Defence rule generation method, apparatus and storage medium

Abstract

This application provides a method, device, and storage medium for generating defense rules. In this application embodiment, multi-level feature extraction is performed on the application layer data of acquired abnormal packets to obtain multi-level features of the abnormal packets. Then, based on the multi-level features of the abnormal packets, defense rules conforming to the syntax format supported by the firewall can be generated, and these defense rules are published to the firewall for network protection. The defense rules generated in this application embodiment include multi-level features of abnormal packets mined from the application layer data of the abnormal packets, making the defense rules more comprehensive. When using these defense rules for network protection, the packets to be detected can be inspected from multiple dimensions, reducing the probability of network attacks bypassing the defense rules and helping to reduce the probability of missed network attack packets.

Description

Technical Field

[0001] This application relates to the field of network security technology, and in particular to a method, device and storage medium for generating defense rules. Background Technology

[0002] With the development and popularization of computer networks, various illegal network attacks such as hacking and worms are becoming increasingly rampant. In order to protect computer networks and systems, firewalls have emerged. A firewall can allow or restrict the transmission of data according to specific rules.

[0003] Firewalls offer some protection against network attacks, but traditional firewalls have relatively simple defense rules against network attacks, leading to some attack traffic going undetected. Summary of the Invention

[0004] This application provides a method, device, and storage medium for generating defense rules to reduce the false negative rate of attack traffic.

[0005] This application provides a method for generating defense rules, including: Obtain the exception message; Multi-level feature extraction is performed on the application layer data of the abnormal message to obtain the multi-level features of the abnormal message; Based on the multi-layered characteristics of the abnormal messages and the syntax format supported by the firewall, defense rules with the syntax format are generated.

[0006] This application embodiment also provides a computing device, including: a memory and a processor; the memory is used to store computer programs; The processor is coupled to the memory and is used to execute the computer program to perform the steps in the above-described defense rule generation method.

[0007] This application also provides a computer-readable storage medium storing computer instructions, which, when executed by one or more processors, cause the one or more processors to perform the steps in the above-described defense rule generation method.

[0008] In this embodiment, multi-level feature extraction is performed on the application layer data of the acquired abnormal packets to obtain multi-level features of the abnormal packets. Then, based on these multi-level features, defense rules conforming to the syntax format supported by the firewall can be generated, and these defense rules are published to the firewall for network protection. The defense rules generated in this embodiment include multi-level features of abnormal packets mined from the application layer data, making the defense rules more comprehensive. When using these defense rules for network protection, the packets to be detected can be inspected from multiple dimensions, reducing the probability of network attacks bypassing the defense rules and helping to reduce the probability of missed network attack packets. Attached Figure Description

[0009] The accompanying drawings, which are included to provide a further understanding of this application and form part of this application, illustrate exemplary embodiments and are used to explain this application, but do not constitute an undue limitation of this application. In the drawings: Figure 1 A flowchart illustrating the process of generating defense rules for traditional solutions; Figure 2 A flowchart illustrating the defense rule generation method provided in this application embodiment; Figure 3 A schematic diagram illustrating the specific process of generating defense rules provided in this application embodiment; Figure 4 A schematic diagram of the structure of a computing device provided in an embodiment of this application. Detailed Implementation

[0010] To make the objectives, technical solutions, and advantages of this application clearer, the technical solutions of this application will be clearly and completely described below in conjunction with specific embodiments and corresponding drawings. Obviously, the described embodiments are only a part of the embodiments of this application, and not all of them. Based on the embodiments in this application, all other embodiments obtained by those skilled in the art without creative effort are within the scope of protection of this application.

[0011] Firewalls can allow or restrict data transmission according to specific defense rules. In traditional solutions, this can be achieved by extracting the longest common subsequence (LCS) of the traffic data. The Longest Common Subsequence (LCS) problem is used to find the longest subsequence among all sequences in a set of sequences (usually two sequences). A sequence X is called the longest common subsequence of the known sequences if it is a subsequence of two or more known sequences, and is the longest of all sequences satisfying this condition.

[0012] Furthermore, the longest common subsequence can be used to generate defense rules that conform to the syntax format supported by the firewall; then, these defense rules are used by the firewall for network protection. Specifically, Figure 1 A flowchart illustrating the process of generating defense rules for traditional solutions. (Example) Figure 1 As shown, the main steps for generating defense rules using traditional methods are as follows: 101. Obtain attack packets collected offline. Attack packets refer to pre-labeled packets used for network attacks.

[0013] 102. According to the set message clustering algorithm, cluster the attack messages to obtain multiple message clusters. Each message cluster includes at least one attack message.

[0014] Among them, message clustering algorithms may include: tree-based message classification algorithms, geometric space-based message classification algorithms, or heuristic message classification algorithms, etc.

[0015] 103. For each packet cluster, extract the longest common subsequence of attack packets in each packet cluster.

[0016] 104. Generate defense rules that conform to the syntax format supported by the firewall based on the longest common subsequence of attack packets in each packet cluster.

[0017] Based on the defense rules generated by the aforementioned traditional schemes, in network security protection, the packet to be detected can be matched with the longest common subsequence contained in the defense rules through multi-modal matching. If the packet to be detected contains a key feature that matches the longest common subsequence contained in the defense rules, the packet to be detected is restricted from passing. If the packet to be detected does not contain a key feature that matches the longest common subsequence contained in the defense rules, the packet to be detected is allowed to pass. However, the inventors of this application have discovered that the key features of some network attack packets are not common subsequences contained in the defense rules, which will cause the defense rules generated by the traditional schemes to fail to intercept such network attack packets, resulting in missed detection of attack traffic.

