Method, apparatus and processing device for deploying intrusion prevention system (IPS) rules

Abstract

The application provides a method and device for deploying an IPS rule and a processing device, which are used for ensuring that an IPS rule is deployed on a target network device more stably and conveniently. The method for deploying an IPS rule provided by the application comprises the following steps: obtaining a target IPS rule which is to be deployed on a target network device; analyzing the target IPS rule and compiling the target IPS rule into a target state machine; and deploying the target state machine in the memory of an IPS rule library of the target network device, so that the target network device loads the rule content of the target IPS rule.

Description

TECHNICAL FIELD

[0001] The present application relates to the field of network security, in particular to a deployment method and device of an intrusion prevention system (IPS) rule and a processing apparatus. BACKGROUND

[0002] Intrusion detection is a network security technology for providing real-time protection for a computer network, which mainly detects current input data in a protected network or a protected host to determine whether the current detection data is legal data or illegal data.

[0003] In the deployment process of the intrusion detection strategy, the IPS rule is uploaded to a network device to be deployed, and the network device parses and compiles the IPS rule into a state machine such as a DFA, and the loaded state machine can be used to identify whether an intrusion event occurs on the device.

[0004] In the research process of the prior art, the inventors found that some network devices cannot complete the compilation of the state machine, so that the deployment or upgrade of the intrusion detection strategy cannot be implemented. SUMMARY

[0005] The present application provides a deployment method and device of an intrusion prevention system (IPS) rule and a processing apparatus, which are used to ensure that the IPS rule is more stably and conveniently deployed on a target network device.

[0006] In a first aspect, the present application provides a deployment method of an intrusion prevention system (IPS) rule, which comprises the following steps.

[0007] Obtaining a target IPS rule to be deployed on a target network device;

[0008] Parsing the target IPS rule and compiling the target IPS rule into a target state machine;

[0009] Deploying the target state machine in a memory of an IPS rule library of the target network device, so that the target network device loads rule content of the target IPS rule.

[0010] In combination with the first aspect of the present application, in a first possible implementation manner of the first aspect of the present application, the step of parsing the target IPS rule and compiling the target IPS rule into a target state machine comprises the following steps.

[0011] Parsing the target IPS rule;

[0012] According to the analysis result, the target IPS rule is split into a plurality of sub-IPS rules;

[0013] The plurality of sub-IPS rules are compiled respectively to obtain a plurality of sub-state machines as the target state machine.

[0014] In combination with the first possible implementation manner of the first aspect of the present application, in the second possible implementation manner of the first aspect of the present application, according to the analysis result, the target IPS rule is split into a plurality of sub-IPS rules, including:

[0015] On the basis of the analysis result, the target IPS rule is split into a plurality of sub-IPS rules according to three dimensions of protocol, direction and port.

[0016] In combination with the first possible implementation manner of the first aspect of the present application, in the third possible implementation manner of the first aspect of the present application, the plurality of sub-IPS rules are compiled respectively to obtain a plurality of sub-state machines, including:

[0017] The plurality of sub-IPS rules are compiled in parallel to obtain a plurality of sub-state machines.

[0018] In combination with the first possible implementation manner of the first aspect of the present application, in the fourth possible implementation manner of the first aspect of the present application, the plurality of sub-IPS rules are compiled respectively to obtain a plurality of sub-state machines, including:

[0019] The plurality of sub-IPS rules are compiled respectively, and in the compiling process, it is judged whether there is a historical rule with the same rule content which has been compiled and is waiting for compiling, if there is, the compiling result of the historical rule is reused to obtain a plurality of sub-state machines.

[0020] In combination with the first aspect of the present application, in the fifth possible implementation manner of the first aspect of the present application, the target state machine is deployed in the memory of the IPS rule library of the target network device, including:

[0021] The target state machine is processed into a file format pre-adapted for the IPS rule library to obtain a state machine file;

[0022] The state machine file is deployed in the memory of the IPS rule library, so that the IPS rule library directly loads the state machine file according to the file adaptability of the state machine file.

[0023] In combination with the fifth possible implementation manner of the first aspect of the present application, in the sixth possible implementation manner of the first aspect of the present application, the state machine file is deployed in the memory of the IPS rule library, including:

[0024] In the process of transmitting the state machine file to the target network device, encryption processing is adopted, wherein the encryption processing includes the following contents:

[0025] Randomly generating 12 bytes of encryption vector IV, wherein the encryption vector corresponding to each encryption block is different; using 32 bytes of encryption key to encrypt 2048 bytes of original data; obtaining 16 bytes of TAG data based on the encrypted content; using a private key to encrypt the encryption key;

[0026] In the process of deploying the encrypted state machine file in the memory of the intrusion prevention system IPS rule library on the target network device, decryption processing is adopted, wherein the decryption processing includes the following contents:

[0027] Decrypting the encryption key using a public key or decrypting the encryption key using 32 bytes of plaintext key; reading 12 bytes of encryption vector IV from the first encryption block to perform decryption environment initialization operation; decrypting 2048 bytes of encrypted data using the decrypted key.

