A safety detection method, device, electronic device and storage medium

Abstract

The application provides a security detection method and device, electronic equipment and storage medium. The method comprises the following steps: obtaining configuration information corresponding to a to-be-processed packet; encapsulating the configuration information into the to-be-processed packet to obtain an encapsulated packet; and forwarding the encapsulated packet to a target process through a kernel protocol stack maintained by an operating system, so that the target process performs security detection on the to-be-processed packet according to the configuration information in the encapsulated packet. In the implementation process of the above scheme, the configuration information corresponding to the to-be-processed packet is transmitted to the target process through the kernel protocol stack, so that the target process performs security detection on the to-be-processed packet according to the configuration information in the encapsulated packet. The configuration information in the kernel protocol stack is maintained by the operating system, which avoids the situation that the target process consumes a large amount of computing resources to maintain the configuration information, and effectively improves the efficiency of security detection.

Description

TECHNICAL FIELD

[0001] The present application relates to the technical field of network security, network communication and border security, in particular to a security detection method and device, an electronic device and a storage medium. BACKGROUND

[0002] At present, most of the security devices obtain the configuration information in the shared memory through the proxy process, and perform security detection according to the configuration information. The specific security detection process is, for example, after receiving a network packet, the configuration information corresponding to the network packet is transmitted to the proxy process through the shared memory, and the proxy process can obtain the network packet from the shared memory and perform security detection on the network packet. However, as the configuration information in the shared memory increases, the proxy process not only needs to obtain the network packet from the shared memory and perform security detection on the network packet, but also needs to consume a large amount of computing resources to maintain the configuration information in the shared memory. That is, the efficiency of the current security detection through the configuration information in the shared memory is low. SUMMARY

[0003] The purpose of the embodiments of the present application is to provide a security detection method and device, an electronic device and a storage medium, which can improve the problem of low efficiency of security detection.

[0004] The embodiments of the present application provide a security detection method, which comprises: obtaining configuration information corresponding to a to-be-processed packet; encapsulating the configuration information into the to-be-processed packet to obtain an encapsulated packet; and forwarding the encapsulated packet to a target process through a kernel protocol stack maintained by an operating system, so that the target process performs security detection on the to-be-processed packet according to the configuration information in the encapsulated packet. In the implementation process of the above scheme, the configuration information corresponding to the to-be-processed packet is transmitted to the target process through the kernel protocol stack, so that the target process performs security detection on the to-be-processed packet according to the configuration information in the encapsulated packet. The configuration information in the kernel protocol stack is maintained by the operating system, which avoids the situation that the target process consumes a large amount of computing resources to maintain the configuration information, and effectively improves the efficiency of security detection.

[0005] Optionally, in the embodiments of the present application, obtaining the configuration information corresponding to the to-be-processed packet comprises: obtaining an access control rule corresponding to the to-be-processed packet; and searching for the configuration information corresponding to the access control rule in a configuration information library to obtain the configuration information corresponding to the to-be-processed packet, wherein the configuration information library stores a correspondence between the access control rule and the configuration information. In the implementation process of the above scheme, the access control rule corresponding to the to-be-processed packet is obtained, and the configuration information corresponding to the access control rule is searched, so as to obtain the configuration information corresponding to the to-be-processed packet, which avoids the problem that the configuration information corresponding to the to-be-processed packet cannot be obtained.

[0006] Optionally, in an embodiment of the present application, encapsulating the configuration information into the message to be processed includes: encapsulating the configuration information before the message header of the message to be processed; or, encapsulating the configuration information between the message header and the message body of the message to be processed; or, encapsulating the configuration information after the message body of the message to be processed.

[0007] Optionally, in an embodiment of the present application, forwarding the encapsulated message to the target process via the kernel protocol stack maintained by the operating system includes: storing the encapsulated message in the kernel protocol stack maintained by the operating system; and obtaining the encapsulated message from the kernel protocol stack maintained by the operating system via the target process. In the implementation of the above solution, by storing the encapsulated message in the kernel protocol stack maintained by the operating system and obtaining the encapsulated message from the kernel protocol stack maintained by the operating system, the operating system's maintenance mechanism for the kernel protocol stack is utilized to avoid consuming a large amount of computing resources to maintain configuration information, thereby improving security detection efficiency and reducing data maintenance costs.