[0018] To address the technical problems of traditional solutions, some embodiments of this application, in order to reduce the probability of missed attack traffic detection, perform multi-level feature extraction on the application layer data of the acquired abnormal packets to obtain multi-level features of the abnormal packets. Then, based on the multi-level features of the abnormal packets, defense rules conforming to the syntax format supported by the firewall can be generated, and these defense rules can be published to the firewall for network protection. The defense rules generated by the embodiments of this application include multi-level features of abnormal packets mined from the application layer data of the abnormal packets, making the defense rules more comprehensive. When using these defense rules for network protection, the packets to be detected can be inspected from multiple dimensions, reducing the probability of network attacks bypassing the defense rules and helping to reduce the probability of missed network attack packets.

[0019] The technical solutions provided by the various embodiments of this application are described in detail below with reference to the accompanying drawings.

[0020] It should be noted that the same reference numerals denote the same object in the following figures and embodiments. Therefore, once an object is defined in one figure or embodiment, it does not need to be discussed further in subsequent figures and embodiments.

[0021] Figure 2 This is a flowchart illustrating the defense rule generation method provided in an embodiment of this application. Figure 2 As shown, the method mainly includes the following steps: 201. Obtain abnormal messages.

[0022] 202. Perform multi-level feature extraction on the application layer data of abnormal messages to obtain multi-level features of abnormal messages.

[0023] 203. Generate defense rules with grammatical format based on the multi-layered characteristics of abnormal messages and the syntax format supported by the firewall.

[0024] Since abnormal packets can reflect the characteristics of network attack packets to a certain extent, abnormal packets can be obtained in step 201. In this embodiment, the specific implementation method for obtaining abnormal packets is not limited.

[0025] In some embodiments, the defense rule generation method provided in this application can be used offline to generate defense rules. Correspondingly, abnormal packets collected offline can be obtained as abnormal packets in step 201. These offline-collected abnormal packets may be manually labeled abnormal packets, or packets already blocked by an existing firewall, but are not limited to these. For embodiments that generate defense rules offline, the abnormal packets may be attack packets. In this application embodiment, the firewall may be a cloud firewall or a firewall deployed locally on a computing device.

[0026] In other embodiments, the defense rule generation method provided in this application can be used online to generate defense rules. Correspondingly, the abnormal packets are those captured online. Specifically, a pre-set anomaly detection model can be used to perform anomaly detection on packets received by the firewall; if the anomaly detection model outputs a result indicating that the packets received by the firewall are abnormal, then the packets received by the firewall are determined to be abnormal packets.

[0027] Optionally, a pre-configured anomaly detection model can be used to detect the source of packets received by the firewall; if the source of the packet is a pre-marked anomaly source, the packet is determined to be an anomalous packet. The source of the packet can be represented by the source Internet Protocol (IP) address and / or source port number. Correspondingly, the pre-marked anomaly source can be a known anomalous source IP address and / or source port number. For example, a known anomalous source IP address may include: a source IP address captured by a botnet / worm monitoring system, and / or a source IP address captured by a vulnerability scanner. A known anomalous source port number may be a specific port corresponding to a high-risk asset, etc.

[0028] Specifically, for embodiments where the source of a message is represented by its source IP address, the source IP address of the message received by the firewall can be used to query among known abnormal source IP addresses; if the source IP address of the message received by the firewall is found among the known abnormal source IP addresses, it is determined that the message received by the firewall is an abnormal message.

[0029] For embodiments where the source of a message is represented by a source port number, the source port number of the message received by the firewall can be used to query among known abnormal source port numbers; if the source port number of the message received by the firewall is found among the known abnormal source port numbers, it is determined that the message received by the firewall is an abnormal message.

[0030] For embodiments where the source of a packet is indicated by its source IP address and source port number, the source IP address and source port number of the packet received by the firewall can be used to query for known abnormal source IP addresses and known abnormal source port numbers. If the source IP address of the packet received by the firewall is found in the known abnormal source IP addresses, and / or the source port number of the packet received by the firewall is found in the known abnormal source port numbers, the packet received by the firewall is determined to be an abnormal packet.

[0031] The term "offline" is used in contrast to "online." "Online" refers to the generation of defense rules in real-time or near real-time during the firewall's online operation. "Offline" refers to generating defense rules offline, separate from the firewall's online operation, and then publishing these rules to the firewall for detection or blocking of packets acquired online.

[0032] The specific implementation methods for obtaining abnormal messages shown in the above embodiments are merely illustrative and do not constitute a limitation.

[0033] Because the rules constructed from the outer layer information of the Open System Interconnection (OSI) model are coarse-grained, network attacks can easily bypass these rules, making it impossible for firewalls to intercept attack traffic. To generate finer-grained defense rules, in step 202 of this embodiment, multi-level feature extraction can be performed on the application layer data of abnormal packets to obtain multi-level features of the abnormal packets. Here, the application layer refers to the application layer in the OSI model, which is an interface between network services and end users. This is mainly because application layer data can extract more and finer-grained information, helping to reduce the possibility of network attack traffic bypassing the rules.

[0034] In this embodiment, multi-level features refer to the feature information of abnormal packets at multiple levels, which can reflect the characteristics of abnormal packets from multiple perspectives. Packets that match these features have a higher probability of being abnormal packets. Therefore, network protection can be carried out based on the multi-level features known to be abnormal packets.

[0035] In this embodiment, the specific content of the extracted multi-level features is not limited. Optionally, the multi-level features of the abnormal message may include at least two of the following: the metadata of the abnormal message, the protocol type, the structural pattern of the payload, and the vulnerability type of the abnormal message.

[0036] Metadata for abnormal packets refers to data describing the attributes of the abnormal packets, which may include: the direction of the abnormal packet, the encoding method, special characters contained in the abnormal packet, and the corresponding data unit of the packet. The direction of the abnormal packet refers to whether the abnormal packet is sent from an asset protected by the firewall or sent to an asset protected by the firewall. For packets sent from assets protected by the firewall, the packet direction can be defined as outgoing (OUT); for packets sent to assets protected by the firewall, the packet direction can be defined as incoming (IN).

[0037] The encoding method of an exception message refers to the encoding method of the application layer data of the exception message, that is, what encoding algorithm is used.