[0028] In a second aspect, the present application provides an intrusion prevention system IPS rule deployment device, the device comprising:

[0029] An acquisition unit is configured to acquire a target intrusion prevention system IPS rule to be deployed to a target network device;

[0030] A compiling unit is configured to parse the target intrusion prevention system IPS rule and compile the target intrusion prevention system IPS rule into a target state machine;

[0031] A deployment unit is configured to deploy the target state machine in the memory of the intrusion prevention system IPS rule library of the target network device, so that the target network device loads the rule content of the target intrusion prevention system IPS rule.

[0032] In a first possible implementation manner of the second aspect of the present application, the compiling unit is specifically configured to:

[0033] Parse the target intrusion prevention system IPS rule;

[0034] According to the parsing result, split the target intrusion prevention system IPS rule into a plurality of sub-intrusion prevention system IPS rules;

[0035] Compile the plurality of sub-intrusion prevention system IPS rules respectively to obtain a plurality of sub-state machines as the target state machine.

[0036] In the second possible implementation manner of the second aspect of the present application, the compiling unit is specifically configured to:

[0037] On the basis of the analysis result, the target IPS rule is split into a plurality of sub-IPS rules according to three dimensions of protocol, direction and port.

[0038] In a third possible implementation manner of the second aspect of the present application, in combination with the first possible implementation manner of the second aspect of the present application, the compiling unit is specifically configured to:

[0039] The plurality of sub-IPS rules are compiled in parallel to obtain a plurality of sub-state machines.

[0040] In a fourth possible implementation manner of the second aspect of the present application, in combination with the first possible implementation manner of the second aspect of the present application, the plurality of sub-IPS rules are respectively compiled to obtain a plurality of sub-state machines, and the compiling includes:

[0041] The plurality of sub-IPS rules are respectively compiled, and in the compiling process, it is determined whether there is a historical rule with the same rule content that has been compiled, if there is, the compiling result of the historical rule is reused to obtain the plurality of sub-state machines.

[0042] In a fifth possible implementation manner of the second aspect of the present application, in combination with the second aspect of the present application, the deploying unit is specifically configured to:

[0043] The target state machine is processed into a file format pre-adapted for the IPS rule library to obtain a state machine file;

[0044] The state machine file is deployed in the memory of the IPS rule library, so that the IPS rule library directly loads the state machine file according to the file adaptation of the state machine file.

[0045] In a sixth possible implementation manner of the second aspect of the present application, in combination with the fifth possible implementation manner of the second aspect of the present application, the deploying unit is specifically configured to:

[0046] In the process of transmitting the state machine file to the target network device, encryption processing is adopted, and the encryption processing includes the following contents:

[0047] A 12-byte encryption vector IV is randomly generated, wherein the encryption vector corresponding to each encryption block is different; a 32-byte encryption key is used to encrypt 2048 bytes of original data; 16-byte TAG data is obtained based on the encryption content; and the private key is used to encrypt the encryption key;

[0048] In the process of deploying the encrypted state machine file in the memory of the IPS rule library on the target network device, decryption processing is adopted, and the decryption processing includes the following contents:

[0049] The encrypted key is decrypted using a public key, or the encrypted key is decrypted using a 32-byte plaintext key; 12 bytes of an encrypted vector IV are read from the first encrypted block, and a decryption environment initialization operation is performed; and 2048 bytes of encrypted data are decrypted using the decrypted key.

[0050] In a third aspect, the present application provides a processing device, comprising a processor and a memory, wherein the memory stores a computer program, and the processor executes the computer program in the memory to perform the method in the first aspect or any possible implementation manner of the first aspect of the present application.

[0051] In a fourth aspect, the present application provides a computer readable storage medium, which stores a plurality of instructions, and the instructions are adapted to be loaded by a processor to perform the method in the first aspect or any possible implementation manner of the first aspect of the present application.

[0052] From the above, the present application has the following beneficial effects:

[0053] From the above scheme, the present application compiles the intrusion prevention system IPS rule to the target state machine, which is performed by the processing device outside the target network device, compared with the target network device in the prior art. Thus, the compilation failure and loading failure caused by insufficient memory of the target network device can be avoided. In addition, for the target network device, the network security work is also avoided to compile the target state machine, so that the memory of the target network device is avoided to be occupied, the efficiency of deploying the target intrusion prevention system IPS rule on the target network device is accelerated, and the network security risk is effectively reduced. BRIEF DESCRIPTION OF DRAWINGS

[0054] In order to more clearly illustrate the technical solutions in the embodiments of the present application, the drawings needed in the embodiment description will be briefly introduced. Obviously, the drawings in the following description are only some embodiments of the present application, and other drawings can be obtained by those skilled in the art without creative labor.

