Intrusion detection method and device, electronic equipment and computer readable storage medium

Abstract

The application provides an intrusion detection method and device, electronic equipment and a computer readable storage medium, and belongs to the technical field of computers. The intrusion detection method comprises: acquiring a data packet; determining a maximum depth parameter in depth parameters corresponding to all attack features in a preset attack rule library; and detecting the data packet based on the maximum depth parameter and the attack features in the attack rule library to obtain a detection result. The maximum depth parameter in the depth parameters corresponding to all attack features in the preset attack rule library and the attack features in the attack rule library are used to detect the data packet, the detection depth when different attack features are detected is improved, and the data packet can be detected more comprehensively.

Description

TECHNICAL FIELD

[0001] The present application relates to the technical field of computers, in particular to an intrusion detection method and device, an electronic device and a computer readable storage medium. BACKGROUND

[0002] When a user uses an electronic device to access the Internet, an intrusion detection device is generally deployed to detect possible attack behaviors in the traffic generated when accessing the Internet. A security researcher can analyze attack features specific to a type of attack according to traffic in a real attack behavior, and record the attack features in an attack rule library in a text manner.

[0003] When an intrusion detection device detects a data packet in traffic, it reads a preset number of bytes of content in the data packet, and matches the part of the content with attack features in an attack rule library. If the matching is successful, it is considered that the data packet has an attack behavior. In the process of researching the present application, the present inventors have found that the existing detection method cannot comprehensively detect attack behaviors in data packets. SUMMARY

[0004] The present application provides an intrusion detection method, device, electronic device and computer readable storage medium to solve the problem that the existing detection method cannot comprehensively detect attack behaviors in data packets.

[0005] In a first aspect, the present application provides an intrusion detection method, comprising: obtaining a data packet; determining a maximum depth parameter in depth parameters corresponding to all attack features in a preset attack rule library; and detecting the data packet based on the maximum depth parameter and the attack features in the attack rule library to obtain a detection result.

[0006] In the embodiments of the present application, the maximum depth parameter in the depth parameters corresponding to all attack features in the preset attack rule library and the attack features in the attack rule library are used to detect a data packet, which improves the detection depth when different attack features are detected, so that the data packet can be more comprehensively detected.

[0007] In some possible implementation manners, the determination of the maximum depth parameter in the depth parameters corresponding to all attack features in the preset attack rule library comprises: randomly obtaining and recording two depth parameters from the attack rule library, deleting the smallest depth parameter in the recorded two depth parameters; randomly obtaining and recording a depth parameter from the remaining depth parameters in the attack rule library, deleting the smallest depth parameter in the recorded two depth parameters, until there is no remaining depth parameter in the attack rule library, and the maximum depth parameter finally recorded is the maximum depth parameter.

[0008] In the embodiments of the present application, by recording two depth parameters and deleting the smallest depth parameter, the recorded depth parameter can always be greater than all the deleted depth parameters. Therefore, when there is no remaining depth parameter in the attack rule library, the recorded maximum depth parameter is the maximum depth parameter in the attack rule library. By traversing all the depth parameters, the accuracy of the final maximum depth parameter is ensured.

[0009] In combination with the technical solution provided by the above first aspect, in some possible implementation manners, if the maximum depth parameter is the maximum depth parameter among the depth parameters corresponding to all attack features in the attack rule library, the detection of the data packet based on the maximum depth parameter and the attack features in the attack rule library to obtain a detection result comprises: obtaining the content with the byte number being the maximum depth parameter in the data packet, and respectively matching the content with all attack features in the attack rule library to obtain the detection result.

[0010] In the embodiments of the present application, when the maximum depth parameter is the maximum depth parameter among the depth parameters corresponding to all attack features in the attack rule library, the maximum depth parameter is used as the byte number detected when all attack features are detected, which improves the detection depth when different attack features are detected, so that the data packet can be more comprehensively detected.

[0011] In combination with the technical solution provided by the above first aspect, in some possible implementation manners, if the maximum depth parameter is the maximum parameter among the depth parameters corresponding to all attack features under the same type in the attack rule library, the detection of the data packet based on the maximum depth parameter and the attack features in the attack rule library to obtain a detection result comprises: for each type, obtaining the content with the byte number being the maximum depth parameter corresponding to the type in the data packet, and respectively matching the content with all attack features under the type to obtain the detection result.