[0038] The special characters contained in the error message can be determined based on the pre-configured special characters. The special characters belonging to the pre-configured special characters can be extracted from the error message, that is, the number of special characters contained in the error message can be obtained.

[0039] The data unit corresponding to an exception message refers to whether the exception message is a single packet or a stream message. A single packet message means that data is transmitted using individual data packets. A stream message refers to a message with a larger data volume, where the data to be transmitted is divided into individual data packets and sent sequentially using a data stream method.

[0040] Based on the specific implementation of the above multi-level features, step 202 above, which extracts multi-level features from the application layer data of the abnormal message, can be implemented in at least two of the following feature extraction methods: Feature extraction method 1: Extract the metadata of the abnormal message from the abnormal message as one of the multi-level features.

[0041] Metadata of an abnormal message refers to data that describes the attributes of the abnormal message, which may include: the direction of the abnormal message, the encoding method, the special characters contained in the abnormal message, and the data unit corresponding to the message.

[0042] The direction of an abnormal message refers to whether the abnormal message originated from an asset protected by the firewall or was sent to an asset protected by the firewall. For messages originating from assets protected by the firewall, the message direction can be defined as outgoing (OUT); for messages sent to assets protected by the firewall, the message direction can be defined as incoming (IN).

[0043] To determine the direction of an abnormal message, the starting line of the abnormal message can be obtained, and the direction can be determined based on the content of the starting line. Specifically, if the starting line of the abnormal message contains a direction identifier, the direction of the abnormal message is determined to be inflow; if the starting line of the abnormal message contains a status code, the direction of the abnormal message is determined to be outflow.

[0044] The encoding method of an exception message refers to the encoding method of the application layer data of the exception message, that is, what encoding algorithm is used.

[0045] Since different encoding methods result in different character composition patterns, a correspondence between encoding methods and character composition patterns can be pre-defined. Based on this correspondence, the characters in the exception message can be matched against the character composition patterns included in the correspondence to determine the character composition pattern that the exception message characters match; and the encoding method corresponding to the character composition pattern that the exception message characters match is determined as the encoding method for the exception message.

[0046] The special characters contained in the error message can be determined based on pre-configured special characters. Specifically, characters belonging to pre-configured special characters can be extracted from the error message, i.e., the number of special characters contained in the error message can be obtained.

[0047] The data unit corresponding to an abnormal message refers to whether the abnormal message is a single packet or a stream message. To determine the data unit of an abnormal message, Protocol Control Information (N_PCI) can be obtained from the message header; and based on the Protocol Control Information, it can be determined whether the abnormal message is a single packet or a stream message. The Protocol Control Information identifies the data unit of the message.

[0048] The metadata of the above-mentioned abnormal messages, and the method of obtaining the metadata, are for illustrative purposes only and do not constitute a limitation.

[0049] Feature extraction method 2: Determine the protocol type of the abnormal message as one of the multi-level features.

[0050] In some embodiments, the abnormal message can be parsed to obtain the message header; the protocol type field can be extracted from the message header; and the protocol type of the abnormal message can be determined according to the values ​​of the protocol type fields at each level.

[0051] The protocol type of the abnormal message can be any one of the following: Hypertext Transfer Protocol (HTTP), Internet Control Message Protocol (ICMP), Internet Group Management Protocol (IGMP), Transmission Control Protocol (TCP), and User Datagram Protocol (UDP).

[0052] In other embodiments, deep packet inspection (DPI) technology can also be used to parse abnormal messages and obtain the payload of the abnormal messages; then, the protocol type of the abnormal message can be determined based on the character characteristics of the payload of the abnormal message.

[0053] Feature extraction method 3: Determine the protocol type of the abnormal message; and according to the protocol type of the abnormal message, use the protocol type adaptation parsing method to parse the abnormal message to obtain the payload of the abnormal message; based on the payload of the abnormal message, determine the structural pattern of the payload as one of the multi-level features.

[0054] For details on the specific implementation methods for determining the protocol type and payload of abnormal messages, please refer to the relevant content of Feature Extraction 2 above, which will not be repeated here.

[0055] Based on the payload of the anomaly message, the payload's structural pattern can be determined. The payload's structural pattern refers to the data storage or organization structure of the payload. The payload's structural pattern can be a key-value (KV) pattern or a non-KV pattern.

[0056] Because data is encoded during message transmission, the payload of an error message is actually the encoded characters of the transmitted content (i.e., application data). The payload structure specifically refers to the structure of the application data encapsulated within the payload. However, in actual message transmission, the payload transmits not only the encoded characters of the application data but also some useless characters.

[0057] To improve the accuracy of the determined payload structure pattern, the coded characters corresponding to the application data can be extracted from the payload of the error message. Optionally, the file format of the application data encapsulated in the payload can be obtained from the error message. The file format is a special encoding method used by a computer to store information and is used to identify internally stored data.

[0058] For HTTP protocol error messages, file formats can be Extensible Markup Language (XML), Hypertext Markup Language (HTML), text, JavaScript Object Notation (JSON), Graphic Interchange Format (GIF), etc. For non-HTTP protocol error messages, file formats can be Portable Document Format (PDF), Word document format, or PowerPoint presentation file, etc.

[0059] Furthermore, a target invalid character recognition model corresponding to the file format of the application data can be obtained from multiple invalid character recognition models corresponding to various preset file formats. Then, the target invalid character recognition model can be used to identify invalid characters contained in the encoded characters corresponding to the payload. Further, invalid characters can be removed from the encoded characters corresponding to the payload to obtain the encoded characters corresponding to the application data.

[0060] Furthermore, the structural pattern of the payload can be determined based on the attribute distribution characteristics of the encoded characters in the application data. Optionally, it can be determined whether the attribute distribution characteristics of the encoded characters corresponding to the application data satisfy the distribution characteristics of a key-value pair (KV) structure; if so, the structural pattern of the payload is determined to be a KV pattern. Correspondingly, if the attribute distribution characteristics of the encoded characters corresponding to the application data do not satisfy the distribution characteristics of a key-value pair structure, the structural pattern of the payload is determined to be a non-KV pattern.