[0055] Figure 1 It is a flowchart of the deployment method of the intrusion prevention system IPS rule of the present application;

[0056] Figure 2 It is a working schematic diagram of splitting the target intrusion prevention system IPS rule of the present application;

[0057] Figure 3A flowchart of a compiling process of a single rule of the present application;

[0058] Figure 4 A data structure diagram before encryption of a state machine of the present application;

[0059] Figure 5 A data structure diagram after encryption of a state machine of the present application;

[0060] Figure 6 A structure diagram of a deployment device of IPS rules of the present application;

[0061] Figure 7 A structure diagram of a processing device of the present application. DETAILED DESCRIPTION

[0062] The technical solutions in the embodiments of the present application will be clearly and completely described below with reference to the drawings in the embodiments of the present application. Obviously, the described embodiments are only part of the embodiments of the present application, rather than all the embodiments of the present application. Based on the embodiments in the present application, all other embodiments obtained by those skilled in the art without creative work fall within the scope of protection of the present application.

[0063] The terms "first", "second", and the like in the specification of the present application, the claims, and the above-described drawings are used to distinguish similar objects, and do not necessarily indicate a specific order or a chronological sequence. It should be understood that the data thus used can be interchanged under appropriate circumstances, so that the embodiments described herein can be implemented in an order other than that illustrated or described herein. In addition, the terms "include" and "have" and any variations thereof are intended to cover non-exclusive inclusion, for example, a process, method, system, product, or device that includes a series of steps or modules does not necessarily have to be limited to only those steps or modules clearly listed, but can include other steps or modules that are not clearly listed or inherent to the process, method, product, or device. The naming or numbering of the steps appearing in the present application does not mean that the steps in the method flow must be executed in the time / chronological order indicated by the naming or numbering. The flow steps that have been named or numbered can change the execution order according to the technical purpose to be achieved, as long as the same or similar technical effects can be achieved.

[0064] The division of the modules appearing in the present application is a logical division, and in actual application, another division manner can be adopted, for example, a plurality of modules can be combined or integrated in another system, or some features can be ignored or not executed, in addition, the coupling or direct coupling or communication connection between the displayed or discussed modules can be through some interfaces, the indirect coupling or communication connection between the modules can be electrical or other similar forms, which are not limited in the present application. In addition, the modules or sub-modules described as separate components can or can not be physically separated, can or can not be physical modules, or can be distributed in a plurality of circuit modules, and some or all of the modules can be selected according to actual needs to achieve the purpose of the present application.

[0065] Before introducing the deployment method of the intrusion prevention system IPS rule provided in the present application, the background content involved in the present application is first introduced.

[0066] The deployment method, device and computer readable storage medium of the intrusion prevention system IPS rule provided in the present application can be applied to a processing device, and are used for guaranteeing more stable and convenient deployment of the intrusion prevention system IPS rule on a target network device.

[0067] The deployment method of the intrusion prevention system IPS rule mentioned in the present application can be executed by the deployment device of the intrusion prevention system IPS rule, or a server, a physical host or a user equipment (User Equipment, UE) and other different types of processing devices integrated with the deployment device of the intrusion prevention system IPS rule. The deployment device of the intrusion prevention system IPS rule can be realized in the form of hardware or software, the UE can be a terminal device such as a smart phone, a tablet computer, a notebook computer, a desktop computer or a personal digital assistant (Personal Digital Assistant, PDA), and the processing device can be set in the form of device cluster.

[0068] Specifically, for the processing device involved in the present application, the specific device form in actual application is adaptively adjusted according to the application needs of the related device / staff responsible for network security work, and the intrusion prevention system IPS rule can be deployed on the target network device from the outside of the target network device.

[0069] Next, the deployment method of the intrusion prevention system IPS rule provided in the present application is introduced.

[0070] Firstly, referring to Figure 1 , Figure 1A flowchart of the deployment method of the intrusion prevention system IPS rule of the present application is shown. The deployment method of the intrusion prevention system IPS rule provided by the present application can specifically include the following steps S101 to S103:

[0071] Step S101, obtaining a target intrusion prevention system IPS rule to be deployed to a target network device;

[0072] It can be understood that for the intrusion prevention system IPS rule itself, it can also be referred to as a security policy. The present application does not make specific improvements. Here, the acquisition and processing of the intrusion prevention system IPS rule can be real-time configuration of the intrusion prevention system IPS rule, or can be a call processing / receiving processing of the intrusion prevention system IPS rule.

[0073] For convenience of description, the intrusion prevention system IPS rule to be deployed to the target network device at present / this time is recorded as the target intrusion prevention system IPS rule.

[0074] In general, the target intrusion prevention system IPS rule is generally initiated in the form of a network security task. Thus, in the task, the deployment object of the target intrusion prevention system IPS rule, i.e., the target network device, is directly indicated.

[0075] The target network device can be any type of network device, such as a firewall, a router, a switch, and other network devices that can be involved in network architecture. The specific adjustment can be made according to actual conditions, and the present application does not make specific limitations.

[0076] In actual application, the target intrusion prevention system IPS rule can be a replacement of the original rule on the target network device, achieving the effect of updating the rule, or can be an expansion of the original rule on the target network device, achieving the effect of supplementing the rule.