[0012] In the embodiments of the present application, by using the maximum depth parameter corresponding to different types as the byte number detected when all attack features of the type are detected, the attack behavior of the type can be more comprehensively detected. Meanwhile, different maximum depth parameters corresponding to different attack types can reduce the amount of calculation required when matching the attack features corresponding to part of the types, and improve the matching efficiency.

[0013] In conjunction with the technical solution provided in the first aspect above, in some possible implementations, the attack rule base further includes the protocol type used for each attack feature to attack. Determining the maximum depth parameter among all depth parameters corresponding to all attack features in the preset attack rule base includes: obtaining the target protocol type corresponding to the data packet; determining the maximum depth parameter based on the depth parameters corresponding to all attack features in the attack rule base used to attack the target protocol type; correspondingly, detecting the data packet based on the maximum depth parameter and the attack features in the attack rule base to obtain a detection result includes: obtaining the content in the data packet whose byte count is equal to the maximum depth parameter, and matching this content with all attack features in the attack rule base used to attack the target protocol type to obtain the detection result.

[0014] In this embodiment of the application, by obtaining the target protocol type corresponding to the data packet, it is not necessary to match the data packet with attack features that are not used to attack the target protocol type during subsequent matching, thereby reducing the matching time and improving the matching efficiency.

[0015] Secondly, this application provides an intrusion detection device, comprising: an acquisition module, a determination module, and a processing module. The acquisition module is used to acquire data packets; the determination module is used to determine the maximum depth parameter among the depth parameters corresponding to all attack features in a preset attack rule base; and the processing module is used to detect the data packets based on the maximum depth parameter and the attack features in the attack rule base to obtain a detection result.

[0016] In conjunction with the technical solution provided in the second aspect above, in some possible implementations, if the maximum depth parameter is the maximum depth parameter among all attack features in the attack rule base, the processing module is specifically used to obtain the content in the data packet whose byte count is the maximum depth parameter, and match the content with all attack features in the attack rule base respectively to obtain the detection result.

[0017] In conjunction with the technical solution provided in the second aspect above, in some possible implementations, if the maximum depth parameter is the maximum parameter among the depth parameters corresponding to all attack features of the same type in the attack rule base, the processing module is specifically used to obtain, for each type, the content in the data packet whose byte count is the maximum depth parameter corresponding to that type, and match the content with all attack features of that type respectively to obtain the detection result.

[0018] Thirdly, embodiments of this application also provide an electronic device, including: a memory and a processor, the memory and the processor being connected; the memory being used to store a program; the processor being used to invoke the program stored in the memory to perform a method provided as described in the first aspect embodiments and / or in combination with any possible implementation of the first aspect embodiments.

[0019] Fourthly, embodiments of this application also provide a computer-readable storage medium having a computer program stored thereon, wherein the computer program, when run by a computer, performs the method provided by any possible implementation of the first aspect embodiments and / or in combination with the first aspect embodiments. Attached Figure Description

[0020] To more clearly illustrate the technical solutions of the embodiments of this application, the accompanying drawings used in the embodiments will be briefly introduced below. It should be understood that the following drawings only show some embodiments of this application and should not be regarded as a limitation of the scope. For those skilled in the art, other related drawings can be obtained based on these drawings without creative effort.

[0021] Figure 1 This is a flowchart illustrating the first intrusion detection method according to an embodiment of this application;

[0022] Figure 2 This is a flowchart illustrating a second intrusion detection method according to an embodiment of this application;

[0023] Figure 3 This is a structural block diagram of an intrusion detection device shown in an embodiment of this application;

[0024] Figure 4 This is a structural block diagram of an electronic device shown in an embodiment of this application. Detailed Implementation

[0025] The technical solutions in the embodiments of this application will now be described with reference to the accompanying drawings.