[0008] Optionally, in an embodiment of the present application, the target process performs a security check on the message to be processed based on the configuration information in the encapsulated message, including: determining whether the configuration information is parsed from the encapsulated message; if so, parsing the message to be processed from the encapsulated message by the target process, and performing a security check on the message to be processed using the configuration information to obtain a security check result. In the implementation of the above solution, the target process parses the message to be processed from the encapsulated message and performs a security check on the message to be processed using the configuration information, thereby improving the efficiency of security checking.

[0009] Optionally, in an embodiment of the present application, after determining whether the configuration information is parsed from the encapsulated message, it also includes: if the configuration information is not parsed from the encapsulated message, parsing the message to be processed from the encapsulated message, and forwarding the message to be processed according to the five-tuple of the message to be processed.

[0010] Optionally, in an embodiment of the present application, after obtaining the security detection result, the method further includes: if the security detection result indicates a malicious attack, discarding the pending message, or cleaning the pending message. In the implementation process of the above solution, by discarding the pending message or cleaning the pending message in the presence of a malicious attack, the probability of being attacked by a malicious attack is reduced, thereby effectively increasing the security of the security detection.

[0011] An embodiment of the present application also provides a security detection device, including: a configuration information acquisition module, used to obtain configuration information corresponding to the message to be processed; an encapsulated message acquisition module, used to encapsulate the configuration information into the message to be processed to obtain an encapsulated message; a message security detection module, used to forward the encapsulated message to the target process through the kernel protocol stack maintained by the operating system, so that the target process performs security detection on the message to be processed based on the configuration information in the encapsulated message.

[0012] Optionally, in an embodiment of the present application, the configuration information acquisition module includes: a control rule acquisition sub-module, used to obtain the access control rules corresponding to the message to be processed; a configuration information search sub-module, used to search the configuration information corresponding to the access control rules in the configuration information library, and obtain the configuration information corresponding to the message to be processed, and the configuration information library stores the correspondence between the access control rules and the configuration information.

[0013] Optionally, in an embodiment of the present application, the encapsulated message obtaining module includes: a first message encapsulation sub-module, used to encapsulate the configuration information before the message header of the message to be processed; or, a second message encapsulation sub-module, used to encapsulate the configuration information between the message header and the message body of the message to be processed; or, a third message encapsulation sub-module, used to encapsulate the configuration information after the message body of the message to be processed.

[0014] Optionally, in an embodiment of the present application, the message security detection module includes: an encapsulated message storage submodule, used to store the encapsulated message in the kernel protocol stack maintained by the operating system; and an encapsulated message acquisition submodule, used to obtain the encapsulated message from the kernel protocol stack maintained by the operating system through the target process.

[0015] Optionally, in an embodiment of the present application, the message security detection module includes: a configuration information parsing submodule, used to determine whether the configuration information is parsed from the encapsulated message; a message processing detection submodule, used to parse the message to be processed from the encapsulated message through the target process if the configuration information is parsed from the encapsulated message, and use the configuration information to perform security detection on the message to be processed to obtain a security detection result.

[0016] Optionally, in an embodiment of the present application, the message security detection module further includes: a message forwarding submodule for processing, which is used to parse the message to be processed from the encapsulated message if the configuration information is not parsed from the encapsulated message, and forward the message to be processed according to the five-tuple of the message to be processed.

[0017] Optionally, in an embodiment of the present application, the message security detection module further includes: a message discarding and cleaning submodule, which is used to discard the message to be processed or clean the message to be processed if the security detection result shows that there is a malicious attack.

[0018] An embodiment of the present application further provides an electronic device, including: a processor and a memory, wherein the memory stores machine-readable instructions executable by the processor, and when the machine-readable instructions are executed by the processor, the method described above is performed.

