Method, device, electronic device and storage medium for processing abnormal security business

Abstract

The embodiment of the present invention provides a method, device, electronic device and storage medium for processing security abnormal services. The method connects a security gateway to an SRv6 routing forwarding network, and obtains service information when a user uses the SRv6 routing forwarding service. According to the service information, a security analysis is performed on the routing forwarding service to determine whether the routing forwarding service is a security abnormal service. If the routing forwarding service is a security abnormal service, a risk level is marked on the security abnormal service to determine the security forwarding risk level of the security abnormal service. According to the security forwarding risk level of the security abnormal service, the security abnormal service is forwarded to an abnormal service system for processing, so that when the security gateway encounters a security problem, the service is marked for risk and forwarded to a designated area or system as soon as possible, so as to achieve safety, isolation and effectiveness, which is conducive to improving the security protection of the SRV6 user service level.

Description

Technical Field

[0001] The present invention relates to the field of computer technology, and in particular to a method for processing abnormal security services, a device for processing abnormal security services, an electronic device and a computer-readable storage medium. Background Art

[0002] With the increasing scale of SRv6 (Segment Routing IPv6, segment routing based on IPv6 forwarding plane) network, user service security issues are becoming increasingly prominent. However, traditional firewalls, IDS (Intrusion Detection System), IPS (Internet Protocol Suite), and NDR (Network Data Reduction) require a lot of investment from users themselves at the access level of large-scale networks, which has high costs in terms of technology, manpower, and financial resources. Summary of the invention

[0003] In view of the above problems, embodiments of the present invention are proposed to provide a method for processing security abnormality services, a device for processing security abnormality services, an electronic device and a computer-readable storage medium that overcome the above problems or at least partially solve the above problems.

[0004] In order to solve the above problem, an embodiment of the present invention discloses a method for processing security abnormal services, characterized in that it is applied to a security gateway, the security gateway is connected to an SRv6 routing forwarding network, and the method includes:

[0005] When users use SRv6 routing forwarding services, obtain service information;

[0006] Performing a security analysis on the routing and forwarding service according to the service information to determine whether the routing and forwarding service is a security abnormality service;

[0007] If the routing forwarding service is a security abnormality service, marking the risk level of the security abnormality service to determine the security forwarding risk level of the security abnormality service;

[0008] According to the security forwarding risk level of the security abnormality service, the security abnormality service is forwarded to the abnormal service system for processing.

[0009] Optionally, before acquiring the business information, the method further includes:

[0010] Monitor the user's inbound and outbound traffic services and obtain inbound and outbound traffic service information;

[0011] Based on the inlet and outlet traffic service information, a security indicator feature library based on user services is established.

[0012] Optionally, the security gateway includes a DPI deep packet inspection module, and the establishment of a security indicator feature library based on user services based on the inlet and outlet traffic service information includes:

[0013] Calling the DPI module to analyze the inlet and outlet traffic service information to obtain the user service type;

[0014] Perform autonomous learning based on the inlet and outlet traffic business information to determine business security indicators;

[0015] A security indicator feature library based on user services is established according to the user service type and the service security indicator.

[0016] Optionally, the service security indicator includes at least one of a quintuple, user access information, service traffic status, service usage duration, and service usage status.

[0017] Optionally, performing security analysis on the routing forwarding service according to the service information to determine whether the routing forwarding service is a security abnormality service includes:

[0018] Extracting multiple business security information from the business information;

[0019] Comparing the plurality of business security information with the corresponding business security indicators respectively;

[0020] If at least one service security information does not meet the corresponding security indicator, determining that the routing forwarding service is a security abnormality service;

[0021] If each service security information meets the corresponding security indicator, it is determined that the routing forwarding service is not a security abnormality service.