[0026] It should be noted that similar reference numerals and letters in the following figures denote similar items; therefore, once an item is defined in one figure, it does not need to be further defined and explained in subsequent figures. Furthermore, relational terms such as "first," "second," etc., in the description of this application are used merely to distinguish one entity or operation from another, and do not necessarily require or imply any such actual relationship or order between these entities or operations. Moreover, the terms "comprising," "including," or any other variations thereof are intended to cover non-exclusive inclusion, such that a process, method, article, or apparatus that comprises a list of elements includes not only those elements but also other elements not expressly listed, or elements inherent to such a process, method, article, or apparatus. Without further limitations, an element defined by the phrase "comprising one…" does not exclude the presence of other identical elements in the process, method, article, or apparatus that includes said element.

[0027] Furthermore, the term "and / or" in this application is merely a description of the relationship between related objects, indicating that there can be three relationships. For example, A and / or B can represent three situations: A exists alone, A and B exist simultaneously, and B exists alone.

[0028] The technical solution of this application will now be described in detail with reference to the accompanying drawings.

[0029] In view of the problems existing in the prior art, the inventors, after careful research, discovered that the number of bytes read from data packets by existing intrusion detection devices is usually determined by a preset depth parameter, with different attack features corresponding to different depth parameters. That is, when detecting data packets, for each attack feature, the data packet is detected using the depth parameter corresponding to that attack feature and the attack feature itself.

[0030] For example, if the attack rule base records an attack feature with the field "AAAAA" and its corresponding depth parameter is 100, the intrusion detection device will read the first 100 bytes of the data packet and match the read content with "AAAAA". If the read content contains the "AAAAA" field, then the data packet contains an attack.

[0031] However, the location of the same attack signature in a data packet is not fixed. Therefore, when matching data packets using the depth parameter corresponding to the attack signature, there may be cases where the attack signature cannot be detected because the amount of content read is too small.

[0032] It should be noted that the defects in the above solutions are the result of the inventors' practice and careful research. Therefore, the discovery process of the above problems and the solutions proposed by the inventors in the embodiments of the present invention below should be considered as contributions made by the inventors to the present invention.

[0033] Based on this, this solution provides an intrusion detection method that uses the maximum depth parameter among all attack features in the attack rule base as the final depth parameter for detecting data packets, thereby enabling more comprehensive detection of data packets and improving detection accuracy.

[0034] For easier understanding, please refer to Figure 1 , Figure 1 This is a flowchart illustrating an intrusion detection method according to an embodiment of this application. The following will be combined with... Figure 1 The steps involved are explained.

[0035] S100: Get data packets.

[0036] The data packets can be pre-acquired and stored in a database, and can be directly called when needed, or they can be obtained in real time when needed.

[0037] S200: Determine the maximum depth parameter among all depth parameters corresponding to all attack features in the preset attack rule base.

[0038] For different implementation scenarios, there are three ways to determine the maximum depth parameter among all the depth parameters corresponding to all attack features in the preset attack rule base.

[0039] In the first implementation, the maximum depth parameter is the maximum depth parameter among all the depth parameters corresponding to all attack features in the attack rule base.

[0040] One way to determine the maximum depth parameter from all depth parameters corresponding to all attack features in the attack rule base is to sort all depth parameters corresponding to all attack features in the attack rule base according to their numerical values, thereby obtaining the maximum depth parameter among all depth parameters corresponding to all attack features in the attack rule base.

[0041] For example, if the attack rule base includes five attack features A, B, C, D, and E, and the depth parameters corresponding to A, B, C, D, and E are 100, 120, 140, 110, and 130 respectively, then 100, 120, 140, 110, and 130 can be sorted in descending order. The sorted depth parameters are 140, 130, 120, 110, and 100. Thus, it can be determined that the maximum depth parameter among all attack features in the attack rule base is 140.

[0042] Alternatively, one could first randomly select and record two depth parameters from the attack rule base, then delete the smaller of the two recorded depth parameters. Then, randomly select and record one depth parameter from the remaining depth parameters in the attack rule base, deleting the smaller of the two recorded depth parameters, until no depth parameters remain in the attack rule base. The largest depth parameter recorded at the end is the maximum depth parameter.

[0043] For example, if the attack rule base includes five attack features: A, B, C, D, and E, and the corresponding depth parameters for A, B, C, D, and E are 100, 120, 140, 110, and 130 respectively, then we can first obtain and record the depth parameters for A and B, i.e., record 100 and 120. Then, we delete the 100 from the two recorded depth parameters, leaving a depth parameter of 120. This example is for illustrative purposes only and should not be construed as a limitation of this application.