[0019] An embodiment of the present application further provides a computer-readable storage medium, on which a computer program is stored. When the computer program is executed by a processor, the method described above is executed.

[0020] Other features and advantages of the embodiments of the present application will be described in the subsequent description, and in part will become apparent from the description, or may be understood by practicing the embodiments of the present application. BRIEF DESCRIPTION OF THE DRAWINGS

[0021] In order to more clearly illustrate the technical solutions of the embodiments of the present application, the following is a brief introduction to the drawings required for use in the embodiments of the present application. It should be understood that the following drawings only illustrate certain embodiments of the embodiments of the present application and therefore should not be regarded as limiting the scope. For ordinary technicians in this field, other relevant drawings can be obtained based on these drawings without creative work.

[0022] Figure 1 A schematic diagram showing a flow chart of a security detection method provided in an embodiment of the present application is shown;

[0023] Figure 2 A schematic diagram of a process for processing a message to be processed according to an embodiment of the present application is shown;

[0024] Figure 3 A schematic structural diagram of a safety detection device provided in an embodiment of the present application is shown;

[0025] Figure 4 A schematic structural diagram of an electronic device provided in an embodiment of the present application is shown. DETAILED DESCRIPTION

[0026] The technical solutions in the embodiments of the present application will be clearly and completely described below in conjunction with the drawings in the embodiments of the present application. Obviously, the described embodiments are only a part of the embodiments in the embodiments of the present application, rather than all of the embodiments. The components of the embodiments of the present application generally described and shown in the drawings here can be arranged and designed in various different configurations. Therefore, the following detailed description of the embodiments of the present application provided in the drawings is not intended to limit the scope of the embodiments of the present application for protection, but merely represents selected embodiments in the embodiments of the present application. Based on the embodiments of the present application, all other embodiments obtained by those skilled in the art without making creative work are within the scope of protection of the embodiments of the present application.

[0027] It is understood that the terms "first" and "second" in the embodiments of the present application are used to distinguish similar objects. Those skilled in the art will understand that the terms "first" and "second" do not limit the quantity or order of execution, and that the terms "first" and "second" do not necessarily define differences.

[0028] It should be noted that the security detection method provided in the embodiments of the present application can be executed by electronic devices, where the electronic devices refer to network security devices (NSDs), device terminals, or servers that have the function of executing computer programs; NSDs include but are not limited to firewall devices, antivirus system servers, intrusion detection systems (IDSs), horizontal isolation devices, or intrusion protection systems (IPSs), etc., and device terminals include smartphones, personal computers, tablet computers, personal digital assistants, or mobile Internet devices. A server refers to a device that provides computing services over a network, such as x86 servers and non-x86 servers, and non-x86 servers include mainframes, minicomputers, and UNIX servers.

[0029] The following describes application scenarios in which this security detection method is applicable. These application scenarios include, but are not limited to, using this security detection method to enhance the functionality of NSDs or improve the efficiency of NSD security detection. NSDs include, but are not limited to, firewall devices, antivirus system servers, intrusion detection systems (IDS) devices, horizontal isolation devices, or intrusion protection systems (IPS) devices.

[0030] See Figure 1 The flowchart of the security detection method provided by the embodiment of the present application is shown; the main idea of ​​the security detection method is to pass the configuration information corresponding to the message to be processed to the target process through the kernel protocol stack, rather than passing the configuration information to the target process through shared memory. Since the configuration information in the kernel protocol stack is maintained by the operating system, the configuration information in the kernel protocol stack is automatically maintained by the operating system. The operating system can automatically release and recycle the configuration information after the life cycle of the message to be processed ends, thereby avoiding the situation of consuming a large amount of computing resources to maintain the configuration information, and effectively improving the efficiency of security detection. The implementation method of the above-mentioned security detection method may include:

[0031] Step S110: Obtain configuration information corresponding to the message to be processed.