[0022] Optionally, forwarding the security abnormality service to an abnormal service system for processing according to the security forwarding risk level of the security abnormality service includes:

[0023] Diverting the abnormal security business;

[0024] Determining the risk type of the security abnormality business according to the security index that the security abnormality business does not meet;

[0025] According to the risk type of the abnormal security service and the security forwarding risk level, the diverted service flow is forwarded to the abnormal service system for processing.

[0026] Optionally, forwarding the diverted service flow to the abnormal service system for processing according to the risk type of the abnormal security service and the security forwarding risk level includes:

[0027] Re-determining the SRv6 forwarding strategy and the SRv6 forwarding path list according to the risk type of the abnormal security service and the security forwarding risk level;

[0028] According to the SRv6 forwarding strategy and the SRv6 forwarding path list, the diverted service flow is forwarded to the abnormal service system for processing.

[0029] The embodiment of the present invention further discloses a device for processing security abnormality services, which is applied to a security gateway, wherein the security gateway is connected to an SRv6 routing forwarding network, and the device includes:

[0030] An acquisition module is used to obtain service information when a user uses the SRv6 routing forwarding service;

[0031] An analysis module, configured to perform a security analysis on the routing and forwarding service according to the service information, and determine whether the routing and forwarding service is a security abnormality service;

[0032] A marking module, for marking the risk level of the abnormal security service if the routing forwarding service is an abnormal security service, and determining the security forwarding risk level of the abnormal security service;

[0033] The forwarding module is used to forward the security abnormality service to the abnormal service system for processing according to the security forwarding risk level of the security abnormality service.

[0034] Optionally, the device further comprises:

[0035] A monitoring module is used to monitor the user's inlet and outlet traffic services and obtain inlet and outlet traffic service information;

[0036] A module is established to establish a security indicator feature library based on user services based on the inlet and outlet traffic service information.

[0037] Optionally, the security gateway includes a DPI deep packet inspection module, and the establishment module includes:

[0038] A calling submodule, used to call the DPI module, analyze the inlet and outlet traffic service information, and obtain the user service type;

[0039] An autonomous learning submodule, used to perform autonomous learning based on the inlet and outlet traffic service information to determine the service security index;

[0040] The feature library establishment submodule is used to establish a security indicator feature library based on user services according to the user service type and the service security indicator.

[0041] Optionally, the service security indicator includes at least one of a quintuple, user access information, service traffic status, service usage duration, and service usage status.

[0042] Optionally, the analysis module includes:

[0043] An extraction submodule, used to extract multiple business security information from the business information;

[0044] A comparison submodule, used to compare the plurality of business security information with the corresponding business security indicators respectively;

[0045] An abnormal service determination submodule, configured to determine that the routing forwarding service is a security abnormal service if at least one service security information does not meet the corresponding security indicator;

[0046] The non-business determination submodule is used to determine that the routing forwarding business is not a security abnormal business if each business security information meets the corresponding security indicator.

[0047] Optionally, the forwarding module includes:

[0048] A diversion submodule, used for diverting the abnormal security business;

[0049] A risk type determination submodule, used to determine the risk type of the security abnormality business according to the security index that the security abnormality business does not meet;

[0050] The diversion forwarding submodule is used to forward the diverted business flow to the abnormal business system for processing according to the risk type of the abnormal security business and the security forwarding risk level.

[0051] Optionally, the traffic splitting and forwarding submodule includes:

[0052] A policy determination unit, configured to re-determine an SRv6 forwarding policy and an SRv6 forwarding path list according to the risk type of the security abnormality service and the security forwarding risk level;

[0053] The processing unit is used to forward the diverted service flow to the abnormal service system for processing according to the SRv6 forwarding strategy and the SRv6 forwarding path list.

[0054] An embodiment of the present invention further discloses an electronic device, comprising: a processor, a memory, and a computer program stored in the memory and capable of running on the processor, wherein when the computer program is executed by the processor, the steps of the method for processing security abnormality services as described above are implemented.