[0061] Feature extraction method 4: Decode the payload of the abnormal message to obtain the application data encapsulated in the payload; the payload includes the encoded characters of the application data; based on the application data, determine the vulnerability type corresponding to the abnormal message as one of the multi-level features.

[0062] The vulnerability type refers to the type of attack that exploits vulnerabilities in assets protected by the firewall. This can include, but is not limited to, buffer overflows, SQL injection, cross-site request forgery, file inclusion, file reading, directory traversal attacks, remote code execution, arbitrary file uploads and deserialization, etc. For details on the implementation methods for extracting the payload of abnormal messages, please refer to the relevant content in feature extraction method 3 above; it will not be repeated here.

[0063] In some embodiments, a decoding method for decoding the abnormal message can be determined based on the encoding method of the abnormal message determined in feature extraction method 1 above; and the payload of the abnormal message can be decoded using the decoding method; if decoding is successful, the application data encapsulated in the payload is obtained. If decoding fails, multiple pre-set decoding methods can be used to decode the payload of the abnormal message one by one, that is, multiple pre-set decoding methods can be used to brute-force decode the payload of the abnormal message to obtain the application data encapsulated in the payload of the abnormal message.

[0064] In this application embodiment, the specific content of the various pre-set decoding methods is not limited. In some embodiments, for text data message protocols, decoding methods such as Base64, Uniform Resource Locator (URL) decoding (urldecode), Unicode, and Unicode Transformation Format (UTF-8) can be set. For binary data message protocols, decoding methods such as No Operation (NOP) and Exclusive OR (XOR) can be set.

[0065] In other embodiments, to reduce the computational load of decoding operations and improve decoding efficiency, encoded characters corresponding to application data can be extracted from the payload when decrypting the payload of abnormal messages. For specific implementation methods of extracting encoded characters corresponding to application data from the payload, please refer to the relevant content in feature extraction method 3 above, which will not be repeated here.

[0066] Furthermore, based on the payload's structural pattern, target encoded characters are obtained from the encoded characters corresponding to the application data. These target encoded characters include a portion of the encoded characters in the application data. The target encoded characters are the encoded characters containing valuable data within the application data. For a key-value (KV) pattern, the valuable data is the value within the KV. For a non-KV pattern, the valuable data can be pre-set key information.

[0067] Accordingly, for embodiments where the payload's structural mode is KV mode, the encoded characters corresponding to the values ​​in the key-value pairs contained in the application data can be extracted from the encoded characters corresponding to the application data and used as the target encoded characters.

[0068] For embodiments where the payload structure is not in key-value (KV) mode, the encoded characters corresponding to the application data can be structured according to the data structure supported by the protocol type of the exception message to obtain encoded characters organized according to the data structure supported by the protocol type of the exception message. The data structure supported by the protocol type is a way for computers to store and organize data, and can be: array, stack, queue, linked list, tree, graph, heap, or hash table, etc. This is mainly because non-KV mode payloads store the encoded characters corresponding to the application data in natural language, which computers cannot recognize. Therefore, it is necessary to structure the encoded characters corresponding to the application data to convert them into a data structure supported by the protocol type of the exception message.

[0069] Furthermore, encoded characters belonging to preset key information can be extracted from encoded characters organized according to the data structure supported by the protocol type of the abnormal message, and used as target encoded characters.

[0070] After obtaining the target encoded characters, they can be decoded to obtain the target application data corresponding to the target encoded characters in the application data. The target application data is a portion of the application data. For specific implementation methods of decoding the target encoded characters, please refer to the above-mentioned content on decoding the payload, which will not be repeated here. Because valuable data encapsulated in the payload is extracted and only the valuable data is decoded, the computational load of decoding can be reduced, and decoding efficiency can be improved.

[0071] For embodiments where the payload's structure is KV (Key-Value) mode, the target encoded character is the encoded character of the value in the key-value pair encapsulated in the payload. Correspondingly, the encoded character of the value in the key-value pair encapsulated in the payload can be decoded to obtain the value in the key-value pair encapsulated in the payload. The value in the key-value pair encapsulated in the payload is the target application data of the target encoded character.

[0072] For embodiments where the payload structure is not in key-value (KV) mode, the target encoded character is the encoded character belonging to preset key information encapsulated in the payload. Accordingly, the encoded character belonging to key information can be decoded to obtain the key information encapsulated in the payload. The key information encapsulated in the payload is the target application data of the target encoded character.

[0073] The inventors of this application have discovered that different vulnerability types have different key characteristics, meaning that the key information (also known as valuable information) carried in the messages of different vulnerability types is different. Based on this, multiple vulnerability types can be pre-defined with their corresponding key characteristics; and these key characteristics can be extracted from the target application data according to the pre-defined key characteristics for each vulnerability type. For any vulnerability type X, if the key characteristics corresponding to vulnerability type X are extracted from the target application data, then the vulnerability type of the abnormal message is determined to be vulnerability type X.

[0074] The above embodiments are merely illustrative examples of the characteristics of application layer data in several abnormal messages, and do not limit the characteristics of application layer data of abnormal data to include only the following characteristics, nor do they limit the implementation of extracting multi-level features of application layer data to the feature extraction methods provided in the above embodiments.

[0075] After determining the multi-level structural characteristics of the abnormal message, in step 203, a defense rule with the syntax format supported by the firewall can be generated based on the multi-level characteristics of the abnormal message.

[0076] Specifically, the logical expressions of multi-level features can be edited according to the syntax format supported by the firewall to obtain the defense rules.

[0077] After generating the defense rules, you can also publish the defense rules to the firewall to use the defense rules for network protection.

[0078] When using defense rules for network protection, multi-level feature extraction can be performed on the application layer data of the target packet received by the firewall to obtain the multi-level features of the target packet. For specific implementation methods of extracting multi-level features of the application layer data of the target packet, please refer to the relevant content on extracting multi-level features of the application layer data of abnormal packets mentioned above, which will not be repeated here.