[0032] Configuration Information, refers to the configuration information required for security detection of the to-be-processed packet. For example, in the process of security detection of the to-be-processed packet by the proxy process, the configuration information of the discarded or cleaned malicious packet, the number of threads, the size of memory and the like. It can be understood that the electronic device needs to receive the to-be-processed packet first, and then obtain the configuration information corresponding to the to-be-processed packet. For example, assuming that the electronic device is a firewall, the firewall itself needs to process the to-be-processed packet, and thus the firewall can directly obtain the configuration information from the to-be-processed packet that has been received. Then, the configuration information corresponding to the to-be-processed packet is obtained. The process of obtaining the configuration information will be described in detail below.

[0033] Step S120: encapsulating the configuration information into the to-be-processed packet to obtain an encapsulated packet.

[0034] It can be understood that there are many encapsulation methods for encapsulating the configuration information into the to-be-processed packet, and thus these encapsulation methods will be described in detail below.

[0035] Step S130: forwarding the encapsulated packet to the target process through the kernel protocol stack maintained by the operating system, so that the target process performs security detection on the to-be-processed packet according to the configuration information in the encapsulated packet.

[0036] It can be understood that, since the operating system does not modify the five-tuple of the to-be-processed packet, the configuration information in the kernel protocol stack is automatically maintained by the operating system, which can ensure that the five-tuple of the to-be-processed packet obtained by the electronic device is the same as the five-tuple during security detection, and the operating system can automatically release and recycle the to-be-processed packet after the end of the life cycle of the to-be-processed packet, thereby avoiding the consumption of a large amount of computing resources for maintaining the configuration information, thereby reducing the data maintenance cost of packet maintenance and configuration information maintenance.

[0037] In the above implementation process, the configuration information corresponding to the to-be-processed packet is transmitted to the target process through the kernel protocol stack, so that the target process performs security detection on the to-be-processed packet according to the configuration information in the encapsulated packet. The configuration information in the kernel protocol stack is maintained by the operating system (i.e., the maintenance mechanism of the kernel protocol stack by the operating system is used), which avoids the consumption of a large amount of computing resources by the target process for maintaining the configuration information, thereby improving the security detection efficiency while effectively reducing the data maintenance cost of packet maintenance and configuration information maintenance.

[0038] As a first optional implementation of the above step S110, in the process of obtaining the configuration information corresponding to the to-be-processed packet, the access control rule corresponding to the to-be-processed packet can be obtained first, and then the configuration information used for security detection referenced by the access control rule is searched. This implementation can include the following steps.

[0039] Step S111: Obtain the access control rules corresponding to the message to be processed.

[0040] An access control rule (ACR) refers to a specific rule in an access control list (ACL). An ACL is a set of access control rules. These rules can be used by devices such as firewalls, switches, and egress routers. These devices can perform access control and management operations on data traffic based on the access control rules in the ACL.

[0041] An implementation example of the above-mentioned step S111 is: an electronic device (such as a firewall) receives a message to be processed from a physical interface, and obtains an access control rule (ACR) corresponding to the message to be processed from an access control list (ACL). For example: if the quintuple of the message to be processed matches the quintuple in the access control rule (ACR) (also known as the message to be processed hits the ACR), it is determined that the message to be processed corresponds to the access control rule (ACR), and the access control rule (ACR) corresponding to the message to be processed can be obtained from the access control list (ACL); wherein each access control rule can reference a configuration information for security detection.

[0042] Step S112: searching for configuration information corresponding to the access control rule in the configuration information database to obtain the configuration information corresponding to the message to be processed. The configuration information database stores the corresponding relationship between the access control rule and the configuration information.

[0043] An example of an implementation of the above step S112 is: since each access control rule can reference a configuration information for security detection, the access control rule and the configuration information can be one-to-one corresponding. The configuration information corresponding to the access control rule (ACR) is searched in the configuration information library to obtain the configuration information corresponding to the message to be processed. The corresponding relationship between the access control rule and the configuration information is stored in the configuration information library. The above configuration information library can adopt a relational database and / or an in-memory database. The relational databases that can be used include Mysql, PostgreSQL, Oracle and SQLSever, etc., and the in-memory databases that can be used include Memcached and Redis, etc.

