firewall is less than the priority of the main firewall, determine that the state of the master-slave switchover is the abnormal switchover state;

[0186] a second determining submodule, configured to, when the received announcement packet is an announcement packet conforming to a preset protocol sent by the standby firewall in the dual-machine hot standby architecture and the priority of the standby firewall is equal to the priority of the main firewall, and the IP address of the interface of the standby firewall is less than or equal to the IP address of the interface of the main firewall, determine that the state of the master-slave switchover is the abnormal switchover state.

[0187] Optionally, the firewall control device 500 further comprises:

[0188] The fifth obtaining module is configured to obtain abnormal running data of the master firewall when it is determined that the state of the master-backup switching is the abnormal switching state.

[0189] The fourth determining module is configured to predict the abnormal running data by using a pre-trained state prediction model to obtain candidate state parameters output by the state prediction model.

[0190] The first generating module is configured to generate a network diagnosis report based on the abnormal running data if the candidate state parameters satisfy the preset condition.

[0191] The second generating module is configured to generate an indication of an external network fault or an indication of optimizing the pre-trained state prediction model if the candidate state parameters do not satisfy the preset condition.

[0192] Optionally, the running data includes at least one of CPU occupancy, memory utilization, service port traffic data, fan speed, and hardware packet loss data.

[0193] As to the apparatus in the above-described embodiments, the specific manners in which various modules perform operations have been described in detail in the embodiments of the method, and thus will not be described here in detail.

[0194] Based on the same inventive concept, the present disclosure further provides a firewall device, comprising:

[0195] a memory having a computer program stored thereon;

[0196] a processor configured to execute the computer program in the memory to implement the steps of any of the above firewall control methods.

[0197] In a possible manner, a block diagram of the firewall device can be as shown in Figure 6 Referring to Figure 6 The firewall device 600 can include a processor 601 and a memory 602. The firewall device 600 can further include one or more of a multimedia component 603, an input / output interface 604, and a communication component 605.

[0198] The processor 601 is configured to control overall operations of the firewall device 600 to complete all or part of the steps of the firewall control method described above. The memory 602 is configured to store various types of data to support the operations of the firewall device 600, which can include, for example, instructions for any application or method operating on the firewall device 600, and application-related data, such as contact data, sent and received messages, pictures, audio, video, and the like. The memory 602 can be implemented by any type of volatile or non-volatile storage device or a combination thereof, such as static random access memory (SRAM), electrically erasable programmable read-only memory (EEPROM), erasable programmable read-only memory (EPROM), programmable read-only memory (PROM), read-only memory (ROM), magnetic memory, flash memory, magnetic disk or optical disk. The multimedia component 603 can include a screen and an audio component. The screen can be, for example, a touch screen, and the audio component is configured to output and / or input audio signals. For example, the audio component can include a microphone configured to receive external audio signals. The received audio signals can be further stored in the memory 602 or transmitted through the communication component 605. The audio component also includes at least one speaker configured to output audio signals. The input / output interface 604 provides an interface between the processor 601 and other interface modules, which can be a keyboard, a mouse, a button, and the like. The buttons can be analog buttons or physical buttons. The communication component 605 is configured to perform wired or wireless communication between the firewall device 600 and other devices. Wireless communication, such as Wi-Fi, Bluetooth, near field communication (NFC), 2G, 3G, 4G, NB-IOT, eMTC, or other 5G, and the like, or a combination of one or more of them, is not limited herein. Therefore, the corresponding communication component 605 can include a Wi-Fi module, a Bluetooth module, an NFC module, and the like.

[0199] In an exemplary embodiment, the firewall device 600 can be implemented by one or more Application Specific Integrated Circuit (ASIC), Digital Signal Processor (DSP), Digital Signal Processing Device (DSPD), Programmable Logic Device (PLD), Field Programmable Gate Array (FPGA), controller, microcontroller, microprocessor or other electronic elements for executing the above firewall control method.

[0200] In another exemplary embodiment, a computer readable storage medium including program instructions is also provided, which when executed by a processor, implements the steps of the above firewall control method. For example, the computer readable storage medium can be the above memory 602 including program instructions, which can be executed by the processor 601 of the firewall device 600 to complete the above firewall control method.

[0201] In another exemplary embodiment, a computer program product is also provided, which contains a computer program executable by a programmable device, the computer program having code portions for executing the above firewall control method when executed by the programmable device.

[0202] The preferred embodiments of the present disclosure are described in detail above with reference to the accompanying drawings, but the present disclosure is not limited to the specific details in the above embodiments. Within the technical concept of the present disclosure, various simple modifications can be made to the technical solutions of the present disclosure, and these simple modifications all belong to the protection scope of the present disclosure.

[0203] In addition, it should be noted that each specific technical feature described in the above specific embodiments can be combined in any appropriate manner without contradiction, and in order to avoid unnecessary repetition, the present disclosure will not further describe various possible combinations.

[0204] Furthermore, any combination of the various different embodiments of the present disclosure can also be made, as long as it does not deviate from the idea of the present disclosure, it should also be considered as disclosed by the present disclosure.

Claims

1. A firewall control method characterized by, The method is applied to a master firewall in a dual-machine hot backup architecture, and the method comprises the following steps: obtaining running data of the master firewall; predicting the running data by using a pre-trained state prediction model to obtain a prediction state parameter output by the state prediction model, the prediction state parameter being used to represent a performance state of the master firewall; obtaining a plurality of prediction state parameters output by a state parameter calculator during training of the state prediction model; determining a preset warning threshold and / or a preset recovery threshold based on a distribution of the plurality of prediction state parameters; in response to the prediction state parameter satisfying a warning condition, controlling the master firewall to send an announcement packet at a warning sending frequency, wherein the warning sending frequency is greater than a sending frequency of the master firewall in a normal master-standby state; the response to the prediction state parameter satisfying the warning condition comprises: when the prediction state parameter is greater than the preset warning threshold, determining that the prediction state parameter satisfies the warning condition; when the prediction state parameter is less than the preset recovery threshold, controlling the master firewall to send the announcement packet at the sending frequency in the normal master-standby state, wherein the preset recovery threshold is less than or equal to the preset warning threshold.