[0055] The embodiment of the present invention further discloses a computer-readable storage medium, characterized in that a computer program is stored on the computer-readable storage medium, and when the computer program is executed by a processor, the steps of the method for processing security abnormality business as described above are implemented.

[0056] The embodiments of the present invention include the following advantages:

[0057] In an embodiment of the present invention, by connecting a security gateway to an SRv6 routing and forwarding network, when a user uses an SRv6 routing and forwarding service, service information is obtained; based on the service information, a security analysis is performed on the routing and forwarding service to determine whether the routing and forwarding service is a security abnormality service; if the routing and forwarding service is a security abnormality service, a risk level is marked on the security abnormality service to determine the security forwarding risk level of the security abnormality service; based on the security forwarding risk level of the security abnormality service, the security abnormality service is forwarded to an abnormal service system for processing, so that when the security gateway encounters a security problem, the service is risk-marked and forwarded to a designated area or system as soon as possible, so as to achieve safety, isolation, and effectiveness, which is conducive to improving the security protection of the SRV6 user service level. BRIEF DESCRIPTION OF THE DRAWINGS

[0058] Figure 1 It is a flowchart of a method for processing abnormal security services provided by an embodiment of the present invention;

[0059] Figure 2 It is a flowchart of another method for processing abnormal security services provided by an embodiment of the present invention;

[0060] Figure 3 This is a forwarding schematic diagram provided by an embodiment of the present invention;

[0061] Figure 4 It is a structural block diagram of a device for processing abnormal security services provided by an embodiment of the present invention. DETAILED DESCRIPTION

[0062] In order to make the above-mentioned objects, features and advantages of the present invention more obvious and easy to understand, the present invention is further described in detail below with reference to the accompanying drawings and specific embodiments.

[0063] Traditional firewalls, IDS (Intrusion Detection System), IPS (Internet Protocol Suite), and NDR (Network Data Reduction) require a lot of investment from users themselves at the access level of large-scale networks, and have high costs in terms of technology, manpower, and financial resources.

[0064] One of the core concepts of the embodiment of the present invention is to connect the security gateway to the SRv6 routing forwarding network, and obtain service information when the user uses the SRv6 routing forwarding service; perform security analysis on the routing forwarding service according to the service information to determine whether the routing forwarding service is a security abnormality service; if the routing forwarding service is a security abnormality service, mark the risk level of the security abnormality service to determine the security forwarding risk level of the security abnormality service; forward the security abnormality service to the abnormal service system for processing according to the security forwarding risk level of the security abnormality service, so that when the security gateway encounters a security problem, it will mark the risk of the service and forward it to the designated area or system as soon as possible, so as to achieve safety, isolation and effectiveness, which is conducive to improving the security protection of the SRV6 user service level.

[0065] Reference Figure 1 , shows a flowchart of a method for processing abnormal security services provided by an embodiment of the present invention, which is applied to a security gateway, and the security gateway is connected to an SRv6 routing forwarding network. The method may specifically include the following steps:

[0066] Step 101: When a user uses an SRv6 routing forwarding service, obtain service information.

[0067] The method for processing security abnormality services in the embodiment of the present invention can be applied to a security gateway. The security gateway can be connected to the SRv6 routing forwarding network, and the security abnormality problems of SRV6 network users can be promptly warned through the security gateway and the supporting system, thereby forwarding the security abnormality service information, and combining with the supporting system to achieve effective isolation of security abnormality problems and rapid and proactive warning processing.

[0068] In the embodiment of the present invention, when a user uses the SRv6 routing forwarding service, service information can be obtained.

[0069] Step 102: Perform security analysis on the routing and forwarding service according to the service information to determine whether the routing and forwarding service is a security abnormality service.

[0070] In the embodiment of the present invention, a security analysis may be performed on the routing and forwarding service according to the service information to determine whether the routing and forwarding service is a security abnormality service.

[0071] Step 103: If the routing forwarding service is a security abnormality service, a risk level is marked on the security abnormality service to determine the security forwarding risk level of the security abnormality service.