[0044] As a second optional implementation of the above step S110, in the process of obtaining the configuration information corresponding to the message to be processed, the corresponding configuration information can be directly searched according to the quintuple of the message to be processed. This implementation may include:

[0045] Step S113: parse the message to be processed to obtain a quintuple, and search for configuration information corresponding to the quintuple.

[0046] An implementation example of the above-mentioned step S113 is: parsing a quintuple from the message to be processed, and searching for the configuration information corresponding to the quintuple in the configuration information library; wherein the above-mentioned configuration information library can adopt an in-memory database, a relational database and / or a non-relational database, and the in-memory databases that can be used are: Memcached and Redis, etc., the relational databases that can be used are: Mysql, PostgreSQL, Oracle and SQLSever, etc., and the non-relational databases that can be used include: Grakn database, Neo4j graph database, Hadoop subsystem HBase, MongoDB and CouchDB, etc.

[0047] See Figure 2 A schematic diagram of a processing process of a message to be processed provided in an embodiment of the present application is shown; as a first optional implementation of step S120, in the process of encapsulating the configuration information into the message to be processed, the configuration information can be encapsulated before the message header. This implementation may include:

[0048] Step S121: Encapsulate the configuration information before the message header of the message to be processed.

[0049] For example, in the process of encapsulating the configuration information into the message to be processed, the configuration information may be encapsulated in front of the message header, that is, the configuration information may be inserted into the side of the message header away from the message body.

[0050] As a second optional implementation of step S120, or in the process of encapsulating the configuration information into the message to be processed, the configuration information may be encapsulated between the message header and the message body. This implementation may include:

[0051] Step S122: Encapsulate the configuration information between the message header and the message body of the message to be processed.

[0052] For example, in the implementation of the above step S122 , in the process of encapsulating the configuration information into the message to be processed, the configuration information may be encapsulated between the message header and the message body of the message to be processed.

[0053] As a third optional implementation of step S120, or in the process of encapsulating the configuration information into the message to be processed, after the configuration information is encapsulated into the message body, this implementation may include:

[0054] Step S123: Encapsulate the configuration information after the message body of the message to be processed.

[0055] For example, in the process of encapsulating the configuration information into the message to be processed, the configuration information may be encapsulated after the message body of the message to be processed, that is, the configuration information may be inserted into the message body away from the message header.

[0056] As an optional implementation of step S130, the implementation of forwarding the encapsulated message to the target process may include:

[0057] Step S131: The encapsulated message is stored in the kernel protocol stack maintained by the operating system.

[0058] Implementation methods of step S131 include: a first implementation method, utilizing the operating system's message communication mechanism to store the encapsulated message in the kernel protocol stack; for example, utilizing the operating system's message communication mechanism to parse a five-tuple from the encapsulated message, then establishing a session connection based on the five-tuple, thereby storing the encapsulated message containing the configuration information in the kernel protocol stack's session connection data structure. A second implementation method, utilizing a custom virtual interface to store the encapsulated message in the kernel protocol stack; for example, utilizing a custom virtual interface in a pre-defined programming language to store the encapsulated message in the kernel protocol stack. Usable programming languages ​​include C, C++, Java, BASIC, JavaScript, LISP, Shell, Perl, Ruby, Python, and PHP.

[0059] Step S132: Obtain the encapsulated message from the kernel protocol stack maintained by the operating system through the target process.

[0060] For example, in the implementation of step S132, after the encapsulated message is stored in the session connection data structure of the kernel protocol stack, the operating system (e.g., the Linux operating system) creates a kernel session connection based on the session connection data structure in the kernel protocol stack. During the process of creating the kernel session connection, the operating system can assign the acquired configuration information to the session connection data structure (e.g., the struct sk_buff structure) in the kernel protocol stack. It is understandable that, since after the configuration information is assigned to the kernel protocol stack, the operating system's message pointer is offset backward according to the data transmission content it points to, it is possible to prevent messages sent to the kernel protocol stack for processing from causing protocol stack processing exceptions, thereby ensuring that the five-tuple sent to the kernel protocol stack for processing is the same as the five-tuple during security testing, and that the messages in the kernel protocol stack are automatically released and recycled by the operating system after their lifecycle ends, thereby avoiding the situation where a large amount of computing resources are consumed to maintain the configuration information, thereby reducing the data maintenance costs for message maintenance and configuration information maintenance.