[0079] Furthermore, security checks can be performed on target packets based on their multi-layered characteristics and pre-set defense rules. Optionally, if the multi-layered characteristics of the target packet satisfy the defense rules, the target packet is considered to have failed the security check and can be intercepted.

[0080] Because the defense rules generated in this application embodiment include multi-level features of abnormal packets mined from application layer data based on abnormal packets, the defense rules are more comprehensive. When using these defense rules for network protection, the packets to be detected can be detected in multiple dimensions, reducing the probability of network attacks bypassing the defense rules and helping to reduce the probability of missed detection of network attack packets.

[0081] In some embodiments, the defense rules can be validated before being published to the firewall. Optionally, the defense rules can be syntax-validated or simulated. Syntax validation refers to verifying whether the syntax of the defense rules conforms to the syntax format supported by the firewall.

[0082] Simulating and validating defense rules refers to verifying whether the defense rules can intercept attack packets. Optionally, attack packets collected offline can be used to simulate and validate the defense rules. For example, multi-level feature extraction can be performed on the application layer data of attack packets collected offline to obtain multi-level features of the attack packets. The number of attack packets collected offline can be one or more. "More than" means two or more. Preferably, the number of attack packets is more than one.

[0083] Based on the multi-layered characteristics of attack packets, it can be determined whether the multi-layered characteristics of attack packets meet the defense rules. If they do, the defense rules are determined to have passed the simulation verification; if they do not, the defense rules are determined to have failed the simulation verification.

[0084] It is worth noting that the abnormal packets obtained in step 201 of the defense rule generation method provided in this application embodiment can be abnormal packets captured online by the firewall. Accordingly, the above-mentioned defense rule generation method is implemented to generate defense rules online in real time, compared to Figure 1The method of generating defense rules based on offline collection of attack packets, as shown, can improve the timeliness of defense rules taking effect and better adapt to vulnerability emergency response scenarios. The defense rule generation method provided in this application generates defense rules in real time based on abnormal packets captured online by the firewall. It can generate rules and publish them online in near real time when attack traffic occurs, which can effectively solve the problem of latency in manual analysis and response.

[0085] Since the defense rule generation method provided in this application is based on abnormal packet generation, it can promptly capture and defend against unknown attack packets that can be identified as abnormal packets by the firewall. Furthermore, it can also promptly generate new defense rules for escape packets that existing firewall defense rules cannot identify, reducing the risk of missed detections.

[0086] It should be noted that the execution subject of each step of the method provided in the above embodiments can be the same device, or the method can be executed by different devices. For example, the execution subject of steps 201 and 202 can be device A; or the execution subject of step 201 can be device A, and the execution subject of step 202 can be device B; and so on.

[0087] Furthermore, some processes described in the above embodiments and accompanying drawings include multiple operations that appear in a specific order. However, it should be clearly understood that these operations may not be executed in the order they appear herein, or they may be executed in parallel. The operation numbers, such as 201, 202, etc., are merely used to distinguish different operations and do not represent any execution order. In addition, these processes may include more or fewer operations, and these operations may be executed sequentially or in parallel.

[0088] The following is combined with Figure 3 The specific embodiments shown illustrate the defense rule generation method provided in this application. For example... Figure 3 As shown, methods for generating protection rules may include: 301. Obtain abnormal messages.

[0089] 302. Extract the metadata of the abnormal message from the abnormal message.

[0090] 303. Determine the protocol type of the abnormal message.

[0091] 304. According to the protocol type of the abnormal message, use the protocol type-adaptive parsing method to parse the abnormal message to obtain the payload of the abnormal message.

[0092] 305. Extract the encoded characters corresponding to the application data from the payload.

[0093] 306. Determine the structural pattern of the payload based on the attribute distribution characteristics of the coded characters corresponding to the application data.

[0094] 307. For a payload structure mode of KV mode, extract the encoded characters corresponding to the values ​​in the key-value pairs from the encoded characters corresponding to the application data, use them as the target encoded characters, and continue to execute step 310.

[0095] 308. For payloads with a non-KV structure, the encoded characters corresponding to the application data are structured according to the data structure supported by the protocol type of the exception message, so as to obtain encoded characters organized according to the data structure supported by the protocol type of the exception message.

[0096] 309. Extract the encoded characters belonging to the preset key information from the encoded characters organized according to the data structure supported by the protocol type of the abnormal message, and use them as the target encoded characters. Continue to execute step 310.

[0097] 310. Decode the target encoded characters to obtain the target application data corresponding to the target encoded characters.

[0098] 311. Based on the key features corresponding to each of the preset vulnerability types, extract the key features corresponding to each of the multiple vulnerability types from the target application data.

[0099] 312. For any vulnerability type X, if the key features corresponding to vulnerability type X are extracted from the target application data, then the vulnerability type of the abnormal message is determined to be vulnerability type X.

[0100] 313. Following the syntax format supported by the firewall, edit the metadata, protocol type, payload structure pattern, and vulnerability type of the abnormal message using logical expressions to obtain the defense rules.

[0101] Accordingly, embodiments of this application also provide a computer-readable storage medium storing computer instructions, which, when executed by one or more processors, cause one or more processors to perform the steps in the above-described defense rule generation method.

[0102] Figure 4 This is a schematic diagram of the structure of a computing device provided in an embodiment of this application. Figure 4 As shown, the computing device may include: a memory 40a and a processor 40b. The memory 40a is used to store computer programs.

[0103] The processor 40b is coupled to the memory 40a and is used to execute computer programs for: acquiring abnormal messages; performing multi-level feature extraction on the application layer data of the abnormal messages to obtain multi-level features of the abnormal messages; and generating defense rules with a syntax format based on the multi-level features of the abnormal messages and the syntax format supported by the firewall.