[0044] Then, obtain and record a depth parameter 140 from the remaining depth parameters 140, 110, and 130. Then delete the smaller of the two recorded depth parameters 140 and 120, 120. At this point, the recorded depth parameter is 140.

[0045] Then, obtain and record a depth parameter 110 from the remaining depth parameters 110 and 130. Then delete the smaller of the two recorded depth parameters 140 and 110, 110. At this time, the recorded depth parameter is 140.

[0046] Finally, obtain and record the depth parameter 130 from the remaining depth parameters 130, and then delete the smaller of the two recorded depth parameters 130 and 140. At this point, the recorded depth parameter is 140. Alternatively, after obtaining and recording the depth parameter 130, directly compare the two recorded depth parameters 130 and 140 to obtain the largest depth parameter 140. 140 is the largest depth parameter among all attack features in the attack rule base.

[0047] The examples provided are for illustrative purposes only and should not be construed as limiting the scope of this application.

[0048] In addition to the method described above for determining the maximum depth parameter among all attack features in the attack rule base, other methods can also be used to determine the maximum depth parameter. No restrictions are placed on the specific method for determining the maximum depth parameter here.

[0049] In the second implementation, the attack rule base also includes the type corresponding to each attack feature. In this case, the maximum depth parameter can be the maximum parameter among the depth parameters corresponding to all attack features of the same type in the attack rule base.

[0050] Since different attack features of the same type may exist in different locations within data packets, by using the maximum depth parameter among all depth parameters corresponding to attack features of the same type in the attack rule base as the maximum depth parameter, a more comprehensive detection of that type of attack behavior can be achieved when matching data packets using this maximum depth parameter and the attack features of that type. Furthermore, different attack types correspond to different maximum depth parameters, which can reduce the computational load required for matching attack features corresponding to certain types, thus improving matching efficiency.

[0051] The types of attack features can include password intrusion, Trojans, WWW spoofing, node attacks, network eavesdropping, etc. There are no restrictions on the specific types of attack features.

[0052] For ease of understanding, the attack rule base is set to include five attack features: A, B, C, D, and E. Attack features A and B belong to the password intrusion type, while attack features C, D, and E belong to the Trojan type. The depth parameters corresponding to A, B, C, D, and E are 100, 120, 140, 110, and 130, respectively.

[0053] At this point, for the password intrusion type, the attack features corresponding to this type are identified as A and B. Therefore, the maximum depth parameter 120 is determined from the depth parameters corresponding to attack features A and B respectively.

[0054] For each Trojan type, the corresponding attack features are identified as C, D, and E. Therefore, the maximum depth parameter 140 is determined from the depth parameters corresponding to each of the attack features C, D, and E.

[0055] The specific process of determining the maximum depth parameter among all attack features under each type is the same as the aforementioned method of determining the maximum depth parameter from all attack features in the attack rule base. For the sake of brevity, it will not be elaborated here.

[0056] The examples provided are for illustrative purposes only and should not be construed as limiting the scope of this application.

[0057] In the third implementation, the attack rule base also includes the protocol type used for each attack feature. In this case, the process of determining the maximum depth parameter among all the depth parameters corresponding to all attack features in the preset attack rule base can be as follows: first, obtain the target protocol type corresponding to the data packet, and then determine the maximum depth parameter according to the depth parameters corresponding to all attack features used for attacking the target protocol type in the attack rule base.

[0058] By obtaining the target protocol type corresponding to the data packet, it is not necessary to match the data packet with attack features that are not used to attack the target protocol type when performing subsequent matching based on depth parameters. This reduces the matching time and improves matching efficiency.

[0059] The protocol type can include HTTP (Hypertext Transfer Protocol) and HTTPS (Hypertext Transfer Protocol Secure). No specific restriction is placed on the protocol type here.

[0060] For ease of understanding, the attack rule base is set to include five attack features: A, B, C, D, and E. Attack features A and B are used to attack the HTTP protocol, while attack features C, D, and E are used to attack the HTTPS protocol. The depth parameters corresponding to A, B, C, D, and E are 100, 120, 140, 110, and 130, respectively.