[0077] Step S102, parsing the target intrusion prevention system IPS rule and compiling it into a target state machine;

[0078] It can be understood that for the target intrusion prevention system IPS rule to be deployed to the target network device at present, the existing technology directly deploys it in the memory of the intrusion prevention system IPS rule library of the target network device. In the application process, the target network device needs to compile it into a state machine for use. However, this will cause a problem, i.e.,

[0079] 1. A large amount of memory needs to be applied in the state machine compilation process. The amount of memory occupation increases gradually with the number of rules. If the target network device itself has small memory, it is easy to cause compilation failure and loading failure due to insufficient memory;

[0080] 2. The state machine compilation process requires frequent memory release requests, which will result in a large amount of memory fragmentation and affect the normal operation of the target network device;

[0081] 3. The state machine compilation process takes a long time. For example, an upgrade may take up to 10 minutes, and the compilation time increases with the number of rules. During the upgrade, the target network device cannot perform packet detection services, increasing the risk of network attacks.

[0082] In this case, the present application executes the compilation process that was originally executed by the target security device outside the target security device, which can effectively solve the above-mentioned problem.

[0083] In this way, after obtaining the target intrusion prevention system IPS rules, the present application can also parse them to learn the rule content and continue to execute the compilation to obtain the corresponding target state machine.

[0084] Among them, the target state machine can be specifically a deterministic finite state automaton (DFA), which only obtains a fixed state when a state is input. However, the state machine translated from the regular expression is often an ε-NFA. In this case, it is necessary to transform the ε-NFA into a non-deterministic finite state automaton (NFA) or DFA by eliminating the ε edge.

[0085] Step S103: deploy the target state machine in the memory of the intrusion prevention system IPS rule base of the target network device, so that the target network device loads the rule content of the target intrusion prevention system IPS rule.

[0086] After the compilation process of the target intrusion prevention system IPS rules is completed and the corresponding target state machine is obtained, it can be deployed in the memory of the intrusion prevention system IPS rule library of the target network device, so that the target network device loads the rule content of the target intrusion prevention system IPS rules, completing the deployment of the target intrusion prevention system IPS rules.

[0087] From the above scheme content can be seen, the present application will be the compilation process between the target intrusion prevention system IPS rules to the target state machine, compared with the prior art by the target network device, the present application is given to the processing device outside the target network device, so you can avoid the target network device because of insufficient memory, resulting in compilation failure, loading failure, in addition, for the target network device, also avoid the network security work to compile the target state machine, so as to avoid the occupation of the memory of the target network device, also speed up the efficiency of the target network device on the deployment of the target intrusion prevention system IPS rules, but also can effectively reduce the network security risk.

[0088] Continue to the above Figure 1 The various steps of the embodiment shown in the figure and their possible implementation in practical applications are described in detail.

[0089] On the basis of the above, the target intrusion prevention system IPS rules required for the compilation process is executed by the processing device outside the target network device, so as to avoid the operation on the target network device, and to have high convenience in operation cost and configuration processing, therefore, the present application can also develop more flexible processing to promote higher processing efficiency.

[0090] As a kind of practical implementation mode, the compilation process of the present application, that is, the process of parsing target intrusion prevention system IPS rules and compiling into target state machine in the above step S102, specifically can include:

[0091] Parsing target intrusion prevention system IPS rules;

[0092] According to the analysis result, the target intrusion prevention system IPS rules are split into multiple sub-intrusion prevention system IPS rules;

[0093] Respectively compile multiple sub-intrusion prevention system IPS rules to obtain multiple sub-state machines as target state machines.

[0094] As can be seen, the purpose of this embodiment is to split the rule compilation into multiple parts, so that the final result is the corresponding sub-state machine of each part, which is used as the target state machine.

[0095] Under this setting, it is easy to understand that these sub-state machines can be deployed to the target network device respectively, so as to avoid the problem of excessive data size of the original single target state machine, and in the case of significantly reduced data size of single sub-state machine, it is convenient to carry out data transmission work, and it is also convenient to carry out specific deployment work on the target network device.

[0096] In addition, due to the segmentation mechanism of the state machine, the deployment of the current target IPS rule can also be deployed at multiple time points, or at different time points, which is suitable for the actual situation of the target network device side and is more convenient and safe for the deployment of the target IPS rule.

[0097] In addition, the rule splitting in the embodiment can also include the following splitting guidance mechanism:

[0098] The target IPS rule is split into multiple sub-IPS rules according to the protocol, direction, and port dimensions based on the analysis result.

[0099] It should be understood that the rule splitting according to the protocol, direction, and port dimensions does not specifically refer to splitting the related rules in the target IPS rule into three types of rules, and in specific operations, the rules can be split according to different protocols, different directions, and different ports.

[0100] Specifically, the rule splitting can also refer to Figure 2 A working diagram for splitting the target IPS rule is shown in the present application, and the organization structure of the rule splitting process in the present application is as shown in Figure 2 The rules can be split according to different protocols such as TCP, UDP, HTTP, IP, ICMP, and then split according to different directions such as to_server

[65535] , to_client

[65535] , aa_to_server, aa_to_client, and then split according to different ports such as port 1…port 100.