[0072] In the embodiment of the present invention, after security analysis of the routing forwarding service, if the routing forwarding service is determined to be a security abnormal service, the risk level of the security abnormal service can be marked to determine the security forwarding risk level of the security abnormal service. The security forwarding risk level of the security abnormal service may also be different due to different abnormal reasons for the service abnormality.

[0073] Step 104: forwarding the security abnormality service to an abnormal service system for processing according to the security forwarding risk level of the security abnormality service.

[0074] In the embodiment of the present invention, the security abnormality service may be forwarded to the abnormal service system for processing according to the security forwarding risk level of the security abnormality service.

[0075] In an embodiment of the present invention, by connecting a security gateway to an SRv6 routing and forwarding network, when a user uses an SRv6 routing and forwarding service, service information is obtained; based on the service information, a security analysis is performed on the routing and forwarding service to determine whether the routing and forwarding service is a security abnormality service; if the routing and forwarding service is a security abnormality service, a risk level is marked on the security abnormality service to determine the security forwarding risk level of the security abnormality service; based on the security forwarding risk level of the security abnormality service, the security abnormality service is forwarded to an abnormal service system for processing, so that when the security gateway encounters a security problem, the service is risk-marked and forwarded to a designated area or system as soon as possible, so as to achieve safety, isolation, and effectiveness, which is conducive to improving the security protection of the SRV6 user service level.

[0076] Reference Figure 2 , shows a flowchart of a method for processing abnormal security services provided by an embodiment of the present invention, which is applied to a security gateway, and the security gateway is connected to an SRv6 routing forwarding network. The method may specifically include the following steps:

[0077] Step 201, monitor the user's ingress and egress traffic services and obtain ingress and egress traffic service information.

[0078] The method for processing security abnormality services in the embodiment of the present invention can be applied to a security gateway. The security gateway can be connected to the SRv6 routing forwarding network, and the security abnormality problems of SRV6 network users can be promptly warned through the security gateway and the supporting system, thereby forwarding the security abnormality service information, and combining with the supporting system to achieve effective isolation of security abnormality problems and rapid and proactive warning processing.

[0079] In the embodiment of the present invention, the inlet and outlet traffic services of the user can be monitored and the inlet and outlet traffic service information can be obtained. In practical applications, after the security gateway is connected, the device can be automatically discovered through LLDP (Link Layer Discovery Protocol). After the security gateway is working, the user's egress traffic service can be monitored.

[0080] Step 202: Based on the inlet and outlet traffic service information, a security indicator feature library based on user services is established.

[0081] In an optional embodiment, the security gateway includes a DPI deep packet inspection module, and step 202 may include the following sub-steps S11-S13:

[0082] Sub-step S11, calling the DPI module to analyze the inlet and outlet traffic service information to obtain the user service type.

[0083] Sub-step S12, autonomous learning is performed based on the inlet and outlet traffic service information to determine the service security index.

[0084] Sub-step S13, establishing a security indicator feature library based on user services according to the user service type and the service security indicator.

[0085] In an optional embodiment, the service security indicator includes at least one of a five-tuple, user access information, service traffic status, service usage duration, and service usage status.

[0086] In an embodiment of the present invention, the DPI module can be called to analyze the inlet and outlet traffic service information to obtain the user service type, and autonomous learning is performed based on the inlet and outlet traffic service information to determine service security indicators such as the five-tuple, user access information, service traffic status, service usage duration, and service usage status. Based on the user service type and these service security indicators, a security indicator feature library based on user services is established.

[0087] In actual applications, after the analysis is completed, the security gateway can autonomously learn and store the user's own business security features (such as business type, five-tuple (source and destination address, source and destination MAC, port number), access and accessed source and target information, business traffic status, business usage duration, business usage status and other business-related indicator information), establish an indicator feature library based on user business and use it as a security benchmark.