[0061] At this point, the target protocol type corresponding to the data packet is first detected. If the target protocol type is HTTP, the attack features corresponding to this type of protocol are determined from the attack rule base, including A and B. Therefore, the maximum depth parameter 120 is determined from the depth parameters corresponding to attack features A and B respectively.

[0062] If the target protocol type is HTTPS, the attack features corresponding to this type of protocol are determined from the attack rule base, including C, D, and E. Therefore, the maximum depth parameter 140 is determined from the depth parameters corresponding to each of the attack features C, D, and E.

[0063] The specific process of determining the maximum depth parameter among all attack features under each protocol type is the same as the aforementioned method of determining the maximum depth parameter from all attack features in the attack rule base. For the sake of brevity, it will not be elaborated here.

[0064] The examples provided are for illustrative purposes only and should not be construed as limiting the scope of this application.

[0065] S300: Based on the maximum depth parameter and attack characteristics in the attack rule base, it detects data packets and obtains detection results.

[0066] Depending on the different ways of determining the maximum depth parameter in S200, the specific process of detecting data packets and obtaining detection results based on the maximum depth parameter and attack characteristics in the attack rule base can also be implemented in the following three ways.

[0067] In the first implementation, if the maximum depth parameter is the maximum depth parameter among all attack features in the attack rule base, then the specific process of detecting the data packet based on the maximum depth parameter and the attack features in the attack rule base to obtain the detection result can be as follows: first, obtain the content in the data packet whose number of bytes is the maximum depth parameter, and then match the content with all attack features in the attack rule base to obtain the detection result.

[0068] To facilitate understanding, we will take an example where the maximum depth parameter among all attack features in the attack rule base is 150, and the attack rule base includes five attack features: A, B, C, D, and E.

[0069] First, the first 150 bytes of the data packet are retrieved. Then, attack features A, B, C, D, and E are matched against these 150 bytes. If attack feature A is not present in these 150 bytes, it is determined that the data packet does not contain any attack behavior corresponding to attack feature A. If attack feature A is present in these 150 bytes, it is determined that the data packet contains any attack behavior corresponding to attack feature A. Similarly, if one or more of attack features B, C, D, and E are present in these 150 bytes, it can be confirmed that the data packet contains attack behaviors corresponding to other attack features. The method for determining whether attack behaviors corresponding to attack features B, C, D, and E exist in the data packet is the same as the method for determining whether attack behaviors corresponding to attack feature A exist in the data packet. For brevity, it will not be elaborated here.

[0070] The examples provided are for illustrative purposes only and should not be construed as limiting the scope of this application.

[0071] In the second implementation, if the maximum depth parameter is the largest parameter among all depth parameters corresponding to all attack features of the same type in the attack rule base, then the specific process of detecting the data packet based on the maximum depth parameter and the attack features in the attack rule base to obtain the detection result can be as follows: for each type, obtain the content in the data packet whose number of bytes is the maximum depth parameter corresponding to that type, and match the content with all attack features of that type to obtain the detection result.

[0072] For ease of understanding, the attack rule base is set to include two types of attack features: password intrusion and Trojan horse. Attack features A and B belong to the password intrusion type, while attack features C, D, and E belong to the Trojan horse type. The maximum depth parameter corresponding to the password intrusion type is 120, and the maximum depth parameter corresponding to the Trojan horse type is 140.

[0073] At this point, for the password intrusion type, the first 120 bytes of the data packet are obtained, and then attack features A and B are matched with these 120 bytes of content to obtain the first matching result.

[0074] For each Trojan type, the first 140 bytes of the data packet are retrieved. Then, attack features C, D, and E are matched against these 140 bytes to obtain a second matching result. This matching result includes both the first matching structure and the second matching result.

[0075] The specific implementation method and principle of matching attack features A and B with the content of these 120 bytes respectively to obtain the first matching result, and matching attack features C, D, and E with the content of these 140 bytes respectively to obtain the second matching result, are the same as the specific implementation method and principle of matching attack features A, B, C, D, and E with the content of these 150 bytes respectively in the first implementation method. For the sake of brevity, they will not be repeated here.

[0076] The examples provided are for illustrative purposes only and should not be construed as limiting the scope of this application.