[0101] In this way, the rules can be split more finely based on the three dimensions of protocol, direction, and port, which can facilitate the beneficial effects of the rule splitting and state machine splitting mentioned in the foregoing content.

[0102] Of course, in actual application, the rules can also be split by other specific dimensions.

[0103] In addition, as another practical implementation, after splitting the rules in the embodiment, the process of compiling multiple sub-IPS rules to obtain multiple sub-state machines can also include the following:

[0104] The multiple sub-IPS rules are compiled in parallel to obtain multiple sub-state machines.

[0105] It is easy to understand that for the compiling process between each sub-IPS rule and the corresponding sub-state machine, the processing efficiency of the compiling link can be improved by parallel processing, thereby taking advantage of the convenience of processing devices outside the target network device to provide higher processing capacity, and the compiling efficiency can be further accelerated, thereby accelerating the deployment efficiency of the target IPS rules on the whole level.

[0106] In addition, in addition to parallel processing, the compiling efficiency can also be accelerated in other aspects. Specifically, as another practical implementation manner, in the process of compiling the plurality of sub-IPS rules to obtain the plurality of sub-state machines after splitting the rules in the embodiment, the process can further include:

[0107] The plurality of sub-IPS rules are compiled respectively, and in the compiling process, it is judged whether there is a historical rule with the same rule content that has been compiled for the rule currently waiting for compiling. If there is, the compiling result of the historical rule is reused to obtain the plurality of sub-state machines.

[0108] It can be understood that in the case of the same expected compiling result (the same rule content between two rules), the compiling result before reuse is directly reused, which further reduces the substantial processing of the compiling rules. In the case of directly calling the compiling result, the processing efficiency of the compiling link can be effectively improved.

[0109] In addition, it should be understood that the parallel compiling and the reuse of the compiling result involved in the compiling process can be used separately or in combination. When used in combination, the processing efficiency of the compiling link can be further improved, and the improvement of the processing efficiency of the compiling link continues to contribute to the deployment efficiency of the target IPS rules on the target network device.

[0110] In the compiling process, for the convenience of understanding, reference can be made to Figure 3 A flowchart of the compiling process of a single rule of the application is shown, which shows the compiling process of a single rule. It can be understood that an IPS rule includes a rule header and a rule content, the rule header can be represented by RNT, and the rule content can be represented by OTN.

[0111] In addition, in order to further accelerate the deployment efficiency of the target IPS rules to the target network device, the application can focus on the writing link of deploying the target state machine to the memory of the IPS rule library.

[0112] Specifically, as another practical implementation manner, the process of deploying the target state machine in the memory of the IPS rule base of the target network device in the foregoing step S103 can specifically include:

[0113] processing the target state machine into a file format pre-adapted for the IPS rule base to obtain a state machine file;

[0114] deploying the state machine file in the memory of the IPS rule base, so that the IPS rule base directly loads the state machine file according to the file adaptability of the state machine file.

[0115] For the embodiment, it should be understood that in the prior art, after the target state machine is written into the IPS rule base of the target network device, when the target network device specifically loads the target state machine to specifically deploy the target IPS rule, a secondary compiling operation needs to be performed on the target state machine to obtain the rule.

[0116] In this case, the application can also perform file conversion on the target state machine to convert the file format of the target state machine into a file format that can be read and loaded by the IPS rule base of the target network device, to obtain a state machine file, so that after the state machine is written into the IPS rule base of the target network device, the IPS rule base of the target network device can directly read and load the state machine file due to the file adaptability between the state machine file and the IPS rule base of the target network device, and the target network device does not need to involve the secondary compiling operation in the prior art, which further reduces the required data processing of the target network device, speeds up the deployment efficiency of the target IPS rule on the target network device, effectively reduces the operation cost of the target network device, and achieves more stable and convenient application effects.

[0117] In addition, on the basis of the embodiment of converting the target state machine into the state machine file, as another practical implementation manner, the process of subsequently deploying the state machine file in the memory of the IPS rule base can specifically include:

[0118] On the one hand, the state machine file is subjected to encryption processing in the process of being transmitted to the target network device, and the encryption processing includes the following contents:

[0119] randomly generating an encryption vector IV of 12 bytes, wherein the encryption vector corresponding to each encryption block is different;

[0120] The 32-byte encryption key is used to encrypt the original 2048-byte data;

[0121] Based on the encrypted content, 16 bytes of TAG data are obtained;

[0122] The encryption key is encrypted using a private key;

[0123] On the other hand, in the process of deploying the encrypted state machine file in the memory of the intrusion prevention system IPS rule base on the target network device, a decryption process is adopted, which includes the following contents:

[0124] The encryption key is decrypted using a public key, or the encryption key is decrypted using a 32-byte plaintext key;

[0125] Read 12 bytes of the encryption vector IV from the first encryption block, and perform decryption environment initialization operation;

[0126] The 2048-byte encrypted data is decrypted using the decrypted key.