[0104] In some embodiments, the processor 40b performs multi-level feature extraction on the application layer data of the abnormal message to obtain multi-level features of the abnormal message, specifically by performing at least two of the following feature extraction methods: Extract metadata from abnormal messages as one of the multi-level features; Determine the protocol type of the abnormal message as one of the multi-layered features; According to the protocol type of the abnormal message, the abnormal message is parsed using a protocol type-adaptive parsing method to obtain the payload of the abnormal message; based on the payload, the structural mode of the payload is determined as one of the multi-level features; The payload is decoded to obtain the application data encapsulated in the payload; the payload includes the encoded characters of the application data; based on the application data, the vulnerability type corresponding to the abnormal message is determined as one of the multi-level features.

[0105] Optionally, when determining the structural pattern of the payload based on the payload, the processor 40b is specifically used to: extract the coded characters corresponding to the application data from the payload; and determine the structural pattern of the payload based on the attribute distribution characteristics of the coded characters corresponding to the application data.

[0106] Furthermore, the processor 40b is also used to: obtain the file format of the application data encapsulated in the payload from the exception message; and obtain the target invalid character recognition model corresponding to the file format of the application data from multiple invalid character recognition models corresponding to the preset multiple file formats.

[0107] Accordingly, when the processor 40b extracts the encoded characters corresponding to the application data from the payload, it specifically performs the following: using a target invalid character recognition model to identify invalid characters contained in the encoded characters corresponding to the payload; and removing invalid characters from the encoded characters corresponding to the payload to obtain the encoded characters corresponding to the application data.

[0108] Optionally, when determining the structure pattern of the payload based on the attribute distribution characteristics of the encoded characters corresponding to the application data, the processor 40b is specifically used to: determine whether the attribute distribution characteristics of the encoded characters corresponding to the application data satisfy the distribution characteristics of the key-value pair structure; if so, determine that the structure pattern of the payload is a key-value pair pattern.

[0109] Optionally, when the processor 40b decodes the payload to obtain the application data encapsulated in the payload, it specifically performs the following steps: extracting the encoded characters corresponding to the application data encapsulated in the payload from the payload; obtaining a target encoded character from the encoded characters corresponding to the application data according to the structural pattern of the payload; the target encoded character includes a portion of the encoded characters corresponding to the application data; and decoding the target encoded character to obtain the target application data corresponding to the target encoded character. The target application data is a portion of the application data encapsulated in the payload.

[0110] In some embodiments, the payload's structural pattern is a key-value pair pattern. Accordingly, when the processor 40b obtains the target encoded character from the encoded characters corresponding to the application data according to the payload's structural pattern, it specifically performs the following: extracting the encoded character corresponding to the value in the key-value pair contained in the application data from the encoded characters corresponding to the application data, and using it as the target encoded character.

[0111] Accordingly, when the processor 40b decodes the target encoded characters, it is specifically used to: decode the encoded characters corresponding to the values ​​in the key-value pairs contained in the application data, so as to obtain the values ​​in the key-value pairs as the target application data.

[0112] In other embodiments, the payload's structural pattern is a non-key-value pair pattern. When the processor 40b obtains the target encoded character from the encoded characters corresponding to the application data according to the payload's structural pattern, it specifically performs the following: performs structured processing on the encoded characters corresponding to the application data according to the data structure supported by the protocol type of the exception message, to obtain encoded characters organized according to the data structure supported by the protocol type of the exception message; and extracts encoded characters belonging to preset key information from the encoded characters organized according to the data structure supported by the protocol type of the exception message, as the target encoded character.

[0113] Accordingly, when the processor 40b decodes the target encoded characters, it is specifically used to: decode the encoded characters corresponding to the encoded characters belonging to the preset key information to obtain the key information of the payload encapsulation as the target application data.

[0114] Accordingly, when determining the vulnerability type corresponding to the abnormal message based on the application data, the processor 40b is specifically used to: extract the key features corresponding to each of the multiple vulnerability types from the target application data according to the key features corresponding to each of the multiple preset vulnerability types; for any vulnerability type X, if the key features corresponding to vulnerability type X are extracted from the target application data, then the vulnerability type of the abnormal message is determined to be vulnerability type X.

[0115] In some embodiments, when the processor 40b generates defense rules with a grammatical format based on the multi-layered characteristics of the abnormal message and the grammatical format supported by the firewall, it is specifically used to: edit the logical expression of the multi-layered characteristics according to the grammatical format supported by the firewall to obtain the defense rules.

[0116] Optionally, the processor 40b is also used to: publish defense rules to the firewall to utilize the defense rules for network protection.

[0117] Furthermore, when using defense rules for network protection, processor 40b is specifically used to: extract multi-level features from the application layer data of the target packet received by the firewall to obtain the multi-level features of the target packet; if the multi-level features of the target packet meet the defense rules, the target packet is intercepted.

[0118] Optionally, the processor 40b may acquire abnormal packets by: acquiring abnormal packets collected offline; or, using a pre-set anomaly detection model to perform anomaly detection on the first packet received by the firewall; if the output result of the anomaly detection model indicates anomaly, then the first packet is determined to be an abnormal packet.

[0119] In some alternative implementations, such as Figure 4 As shown, the computing device may further include components such as a communication component 40c and a power supply component 40d. In some embodiments, the computing device may be implemented as a terminal device such as a computer or a mobile phone. Accordingly, the computing device may also include optional components such as a display component 40e and an audio component 40f. Figure 4 The diagram only shows some components and does not mean that the computing device must contain them. Figure 4 The inclusion of all components does not imply that a computing device can only include... Figure 4 The components shown.

[0120] The computing device provided in this embodiment performs multi-level feature extraction on the application layer data of the acquired abnormal packets to obtain multi-level features of the abnormal packets. Then, based on these multi-level features, it can generate defense rules conforming to the syntax format supported by the firewall, and publish these defense rules to the firewall for network protection. The defense rules generated in this embodiment include multi-level features of abnormal packets mined from the application layer data, making the defense rules more comprehensive. When using these defense rules for network protection, the packets to be detected can be inspected from multiple dimensions, reducing the probability of network attacks bypassing the defense rules and helping to reduce the probability of missed network attack packets.