[0077] In the third implementation, if the maximum depth parameter is the maximum depth parameter among all attack features corresponding to the target protocol type, then the specific process of detecting the data packet based on the maximum depth parameter and the attack features in the attack rule base to obtain the detection result can be as follows: First, obtain the content in the data packet whose number of bytes is the maximum depth parameter, and then match the content with all attack features in the attack rule base for the target protocol type to obtain the detection result.

[0078] For ease of understanding, the attack rule base is set to include attack features for attacking HTTP and HTTPS protocols. Attack features A and B are used to attack the HTTP protocol, and attack features C, D, and E are used to attack the HTTPS protocol. The maximum depth parameter among all depth parameters corresponding to all attack features used to attack the HTTP protocol is 120, and the maximum depth parameter among all depth parameters corresponding to all attack features used to attack the HTTPS protocol is 140.

[0079] If the target protocol type corresponding to the data packet is HTTP, then the first 120 bytes of the data packet are obtained, and then attack features A and B are matched with these 120 bytes of content to obtain the matching results.

[0080] If the target protocol type corresponding to the data packet is HTTPS, then the first 140 bytes of the data packet are obtained, and the attack features C, D, and E are matched with these 140 bytes of the data packet to obtain the matching results.

[0081] The specific implementation method and principle of matching attack features A and B with the content of these 120 bytes respectively to obtain matching results, and matching attack features C, D, and E with the content of these 140 bytes respectively to obtain matching results, are the same as the specific implementation method and principle of matching attack features A, B, C, D, and E with the content of these 150 bytes respectively in the first implementation method. For the sake of brevity, they will not be described in detail here.

[0082] The examples provided are for illustrative purposes only and should not be construed as limiting the scope of this application.

[0083] To further understand the intrusion detection methods described above, please refer to [link / reference]. Figure 2 It should be noted that, Figure 2 The principle shown is one of many embodiments of the intrusion detection method of this application; therefore, it cannot be generalized. Figure 2 The manner shown is to be understood as a limitation of this application.

[0084] First, the data packets are acquired, and then the target protocol type corresponding to the data packets is obtained. Next, all attack features used to attack the target protocol type are identified from the attack rule base. Then, the maximum depth parameter among all attack features belonging to the same type is determined. Finally, for each type, the content in the data packet with the number of bytes corresponding to the maximum depth parameter for that type is obtained, and this content is matched against all attack features under that type to obtain the detection results.

[0085] For ease of understanding, the attack rule base is set to include five attack features: A, B, C, D, E, F, G, H, and I. Attack features A, B, C, D, and E are used to attack the HTTP protocol, while attack features F, G, H, and I are used to attack the HTTPS protocol. Attack features A, B, F, and G belong to the password intrusion type, while attack features C, D, E, H, and I belong to the Trojan type. The depth parameters corresponding to A, B, C, D, E, F, G, H, and I are 100, 120, 140, 110, 130, 110, 150, 120, and 130, respectively.

[0086] At this point, the target protocol type corresponding to the data packet is first detected. If the target protocol type is HTTP, the attack characteristics corresponding to this type of protocol are determined from the attack rule base, including A, B, C, D, and E, as well as their respective depth parameters 100, 120, 140, 110, and 130.

[0087] For the password intrusion type, the corresponding attack features are identified as A and B. Therefore, the maximum depth parameter of 120 is determined from the depth parameters corresponding to attack features A and B respectively. For the Trojan type, the corresponding attack features are identified as C, D, and E. Therefore, the maximum depth parameter of 140 is determined from the depth parameters corresponding to attack features C, D, and E respectively.

[0088] Next, the first 120 bytes of the data packet are retrieved, and attack features A and B are matched against these 120 bytes to obtain the first matching result. Then, the first 140 bytes of the data packet are retrieved, and attack features C, D, and E are matched against these 140 bytes to obtain the second matching result. The matching result includes both the first matching structure and the second matching result.

[0089] If the target protocol type is HTTPS, the attack characteristics corresponding to this type of protocol are determined from the attack rule base, including F, G, H, and I, as well as their respective depth parameters 110, 150, 120, and 130.