[0127] Specifically, reference can also be made to Figure 4 , Figure 5 The data structure diagram of the state machine before and after encryption is shown, and through the encryption process here, the data security of the state machine file in the data transmission process can be effectively guaranteed.

[0128] In addition, it should be understood that the encryption and decryption operations described above are based on the aes256 gcm symmetric encryption method, and in specific applications, other types of encryption methods can also be used, which can be adjusted according to actual conditions.

[0129] To further understand the above scheme (including various embodiments), the beneficial effects of the present application scheme can also be illustrated by the following set of examples.

[0130] According to the prior art, there are:

[0131] 1. Upgrade the rule base containing 3000 rules, the peak memory occupied during the upgrade process reaches about 1G, the upgrade time is about 5 minutes, and the actual memory occupied after the upgrade is completed is about 200M.

[0132] 2. Upgrade the rule base containing 8000 rules, the rule base upgrade fails, and it is found through testing that the peak memory occupied during the upgrade process reaches about 2.2G.

[0133] After adopting the present application scheme, there are:

[0134] 1. Upgrade the rule base containing 3000 rules, the peak memory occupied during the upgrade process reaches about 100M, the upgrade time is about 20 seconds, and the actual memory occupied after the upgrade is completed is about 200M.

[0135] 2. Upgrade the rule base containing 8000 rules, the rule base upgrade is successful, the peak memory occupied during the upgrade process is about 130M, and the upgrade time is about 25 seconds.

[0136] 3. Upgrade the rule base containing 50000 rules, the rule base upgrade is successful, the peak memory occupied during the upgrade process is about 150M, and the time is about 35 seconds.

[0137] Through the above actual test, it can be found that the scheme provided by the application not only ensures that the target intrusion prevention system IPS rule can be stably deployed on the target network device, and the deployment efficiency is also significantly improved.

[0138] The above is the introduction of the deployment method of the intrusion prevention system IPS rule provided by the application. In order to better implement the deployment method of the intrusion prevention system IPS rule provided by the application, the application also provides an intrusion prevention system IPS rule deployment device from the functional module angle.

[0139] Reference Figure 6 , Figure 6 is a structural schematic diagram of the intrusion prevention system IPS rule deployment device of the application. In the application, the intrusion prevention system IPS rule deployment device 600 can specifically include the following structures:

[0140] The acquisition unit 601 is configured to acquire the target intrusion prevention system IPS rule to be deployed to the target network device.

[0141] The compiling unit 602 is configured to parse the target intrusion prevention system IPS rule and compile it into a target state machine.

[0142] The deployment unit 603 is configured to deploy the target state machine in the memory of the intrusion prevention system IPS rule base of the target network device, so that the target network device loads the rule content of the target intrusion prevention system IPS rule.

[0143] In an exemplary implementation manner, the compiling unit 602 is specifically configured to:

[0144] parse the target intrusion prevention system IPS rule;

[0145] According to the parsing result, the target intrusion prevention system IPS rule is split into a plurality of sub-intrusion prevention system IPS rules;

[0146] Compile the plurality of sub-intrusion prevention system (IPS) rules respectively to obtain a plurality of sub-state machines as the target state machine.

[0147] In yet another exemplary implementation, the compiling unit 602 is specifically configured to:

[0148] On the basis of the parsing result, the target intrusion prevention system (IPS) rule is split into a plurality of sub-intrusion prevention system (IPS) rules according to three dimensions of protocol, direction and port.

[0149] In yet another exemplary implementation, the compiling unit 602 is specifically configured to:

[0150] The plurality of sub-intrusion prevention system (IPS) rules are compiled in parallel to obtain a plurality of sub-state machines.

[0151] In yet another exemplary implementation, the compiling the plurality of sub-intrusion prevention system (IPS) rules respectively to obtain a plurality of sub-state machines comprises:

[0152] The plurality of sub-intrusion prevention system (IPS) rules are compiled respectively, and in the compiling process, it is judged whether there is a historical rule of the same rule content that has been compiled for the rule currently waiting for compilation, if there is, the compiling result of the historical rule is reused to obtain a plurality of sub-state machines.

[0153] In yet another exemplary implementation, the deploying unit 603 is specifically configured to:

[0154] The target state machine is processed into a file format pre-adapted for the intrusion prevention system (IPS) rule library to obtain a state machine file;

[0155] The state machine file is deployed in the memory of the intrusion prevention system (IPS) rule library, so that the intrusion prevention system (IPS) rule library directly loads the state machine file according to the file adaptation of the state machine file.

[0156] In yet another exemplary implementation, the deploying unit 603 is specifically configured to:

[0157] In the process of transmitting the state machine file to the target network device, encryption processing is adopted, wherein the encryption processing comprises the following contents:

[0158] Randomly generate an encryption vector IV of 12 bytes, wherein the encryption vector corresponding to each encryption block is different; use an encryption key of 32 bytes to encrypt original data of 2048 bytes; obtain TAG data of 16 bytes based on the encrypted content; use a private key to encrypt the encryption key;

[0159] In the process of deploying the encrypted state machine file in the memory of the IPS rule base on the target network device, a decryption process is adopted, wherein the decryption process comprises the following contents:

[0160] The encrypted key is decrypted using a public key or a 32-byte plaintext key; 12 bytes of the encrypted vector IV are read from the first encrypted block to perform the decryption environment initialization operation; and the 2048-byte encrypted data is decrypted using the decrypted key.