[0121] In this embodiment, the memory is used to store computer programs and can be configured to store various other data to support operation on its host device. The processor can execute the computer programs stored in the memory to implement corresponding control logic. The memory can be implemented by any type of volatile or non-volatile storage device or a combination thereof, such as Static Random-Access Memory (SRAM), Electrically Erasable Programmable Read Only Memory (EEPROM), Electrically Programmable Read Only Memory (EPROM), Programmable Read Only Memory (PROM), Read Only Memory (ROM), magnetic storage, flash memory, magnetic disk, or optical disk.

[0122] In the embodiments of this application, the processor can be any hardware processing device capable of executing the above-described method logic. Optionally, the processor can be a central processing unit (CPU), a graphics processing unit (GPU), or a microcontroller unit (MCU); it can also be a programmable device such as a field-programmable gate array (FPGA), a programmable array logic (PAL), a general array logic (GAL), or a complex programmable logic device (CPLD); or it can be an advanced RISC machine (ARM) or a system on chip (SoC), etc., but is not limited thereto.

[0123] In this embodiment, the communication component is configured to facilitate wired or wireless communication between its host device and other devices. The device hosting the communication component can access wireless networks based on communication standards, such as WiFi, 2G or 3G, 4G, 5G, or combinations thereof. In one exemplary embodiment, the communication component receives broadcast signals or broadcast-related information from an external broadcast management system via a broadcast channel. In another exemplary embodiment, the communication component may also be implemented based on Near Field Communication (NFC), Radio Frequency Identification (RFID), Infrared Data Association (IrDA), Ultra Wideband (UWB), Bluetooth (BT), or other technologies.

[0124] In embodiments of this application, the display component may include a liquid crystal display (LCD) and a touch panel (TP). If the display component includes a touch panel, the display component can be implemented as a touchscreen to receive input signals from a user. The touch panel includes one or more touch sensors to sense touches, swipes, and gestures on the touch panel. The touch sensors can sense not only the boundaries of touch or swipe actions but also the duration and pressure associated with the touch or swipe operation.

[0125] In this embodiment, a power supply component is configured to provide power to various components of the device in which it resides. The power supply component may include a power management system, one or more power supplies, and other components associated with generating, managing, and distributing power to the device in which the power supply component resides.

[0126] In embodiments of this application, the audio component can be configured to output and / or input audio signals. For example, the audio component includes a microphone (MIC), which is configured to receive external audio signals when the device containing the audio component is in an operating mode, such as call mode, recording mode, and voice recognition mode. The received audio signals can be further stored in memory or transmitted via a communication component. In some embodiments, the audio component also includes a speaker for outputting audio signals. For example, in devices with voice interaction capabilities, voice interaction with the user can be achieved through the audio component.

[0127] It should be noted that the terms "first" and "second" in this article are used to distinguish different messages, devices, modules, etc., and do not represent a chronological order, nor do they limit "first" and "second" to different types.

[0128] Those skilled in the art will understand that embodiments of this application can be provided as methods, systems, or computer program products. Therefore, this application can take the form of a completely hardware embodiment, a completely software embodiment, or an embodiment combining software and hardware aspects. Furthermore, this application can take the form of a computer program product implemented on one or more computer-usable storage media (including, but not limited to, disk storage, compact disc read-only memory (CD-ROM), optical storage, etc.) containing computer-usable program code.

[0129] This application is described with reference to flowchart illustrations and / or block diagrams of methods, apparatus (systems), and computer program products according to embodiments of this application. It will be understood that each block of the flowchart illustrations and / or block diagrams, and combinations of blocks in the flowchart illustrations and / or block diagrams, can be implemented by computer program instructions. These computer program instructions can be provided to a processor of a general-purpose computer, special-purpose computer, embedded processor, or other programmable data processing apparatus to produce a machine, such that the instructions, which execute via the processor of the computer or other programmable data processing apparatus, generate instructions for implementing the flowchart... Figure 1 One or more processes and / or boxes Figure 1 A device that provides the functions specified in one or more boxes.

[0130] These computer program instructions may also be stored in a computer-readable storage medium that can direct a computer or other programmable data processing device to function in a particular manner, such that the instructions stored in the computer-readable storage medium produce an article of manufacture including instruction means, which are implemented in a process Figure 1 One or more processes and / or boxes Figure 1 The function specified in one or more boxes.

[0131] These computer program instructions may also be loaded onto a computer or other programmable data processing equipment to cause a series of operational steps to be performed on the computer or other programmable equipment to produce a computer-implemented process, thereby providing instructions that execute on the computer or other programmable equipment for implementing the process. Figure 1 One or more processes and / or boxes Figure 1 The steps of the function specified in one or more boxes.

[0132] In a typical configuration, a computing device includes one or more processors (CPU, etc.), input / output interfaces, network interfaces, and memory.

[0133] Memory may include non-persistent storage in computer-readable media, such as random-access memory (RAM) and / or non-volatile memory, such as read-only memory (ROM) or flash RAM. Memory is an example of computer-readable media.

[0134] Computer storage media are readable storage media, also known as removable media. Removable and non-removable media can be used to store information by any method or technology. Information can be computer-readable instructions, data structures, program modules, or other data. Examples of computer storage media include, but are not limited to, phase-change memory (PRAM), static random access memory (SRAM), dynamic random access memory (DRAM), other types of random access memory (RAM), read-only memory (ROM), electrically erasable programmable read-only memory (EEPROM), flash memory or other memory technologies, CD-ROM, Digital Video Disc (DVD) or other optical storage, magnetic tape, disk storage or other magnetic storage devices, or any other non-transferable medium that can be used to store information accessible by a computing device. As defined herein, computer-readable media does not include transient media, such as modulated data signals and carrier waves.