[0090] For password intrusion types, the corresponding attack characteristics are identified as F and G. Therefore, the maximum depth parameter 150 is determined from the depth parameters 110 and 150 corresponding to attack characteristics F and G, respectively. For Trojan types, the corresponding attack characteristics are identified as H and I. Therefore, the maximum depth parameter 130 is determined from the depth parameters 120 and 130 corresponding to attack characteristics H and I, respectively.

[0091] Next, the first 150 bytes of the data packet are retrieved, and then attack features F and G are matched against these 150 bytes to obtain the first matching result. Then, the first 130 bytes of the data packet are retrieved, and then attack features H and I are matched against these 130 bytes to obtain the second matching result. The matching result includes both the first matching structure and the second matching result.

[0092] The examples provided are for illustrative purposes only and should not be construed as limiting the scope of this application.

[0093] Please see Figure 3 , Figure 3 An intrusion detection device 100 is shown in the embodiment of this application. The intrusion detection device 100 includes an acquisition module 110, a determination module 120 and a processing module 130.

[0094] Module 110 is used to acquire data packets.

[0095] The determination module 120 is used to determine the maximum depth parameter among all depth parameters corresponding to all attack features in the preset attack rule base.

[0096] The processing module 130 is used to detect the data packet based on the maximum depth parameter and the attack features in the attack rule base, and obtain the detection result.

[0097] The determination module 120 is specifically used to randomly obtain and record two depth parameters from the attack rule base, delete the smallest depth parameter among the two recorded depth parameters; randomly obtain and record one depth parameter from the remaining depth parameters in the attack rule base, delete the smallest depth parameter among the two recorded depth parameters, until there are no remaining depth parameters in the attack rule base, and the largest depth parameter finally recorded is the maximum depth parameter.

[0098] If the maximum depth parameter is the maximum depth parameter among all attack features in the attack rule base, the processing module 130 is specifically used to obtain the content in the data packet whose number of bytes is the maximum depth parameter, and match the content with all attack features in the attack rule base to obtain the detection result.

[0099] If the maximum depth parameter is the maximum parameter among all depth parameters corresponding to the same type of attack features in the attack rule base, the processing module 130 is specifically used to obtain, for each type, the content in the data packet whose number of bytes is the maximum depth parameter corresponding to that type, and match the content with all attack features under that type to obtain the detection result.

[0100] The attack rule base also includes the protocol type used for each attack feature. The determination module 120 is specifically used to obtain the target protocol type corresponding to the data packet; and to determine the maximum depth parameter based on the depth parameters corresponding to all attack features used to attack the target protocol type in the attack rule base. Correspondingly, the processing module 130 is specifically used to obtain the content in the data packet whose byte count is equal to the maximum depth parameter, and to match this content with all attack features used to attack the target protocol type in the attack rule base to obtain the detection result.

[0101] The intrusion detection device 100 provided in this application embodiment has the same implementation principle and technical effect as the aforementioned intrusion detection method embodiment. For the sake of brevity, any parts not mentioned in the device embodiment can be referred to the corresponding content in the aforementioned intrusion detection method embodiment.

[0102] Please see Figure 4 This is an electronic device 200 provided in the embodiments of this application. The electronic device 200 includes: a transceiver 210, a memory 220, a communication bus 230, and a processor 240.

[0103] The transceiver 210, memory 220, and processor 240 are electrically connected directly or indirectly to achieve data transmission or interaction. For example, these components can be electrically connected to each other through one or more communication buses 230 or signal lines. The transceiver 210 is used to send and receive data. The memory 220 is used to store computer programs, such as... Figure 3 The software functional module shown is the intrusion detection device 100. The intrusion detection device 100 includes at least one software functional module that can be stored in the memory 220 in the form of software or firmware, or embedded in the operating system (OS) of the electronic device 200. The processor 240 is used to execute executable modules stored in the memory 220, such as the software functional modules or computer programs included in the intrusion detection device 100. In this case, the processor 240 is used to acquire data packets; determine the maximum depth parameter among all depth parameters corresponding to attack features in a preset attack rule base; and detect the data packets based on the maximum depth parameter and the attack features in the attack rule base to obtain a detection result.

[0104] The memory 220 may be, but is not limited to, random access memory (RAM), read-only memory (ROM), programmable read-only memory (PROM), erasable programmable read-only memory (EPROM), electrically erasable programmable read-only memory (EEPROM), etc.