[0061] As an optional implementation of step S130, the implementation of security detection of the target process may include:

[0062] Step S133: Determine whether configuration information is parsed from the encapsulated message.

[0063] An example of an implementation of the above-mentioned step S133 is as follows: the target process may obtain kernel monitoring information and determine whether a new encapsulated message is stored in the kernel protocol stack based on the kernel monitoring information. If it is determined that a new encapsulated message is stored in the kernel protocol stack based on the kernel monitoring information, the configuration information is parsed according to a preset format. The preset format here may be a pre-negotiated proxy security module detection record format. A specific parsing process is as follows: the target process may obtain kernel monitoring information from the kernel session connection process, parse the configuration information in the session connection data structure (e.g., struct sk_buff structure) from the kernel monitoring information, create a struct sock structure, and finally assign the configuration information in the structsk_buff structure to the struct sock structure of the target process.

[0064] Step S134: If the configuration information is parsed from the encapsulated message, the target process parses the encapsulated message to obtain a message to be processed, and uses the configuration information to perform a security check on the message to be processed to obtain a security check result.

[0065] An implementation example of the above-mentioned step S134 is as follows: if the target process can obtain the configuration information stored in the struct sock structure through the sock_getsockopt interface of the network socket (Networksocket), the target process parses the message to be processed from the encapsulated message, and uses the configuration information to perform a security check on the message to be processed to obtain a security check result. Then, the target process forwards, discards, cleans, etc. the message to be processed according to the security check result.

[0066] As an optional implementation of step S130, after determining whether the configuration information is parsed from the encapsulated message, if it is determined that the configuration information is not parsed, the message may be directly forwarded. This implementation may include:

[0067] Step S135: If no configuration information is parsed out from the encapsulated message, the message to be processed is parsed out from the encapsulated message, and the message to be processed is forwarded according to the quintuple of the message to be processed.

[0068] The implementation method of the above step S135 is, for example: if the configuration information stored in the struct sock structure cannot be obtained through the sock_getsockopt interface, the target process parses the to-be-processed message from the encapsulated message and forwards the to-be-processed message according to the quintuple of the to-be-processed message.

[0069] As an optional implementation of the above step S130, after obtaining the security detection result in the above step S134, if it is determined that it is a malicious attack, the to-be-processed message may be discarded or cleaned. This implementation may include:

[0070] Step S136: If the security detection result indicates that a malicious attack exists, the message to be processed is discarded, or the message to be processed is cleaned.

[0071] The implementation method of the above step S136 is, for example: if the security detection result shows that there is a malicious attack, the target process directly discards the message to be processed, or the target process cleans the message to be processed to obtain a cleaning result.

[0072] See Figure 3 FIG2 is a schematic diagram showing the structure of a safety detection device provided in an embodiment of the present application; an embodiment of the present application provides a safety detection device 200, comprising:

[0073] The configuration information acquisition module 210 is used to obtain configuration information corresponding to the message to be processed.

[0074] The encapsulated message obtaining module 220 is configured to encapsulate the configuration information into the message to be processed to obtain an encapsulated message.

[0075] The message security detection module 230 is used to forward the encapsulated message to the target process through the kernel protocol stack maintained by the operating system, so that the target process performs security detection on the message to be processed according to the configuration information in the encapsulated message.

[0076] Optionally, in an embodiment of the present application, the configuration information acquisition module includes:

[0077] The control rule acquisition submodule is used to obtain the access control rules corresponding to the message to be processed.

[0078] The configuration information search submodule is used to search for configuration information corresponding to the access control rule in the configuration information library, and obtain the configuration information corresponding to the message to be processed. The configuration information library stores the corresponding relationship between the access control rule and the configuration information.