[0135] It should also be noted that the terms "comprising," "including," or any other variations thereof are intended to cover non-exclusive inclusion, such that a process, method, article, or apparatus that comprises a list of elements includes not only those elements but also other elements not expressly listed, or elements inherent to such process, method, article, or apparatus. Unless otherwise specified, an element defined by the phrase "comprising one..." does not exclude the presence of other identical elements in the process, method, article, or apparatus that includes the aforementioned element.

[0136] The above description is merely an embodiment of this application and is not intended to limit the scope of this application. Various modifications and variations can be made to this application by those skilled in the art. Any modifications, equivalent substitutions, improvements, etc., made within the spirit and principles of this application should be included within the scope of the claims of this application.

Claims

1. A method for generating defense rules, characterized in that, include: Obtain the exception message; Multi-level feature extraction is performed on the application layer data of the abnormal message to obtain the multi-level features of the abnormal message; Based on the multi-layered characteristics of the abnormal message and the syntax format supported by the firewall, generate defense rules with the syntax format. The multi-level features include the structural pattern of the payload of the abnormal message; the structural pattern refers to the data storage or organization pattern of the payload; the multi-level feature extraction of the application layer data of the abnormal message includes: According to the protocol type of the abnormal message, the abnormal message is parsed using the parsing method adapted to the protocol type to obtain the payload of the abnormal message; the payload includes the encoded characters corresponding to the application data; Extract the encoded characters corresponding to the application data from the payload; Determine whether the attribute distribution characteristics of the encoded characters corresponding to the application data satisfy the distribution characteristics of the key-value pair structure; If the conditions are met, the structural pattern of the payload is determined to be a key-value pair pattern.

2. The method according to claim 1, characterized in that, The multi-level feature extraction of the application layer data of the abnormal message to obtain the multi-level features of the abnormal message also includes at least one of the following feature extraction methods: Extract the metadata of the abnormal message from the abnormal message, and use it as one of the multi-level features; The protocol type of the abnormal message is determined as one of the multi-level features; The payload is decoded to obtain the application data encapsulated in the payload; the payload includes the encoded characters of the application data; based on the application data, the vulnerability type corresponding to the abnormal message is determined as one of the multi-level features.

3. The method according to claim 1, characterized in that, Also includes: From the error message, obtain the file format of the application data encapsulated in the payload; From multiple invalid character recognition models corresponding to various preset file formats, obtain the target invalid character recognition model corresponding to the file format of the application data; Extracting the encoded characters corresponding to the application data from the payload includes: Using the target invalid character recognition model, invalid characters contained in the encoded characters corresponding to the payload are identified; The invalid characters are removed from the encoded characters corresponding to the payload to obtain the encoded characters corresponding to the application data.

4. The method according to claim 2, characterized in that, Decoding the payload to obtain the application data encapsulated in the payload includes: Extract the encoded characters corresponding to the application data from the payload; Based on the structural pattern of the payload, a target encoded character is obtained from the encoded characters corresponding to the application data; the target encoded character includes: a portion of the encoded characters in the encoded characters corresponding to the application data. The target encoded character is decoded to obtain the target application data corresponding to the target encoded character; the target application data includes a portion of the application data.

5. The method according to claim 4, characterized in that, The payload has a key-value pair structure. Obtaining the target encoded character from the encoded characters corresponding to the application data based on the payload's structure includes: Extract the encoded characters corresponding to the values ​​in the key-value pairs contained in the application data from the encoded characters corresponding to the application data, and use them as the target encoded characters; Decoding the target encoded character includes: The encoded characters corresponding to the values ​​in the key-value pairs contained in the application data are decoded to obtain the values ​​in the key-value pairs contained in the application data, which are then used as the target application data.

6. The method according to claim 4, characterized in that, The payload has a non-key-value pair structure. The step of obtaining the target encoded character from the encoded characters corresponding to the application data based on the payload's structure includes: According to the data structure supported by the protocol type of the abnormal message, the encoded characters corresponding to the application data are structured to obtain encoded characters organized according to the data structure supported by the protocol type of the abnormal message. Extract the encoded characters belonging to the preset key information from the encoded characters organized according to the data structure supported by the protocol type of the abnormal message, and use them as the target encoded characters; Decoding the target encoded character includes: The encoded characters corresponding to the preset key information are decoded to obtain the key information encapsulated in the payload, which is used as the target application data.

7. The method according to claim 4, characterized in that, The step of determining the vulnerability type corresponding to the abnormal message based on the application data includes: Based on the key features corresponding to each of the preset vulnerability types, extract the key features corresponding to each of the preset vulnerability types from the target application data; For any vulnerability type, if the key features corresponding to any vulnerability type are extracted from the target application data, then the vulnerability type of the abnormal message is determined to be any vulnerability type.

8. The method according to claim 1, characterized in that, The step of generating defense rules with the specified syntax format based on the multi-layered characteristics of the abnormal message and the syntax format supported by the firewall includes: Edit the logical expression of the multi-level features according to the syntax format supported by the firewall to obtain the defense rules.

9. The method according to any one of claims 1-8, characterized in that, Also includes: The defense rules are published to the firewall to provide network protection. The network protection using the aforementioned defense rules includes: Multi-level feature extraction is performed on the application layer data of the target packet received by the firewall to obtain the multi-level features of the target packet; If the multi-layered characteristics of the target packet satisfy the defense rules, the target packet is intercepted.

10. The method according to any one of claims 1-8, characterized in that, The acquisition of abnormal messages includes: Obtain abnormal messages collected offline; or, Using a pre-set anomaly detection model, the first packet received by the firewall is subjected to anomaly detection; if the output result of the anomaly detection model indicates an anomaly, then the first packet is determined to be the anomaly packet.

11. A computing device, characterized in that, include: Memory and processor; The memory is used to store computer programs; The processor is coupled to the memory for executing the computer program to perform the steps of the method according to any one of claims 1-10.

12. A computer-readable storage medium storing computer instructions, characterized in that, When the computer instructions are executed by one or more processors, the one or more processors are caused to perform the steps of the method according to any one of claims 1-10.

Images