[0161] The application also provides a processing device from the hardware structure aspect, referring to Figure 7 , Figure 7 A structural schematic diagram of the processing device of the application is shown, and specifically, the processing device of the application can comprise a processor 701, a memory 702 and an input / output device 703, the processor 701 is used to execute the computer program stored in the memory 702 to realize the functions of Figure 1 the steps of the deployment method of the IPS rule in the corresponding embodiments; or the processor 701 is used to execute the computer program stored in the memory 702 to realize the functions of Figure 6 the units in the corresponding embodiments, the memory 702 is used to store the computer program required by the deployment method of the IPS rule in the corresponding embodiments for the processor 701. Figure 1

[0162] For example, the computer program can be divided into one or more modules / units, one or more modules / units are stored in the memory 702 and executed by the processor 701 to complete the application. One or more modules / units can be a series of computer program instruction segments capable of completing a specific function, which is used to describe the execution process of the computer program in the computer device.

[0163] The processing device can comprise, but is not limited to, the processor 701, the memory 702, the input / output device 703. Those skilled in the art can understand that the schematic diagram is only an example of the processing device and does not constitute a limitation on the processing device, and can comprise more or less components than the schematic diagram, or combine certain components, or different components, for example, the processing device can also comprise a network access device, a bus, etc., and the processor 701, the memory 702, the input / output device 703 are connected through the bus.

[0164] ​The processor 701 can be a central processing unit (CPU), and can also be other general-purpose processors, a digital signal processor (DSP), an application specific integrated circuit (ASIC), a field-programmable gate array (FPGA) or other programmable logic device, discrete gate or transistor logic device, discrete hardware component, etc. The general-purpose processor can be a microprocessor or the processor can also be any conventional processor and the like. The processor is a control center of the processing device, and connects various parts of the entire device through various interfaces and lines.

[0165] The memory 702 can be used to store computer programs and / or modules, and the processor 701 realizes various functions of the computer device by running or executing the computer programs and / or modules stored in the memory 702, and calling data stored in the memory 702. The memory 702 can mainly include a program storage area and a data storage area, wherein the program storage area can store an operating system, at least one application required by a function, etc.; and the data storage area can store data created according to the use of the processing device, etc. In addition, the memory can include a high-speed random access memory, and can also include a non-volatile memory, for example, a hard disk, a memory, a plug-in hard disk, a smart media card (SMC), a secure digital (SD) card, a flash card, at least one disk storage device, a flash memory device, or other volatile solid-state memory device.

[0166] When the processor 701 is used to execute the computer programs stored in the memory 702, the following functions can be realized:

[0167] Obtaining target intrusion prevention system (IPS) rules to be deployed to a target network device;

[0168] Parsing the target intrusion prevention system (IPS) rules and compiling into a target state machine;

[0169] Deploying the target state machine in a memory of an intrusion prevention system (IPS) rule library of the target network device, so that the target network device loads rule content of the target intrusion prevention system (IPS) rules.

[0170] Those skilled in the art can clearly understand that, for the convenience and brevity of description, the specific working process of the above-described deployment device of the intrusion prevention system (IPS) rules, the processing device and the corresponding units thereof can be referred to as Figure 1The deployment method of the IPS rule in the corresponding embodiment is described below, and details are not described herein.

[0171] Those skilled in the art can understand that all or part of the steps in the various methods of the above embodiments can be completed by instructions or by controlling relevant hardware by the instructions, which can be stored in a computer readable storage medium and loaded and executed by a processor.

[0172] To this end, the present application provides a computer readable storage medium, which stores a plurality of instructions capable of being loaded by a processor to execute the method of the present application as Figure 1 The steps of the deployment method of the IPS rule in the corresponding embodiment are described below, and details are not described herein. Figure 1 The deployment method of the IPS rule in the corresponding embodiment is described below, and details are not described herein.

[0173] The computer readable storage medium can include a read only memory (ROM), a random access memory (RAM), a magnetic disk or an optical disk, etc.

[0174] Due to the instructions stored in the computer readable storage medium, the method of the present application as Figure 1 The steps of the deployment method of the IPS rule in the corresponding embodiment are described below, and details are not described herein. Figure 1 The beneficial effects of the deployment method of the IPS rule in the corresponding embodiment are described above, and details are not described herein.

[0175] The deployment method of the IPS rule in the corresponding embodiment is described below, and details are not described herein. The above describes the deployment method of the IPS rule, the device, the processing equipment and the computer readable storage medium provided by the present application in detail, and the principle and implementation mode of the present application are described by applying specific examples in this paper. The above embodiment is only used to help understand the method and core idea of the present application; at the same time, for those skilled in the art, according to the idea of the present application, the specific implementation mode and application range will be changed; in conclusion, the content of the specification should not be understood as the limitation of the present application.