[0105] Processor 240 may be an integrated circuit chip with signal processing capabilities. The aforementioned processor can be a general-purpose processor, including a Central Processing Unit (CPU), a Network Processor (NP), etc.; it can also be a Digital Signal Processor (DSP), an Application Specific Integrated Circuit (ASIC), a Field Programmable Gate Array (FPGA), or other programmable logic devices, discrete gate or transistor logic devices, or discrete hardware components. It can implement or execute the methods, steps, and logic block diagrams disclosed in the embodiments of this application. The general-purpose processor can be a microprocessor, or processor 240 can be any conventional processor.

[0106] Among them, the aforementioned electronic devices 200 include, but are not limited to, personal computers, servers, etc.

[0107] This application also provides a non-volatile computer-readable storage medium (hereinafter referred to as the storage medium) storing a computer program. When the computer program is executed by a computer, such as the electronic device 200 described above, it performs the intrusion detection method described above. The computer-readable storage medium includes various media capable of storing program code, such as a USB flash drive, a portable hard drive, a read-only memory (ROM), a random access memory (RAM), a magnetic disk, or an optical disk.

[0108] The above description is merely a preferred embodiment of this application and is not intended to limit this application. Various modifications and variations can be made to this application by those skilled in the art. Any modifications, equivalent substitutions, improvements, etc., made within the spirit and principles of this application should be included within the protection scope of this application.

Claims

1. An intrusion detection method, characterized in that, include: Get data packets; Determine the maximum depth parameter among all depth parameters corresponding to all attack features in the preset attack rule base; Based on the maximum depth parameter and the attack features in the attack rule base, the data packet is detected to obtain the detection result; If the maximum depth parameter is the largest among the depth parameters corresponding to all attack features of the same type in the attack rule base, the detection of the data packet based on the maximum depth parameter and the attack features in the attack rule base to obtain the detection result includes: For each type, the content in the data packet whose number of bytes corresponds to the maximum depth parameter of that type is obtained, and this content is matched with all attack features under that type to obtain the detection result.

2. The method according to claim 1, characterized in that, The determination of the maximum depth parameter among all depth parameters corresponding to attack features in the preset attack rule base includes: Two depth parameters are randomly obtained and recorded from the attack rule base, and the smallest depth parameter among the two recorded depth parameters is deleted. A depth parameter is randomly selected from the remaining depth parameters in the attack rule base and recorded. The smallest depth parameter among the two recorded depth parameters is deleted until there are no remaining depth parameters in the attack rule base. The largest depth parameter recorded at the end is the maximum depth parameter.

3. The method according to claim 1, characterized in that, The attack rule base also includes the protocol type used for each attack feature, and determining the maximum depth parameter among all depth parameters corresponding to all attack features in the preset attack rule base includes: Obtain the target protocol type corresponding to the data packet; The maximum depth parameter is determined based on the depth parameters corresponding to all attack features used to attack the target protocol type in the attack rule base. Accordingly, the detection of the data packet based on the maximum depth parameter and the attack features in the attack rule base, to obtain the detection result, includes: The content in the data packet whose number of bytes is equal to the maximum depth parameter is obtained, and this content is matched with all attack features in the attack rule base used to attack the target protocol type to obtain the detection result.

4. An intrusion detection device, characterized in that, include: The acquisition module is used to acquire data packets; The determination module is used to determine the maximum depth parameter among all depth parameters corresponding to all attack features in the preset attack rule base; The processing module is used to detect the data packet based on the maximum depth parameter and the attack features in the attack rule base, and obtain the detection result; If the maximum depth parameter is the maximum parameter among all depth parameters corresponding to the same type of attack features in the attack rule base, the processing module is specifically used to obtain, for each type, the content in the data packet whose number of bytes is the maximum depth parameter corresponding to that type, and match the content with all attack features under that type to obtain the detection result.

5. An electronic device, characterized in that, include: A memory and a processor, wherein the memory and the processor are connected; The memory is used to store programs; The processor is configured to invoke a program stored in the memory to perform the method as described in any one of claims 1-3.

6. A computer-readable storage medium, characterized in that, It stores a computer program, which, when executed by a computer, performs the method as described in any one of claims 1-3.

Images