2. The method of claim 1, wherein, the control of the master firewall to send the announcement packet at the warning sending frequency comprises: determining a target warning sending frequency corresponding to the prediction state parameter according to an association between the prediction state parameter and the warning sending frequency; controlling the master firewall to send the announcement packet at the target warning sending frequency.

3. The method of claim 1, wherein, the state prediction model comprises an encoder, a decoder and a state parameter calculator, and the prediction of the running data by using the pre-trained state prediction model to obtain the prediction state parameter output by the state prediction model comprises the following steps: processing each sub-running data included in the running data by using the encoder to obtain a latent variable; processing the latent variable by using the decoder to obtain reconstructed data corresponding to the each sub-running data; processing the each sub-running data and the reconstructed data corresponding to the each sub-running data by using the state parameter calculator to obtain the prediction state parameter.

4. The method of claim 3, wherein, the training method of the state prediction model comprises the following steps: obtaining a sample data set, the sample data set comprising a plurality of running data of the master firewall in a normal master-standby state; processing each sample sub-running data included in a sample running data in the sample data by using a to-be-trained encoder to obtain a latent variable corresponding to the sample running data; processing the latent variable corresponding to the sample running data by using a to-be-trained decoder to obtain reconstructed data corresponding to each sample sub-running data included in the sample running data; based on a difference between the each sample sub-running data and the reconstructed data corresponding to the each sample sub-running data, constructing a loss function, and updating model parameters in the to-be-trained encoder and the to-be-trained decoder once by minimizing the loss function, wherein the to-be-trained encoder and the to-be-trained decoder are obtained after multiple updates.

5. The method according to any one of claims 1 to 4, characterized in that, the method further comprises: In a case where the main firewall receives the announcement message, message information of the received announcement message is acquired; Based on the message information, a state of a main-standby switchover of the main firewall is determined, and the state of the main-standby switchover includes an abnormal switchover state and a normal switchover state; In a case where it is determined that the state of the main-standby switchover is the abnormal switchover state, a target message is sent to a target network device connected to the main firewall and a standby firewall, and the target message is used to refresh a neighbor table of the target network device, wherein the refreshed neighbor table records an interface of the main firewall, and / or In a case where it is determined that the state of the main-standby switchover is the abnormal switchover state, a sending frequency of the main firewall for sending the announcement message is increased, and the increased sending frequency is greater than a sending frequency in a normal main-standby state.

6. The method of claim 5, wherein, The determination of the state of the main-standby switchover of the main firewall based on the message information includes: In a case where the received announcement message is an announcement message conforming to a preset protocol and sent from the standby firewall in the dual-computer hot backup architecture, if a priority of the standby firewall is less than a priority of the main firewall, it is determined that the state of the main-standby switchover is the abnormal switchover state; or In a case where the received announcement message is an announcement message conforming to a preset protocol and sent from the standby firewall in the dual-computer hot backup architecture, and the priority of the standby firewall is equal to the priority of the main firewall, if an interface IP address of the standby firewall is less than or equal to an interface IP address of the main firewall, it is determined that the state of the main-standby switchover is the abnormal switchover state.

7. The method of claim 5, wherein, The method further includes: In a case where it is determined that the state of the main-standby switchover is the abnormal switchover state, abnormal running data of the main firewall is acquired; A candidate state parameter output by a state prediction model is obtained by predicting the abnormal running data through the pre-trained state prediction model; If the candidate state parameter meets a preset condition, a network diagnosis report is generated based on the abnormal running data; If the candidate state parameter does not meet the preset condition, an indication of an external network fault is generated or an indication of optimizing the pre-trained state prediction model is generated.

8. A firewall control device, characterized by The device is applied to a main firewall in a dual-computer hot backup architecture, and the device includes: A first acquisition module is configured to acquire running data of the main firewall; A prediction module is configured to obtain a prediction state parameter output by a state prediction model and used to represent a performance state of the main firewall by predicting the running data through the pre-trained state prediction model; A third acquisition module is configured to acquire a plurality of prediction state parameters output by a state parameter calculator in a training process of the state prediction model; A second determination module is configured to determine a preset warning threshold and / or a preset recovery threshold based on a distribution of the plurality of prediction state parameters; A first control module is configured to control the main firewall to send an announcement message at a warning sending frequency in response to the prediction state parameter meeting a warning condition, and the warning sending frequency is greater than a sending frequency of the main firewall in a normal main-standby state. The firewall control device further includes: The first determining module is configured to determine that the predicted state parameter satisfies the early warning condition when the predicted state parameter is greater than the preset early warning threshold. The second control module is configured to control the master firewall to send the announcement packet at a sending frequency in a normal master-standby state when the predicted state parameter is less than the preset recovery threshold, wherein the preset recovery threshold is less than or equal to the preset early warning threshold.

9. A non-transitory computer-readable storage medium having stored thereon a computer program, characterized in that, The program is executed by the processor to implement the steps of the method in any one of claims 1-7.

10. A firewall device, characterized by The program is executed by the processor to implement the steps of the method in any one of claims 1-7. The memory has the computer program stored thereon. The processor is configured to execute the computer program in the memory to implement the steps of the method in any one of claims 1-7.

Images