Claims

1. A method for deploying intrusion prevention system (IPS) rules, characterized in that: The method comprises: Obtain target intrusion prevention system (IPS) rules to be deployed to target network devices; Parsing the target intrusion prevention system IPS rules and compiling them into a target state machine; Deploying the target state machine outside the target network device in a memory of an intrusion prevention system IPS rule base of the target network device, so that the target network device loads the rule content of the target intrusion prevention system IPS rule; The step of deploying the target state machine in a memory of an intrusion prevention system IPS rule base of the target network device includes: Processing the target state machine into a file format pre-adapted to the intrusion prevention system IPS rule base to obtain a state machine file; Deploying the state machine file in the memory of the intrusion prevention system IPS rule base, so that the intrusion prevention system IPS rule base directly loads the state machine file according to the file adaptability of the state machine file; Deploying the state machine file in the memory of the intrusion prevention system IPS rule base includes: The state machine file is encrypted during transmission to the target network device, wherein the encryption process includes the following: Generate a random 12-byte encryption vector (IV), where each encryption vector is different for each encrypted block; encrypt the 2048-byte original data using a 32-byte encryption key; obtain the 16-byte TAG data based on the encrypted content; and encrypt the encryption key using the private key. On the target network device, a decryption process is performed during the process of deploying the encrypted state machine file into the memory of the intrusion prevention system IPS rule base, wherein the decryption process includes the following: Decrypt the encryption key using the public key, or decrypt the encryption key using the 32-byte plaintext key; read the 12-byte encryption vector IV from the first encryption block to perform a decryption environment initialization operation; and decrypt the 2048-byte encrypted data using the decrypted key.

2. The method according to claim 1, characterized in that The parsing of the target intrusion prevention system IPS rules and compiling them into a target state machine includes: Parsing the target intrusion prevention system IPS rules; Splitting the target intrusion prevention system IPS rule into multiple sub-intrusion prevention system IPS rules according to the parsing result; A plurality of the sub-intrusion prevention system IPS rules are compiled respectively to obtain a plurality of sub-state machines as the target state machine.

3. The method according to claim 2, characterized in that The target intrusion prevention system IPS rule is split into multiple sub-intrusion prevention system IPS rules according to the analysis result, including: Based on the analysis result, the target intrusion prevention system IPS rule is split into multiple sub-intrusion prevention system IPS rules according to three dimensions: protocol, direction and port.

4. The method according to claim 2, characterized in that The plurality of sub-IPS rules are compiled separately to obtain a plurality of sub-state machines, including: Compile a plurality of the sub-intrusion prevention system IPS rules in parallel to obtain a plurality of the sub-state machines.

5. The method according to claim 2, characterized in that The compiling of the plurality of sub-IPS rules to obtain a plurality of sub-state machines includes: Compile multiple sub-intrusion prevention system IPS rules separately, and during the compilation process, determine whether there are compiled historical rules with the same rule content as the rule currently waiting to be compiled. If so, reuse the compilation results of the historical rules to obtain multiple sub-state machines.

6. A device for deploying rules of an intrusion prevention system IPS, characterized in that: The device comprises: An acquisition unit, configured to acquire target intrusion prevention system IPS rules to be deployed to a target network device; A compilation unit, configured to parse the target intrusion prevention system IPS rules and compile them into a target state machine; A deployment unit, configured to deploy the target state machine outside the target network device in a memory of an intrusion prevention system IPS rule base of the target network device, so that the target network device loads the rule content of the target intrusion prevention system IPS rule; The deployment unit is specifically configured to: Processing the target state machine into a file format pre-adapted to the intrusion prevention system IPS rule base to obtain a state machine file; Deploying the state machine file in the memory of the intrusion prevention system IPS rule base, so that the intrusion prevention system IPS rule base directly loads the state machine file according to the file adaptability of the state machine file; The deployment unit is specifically configured to: The state machine file is encrypted during transmission to the target network device, wherein the encryption process includes the following: Generate a random 12-byte encryption vector (IV), where each encryption vector is different for each encrypted block; encrypt the 2048-byte original data using a 32-byte encryption key; obtain the 16-byte TAG data based on the encrypted content; and encrypt the encryption key using the private key. On the target network device, a decryption process is performed during the process of deploying the encrypted state machine file into the memory of the intrusion prevention system IPS rule base, wherein the decryption process includes the following: Decrypt the encryption key using the public key, or decrypt the encryption key using the 32-byte plaintext key; read the 12-byte encryption vector IV from the first encryption block to perform a decryption environment initialization operation; and decrypt the 2048-byte encrypted data using the decrypted key.

7. A processing device, characterized in that The method comprises a processor and a memory, wherein a computer program is stored in the memory, and when the processor calls the computer program in the memory, the method according to any one of claims 1 to 5 is executed.

8. A computer-readable storage medium, characterized in that The computer-readable storage medium stores a plurality of instructions, and the instructions are suitable for being loaded by a processor to execute the method according to any one of claims 1 to 5.

Images