[0079] Optionally, in an embodiment of the present application, the encapsulated message obtaining module includes:

[0080] The first message encapsulation submodule is used to encapsulate the configuration information before the message header of the message to be processed.

[0081] Alternatively, the second message encapsulation submodule is configured to encapsulate the configuration information between the message header and the message body of the message to be processed.

[0082] Alternatively, the third message encapsulation submodule is configured to encapsulate the configuration information after the message body of the message to be processed.

[0083] Optionally, in an embodiment of the present application, the message security detection module includes:

[0084] The encapsulated message storage submodule is used to store the encapsulated message in the kernel protocol stack maintained by the operating system.

[0085] The encapsulated message acquisition submodule is used to obtain the encapsulated message from the kernel protocol stack maintained by the operating system through the target process.

[0086] Optionally, in an embodiment of the present application, the message security detection module includes:

[0087] The configuration information parsing submodule is used to determine whether the configuration information is parsed from the encapsulated message.

[0088] The message processing detection submodule is used to parse the configuration information from the encapsulated message, parse the message to be processed from the encapsulated message through the target process, and use the configuration information to perform security detection on the message to be processed to obtain a security detection result.

[0089] Optionally, in the embodiment of the present application, the message security detection module further includes:

[0090] The message forwarding submodule is used to parse the message to be processed from the encapsulated message if the configuration information is not parsed from the encapsulated message, and forward the message to be processed according to the quintuple of the message to be processed.

[0091] Optionally, in the embodiment of the present application, the message security detection module further includes:

[0092] The message discarding and cleaning submodule is used to discard the message to be processed, or to clean the message to be processed if the security detection result shows that there is a malicious attack.

[0093] It should be understood that the device corresponds to the above-mentioned security detection method embodiment and can perform each step involved in the above-mentioned method embodiment. The specific functions of the device can be found in the description above. To avoid repetition, a detailed description is appropriately omitted here. The device includes at least one software function module that can be stored in a memory in the form of software or firmware or fixed in the operating system (OS) of the device.

[0094] See Figure 4 The electronic device 300 provided in the embodiment of the present application includes a processor 310 and a memory 320, wherein the memory 320 stores machine-readable instructions executable by the processor 310, and when the machine-readable instructions are executed by the processor 310, the method described above is performed.

[0095] The embodiment of the present application further provides a computer-readable storage medium 330 , on which a computer program is stored. When the computer program is run by the processor 310 , the above method is executed.

[0096] Among them, the computer-readable storage medium 330 can be implemented by any type of volatile or non-volatile storage device or a combination thereof, such as static random access memory (SRAM), electrically erasable programmable read-only memory (EEPROM), erasable programmable read-only memory (EPROM), programmable read-only memory (PROM), read-only memory (ROM), magnetic memory, flash memory, disk or optical disk.

[0097] It should be noted that the various embodiments in this specification are described in a progressive manner, with each embodiment focusing on the differences from other embodiments. Similarities between the various embodiments can be referred to in conjunction with each other. For device embodiments, since they are generally similar to method embodiments, their description is relatively simple, and for relevant details, reference can be made to the description of the method embodiments.

[0098] In the several embodiments provided in the embodiments of the present application, it should be understood that the disclosed devices and methods can also be implemented in other ways. The device embodiments described above are only schematic. For example, the flowcharts and block diagrams in the accompanying drawings show the possible implementation architectures, functions and operations of the devices, methods and computer program products according to the multiple embodiments of the embodiments of the present application. In this regard, each box in the flowchart or block diagram can represent a module, a program segment or a part of a code, and a module, a program segment or a part of a code contains one or more executable instructions for implementing a specified logical function. It should also be noted that in some alternative implementations, the functions marked in the box can also be different from the order of occurrence marked in the accompanying drawings. For example, two consecutive boxes can actually be executed substantially in parallel, and they can sometimes be executed in the opposite order, which is mainly based on the functions involved.

[0099] In addition, the functional modules of each embodiment in the embodiments of the present application can be integrated together to form an independent part, or each module can exist separately, or two or more modules can be integrated to form an independent part. In addition, in the description of this specification, the description with reference to the terms "one embodiment", "some embodiments", "example", "specific example", or "some examples" means that the specific features, structures, materials or characteristics described in conjunction with the embodiment or example are included in at least one embodiment or example of the embodiments of the present application. In this specification, the schematic representation of the above terms does not necessarily refer to the same embodiment or example. Moreover, the specific features, structures, materials or characteristics described can be combined in an appropriate manner in any one or more embodiments or examples. In addition, those skilled in the art can combine and combine the different embodiments or examples described in this specification and the features of the different embodiments or examples, without contradicting each other.

[0100] The above description is only an optional implementation method of the embodiment of the present application, but the protection scope of the embodiment of the present application is not limited to this. Any technician familiar with this technical field can easily think of changes or replacements within the technical scope disclosed in the embodiment of the present application, and they should all be covered by the protection scope of the embodiment of the present application.

Claims

1. A safety detection method, characterized in that: include: Obtain the configuration information corresponding to the message to be processed; Encapsulating the configuration information into the message to be processed to obtain an encapsulated message; Forwarding the encapsulated message to a target process through a kernel protocol stack maintained by an operating system, so that the target process performs security detection on the message to be processed according to configuration information in the encapsulated message; Among them, the target process performs a security check on the message to be processed according to the configuration information in the encapsulated message, including: judging whether the configuration information is parsed from the encapsulated message; if so, parsing the message to be processed from the encapsulated message by the target process, and using the configuration information to perform a security check on the message to be processed to obtain a security check result.

2. The method according to claim 1, characterized in that The obtaining of configuration information corresponding to the message to be processed includes: Obtain the access control rules corresponding to the message to be processed; The configuration information corresponding to the access control rule is searched in a configuration information library to obtain the configuration information corresponding to the message to be processed, wherein the configuration information library stores the corresponding relationship between the access control rule and the configuration information.

3. The method according to claim 2, characterized in that The encapsulating the configuration information into the message to be processed includes: Encapsulating the configuration information before the message header of the message to be processed; Alternatively, encapsulating the configuration information between the message header and the message body of the message to be processed; Alternatively, the configuration information is encapsulated after the message body of the message to be processed.

4. The method according to claim 1, wherein The kernel protocol stack maintained by the operating system forwards the encapsulated message to the target process, including: Storing the encapsulated message in a kernel protocol stack maintained by the operating system; The encapsulated message is obtained from a kernel protocol stack maintained by the operating system through the target process.

5. The method according to claim 1, wherein After determining whether the configuration information is parsed from the encapsulated message, the method further includes: If the configuration information is not parsed out from the encapsulated message, the message to be processed is parsed out from the encapsulated message, and the message to be processed is forwarded according to the quintuple of the message to be processed.

6. The method according to claim 1, characterized in that After obtaining the safety test result, the method further includes: If the security detection result indicates that a malicious attack exists, the message to be processed is discarded, or the message to be processed is cleaned.

7. A safety detection device, characterized in that: include: A configuration information acquisition module is used to obtain configuration information corresponding to the message to be processed; An encapsulated message obtaining module, configured to encapsulate the configuration information into the message to be processed to obtain an encapsulated message; A message security detection module is used to forward the encapsulated message to a target process through a kernel protocol stack maintained by an operating system, so that the target process performs a security detection on the message to be processed according to the configuration information in the encapsulated message; Among them, the target process performs a security check on the message to be processed according to the configuration information in the encapsulated message, including: judging whether the configuration information is parsed from the encapsulated message; if so, parsing the message to be processed from the encapsulated message by the target process, and using the configuration information to perform a security check on the message to be processed to obtain a security check result.

8. An electronic device, characterized in that: include: A processor and a memory, wherein the memory stores machine-readable instructions executable by the processor, and when the machine-readable instructions are executed by the processor, the method according to any one of claims 1 to 6 is performed.

9. A computer-readable storage medium, characterized in that The computer-readable storage medium stores a computer program, and when the computer program is executed by a processor, the method according to any one of claims 1 to 6 is executed.

Images