[0088] Step 203: When the user uses the SRv6 routing forwarding service, obtain service information.

[0089] Step 204: Perform security analysis on the routing and forwarding service according to the service information to determine whether the routing and forwarding service is a security abnormality service.

[0090] In an optional embodiment, the step 204 may include the following sub-steps S21-S24:

[0091] Sub-step S21, extracting multiple business security information from the business information.

[0092] Sub-step S22, comparing the multiple pieces of business security information with the corresponding business security indicators respectively.

[0093] Sub-step S23: If at least one piece of service security information does not meet the corresponding security indicator, the routing forwarding service is determined to be a security abnormality service.

[0094] Sub-step S24: if each service security information meets the corresponding security indicator, it is determined that the routing forwarding service is not a security abnormality service.

[0095] In an embodiment of the present invention, multiple business security information can be extracted from the business information, and the multiple business security information can be compared with the corresponding business security indicators. If at least one business security information does not meet the corresponding security indicator, it can be determined that the routing forwarding business is a security abnormal business; if each business security information meets the corresponding security indicator, it can be determined that the routing forwarding business is not a security abnormal business.

[0096] In actual applications, the security gateway always reports the user's business status. When a security situation occurs during the user's use of SRV6 services, the security gateway can conduct security analysis in the first place, and analyze the business flow (including inbound and outbound) with security anomalies based on traffic conditions, five-tuple information, business type, business usage status, etc. By comparing the indicators of the self-learned business security feature library, once an indicator threshold abnormality is found, it will be recorded in a timely manner.

[0097] Step 205: If the routing forwarding service is a security abnormality service, the risk level of the security abnormality service is marked to determine the security forwarding risk level of the security abnormality service.

[0098] Step 206: forward the security abnormality service to an abnormal service system for processing according to the security forwarding risk level of the security abnormality service.

[0099] In an optional embodiment, step 206 may include the following sub-steps S31-S33:

[0100] Sub-step S31, diverting the abnormal security business.

[0101] Sub-step S32, determining the risk type of the security abnormality business according to the security index that the security abnormality business does not meet.

[0102] Sub-step S33, forwarding the diverted service flow to the abnormal service system for processing according to the risk type of the abnormal security service and the security forwarding risk level.

[0103] In an embodiment of the present invention, security abnormal business can be diverted, and the risk type of the security abnormal business can be determined based on the security indicators that the security abnormal business does not meet. According to the risk type of the security abnormal business and the security forwarding risk level, the diverted business flow can be forwarded to the abnormal business system for processing.

[0104] In actual applications, the security abnormality business flow information can be synchronized to the business diversion module in the security gateway through the API interface. The business diversion module can perform diversion, risk tagging and classification, internal diversion, and local recording of the security abnormality business.

[0105] In an optional embodiment, the sub-step S33 may include the following sub-steps S331-S332:

[0106] Sub-step S331, re-determining the SRv6 forwarding strategy and the SRv6 forwarding path list according to the risk type of the security abnormality service and the security forwarding risk level.

[0107] Sub-step S332: forwarding the diverted service flow to the abnormal service system for processing according to the SRv6 forwarding strategy and the SRv6 forwarding path list.

[0108] In an embodiment of the present invention, the SRv6 forwarding strategy and the SRv6 forwarding path list can be re-determined according to the risk type and security forwarding risk level of the security abnormal service, and the diverted service flow can be forwarded to the abnormal service system for processing according to the SRv6 forwarding strategy and the SRv6 forwarding path list.

[0109] In actual applications, after diversion, the business flow information can be forwarded to the SRV6 forwarding module in the security gateway through the module API interface. The SRV6 forwarding module can re-formulate the entire SRV6 forwarding strategy and SRH forwarding path list for the business flow based on business classification and security forwarding risk level, and report to the SRV6 network controller to notify all network nodes to forward according to the new forwarding strategy and path (can be combined with network slicing) to the target area or disposal system.

[0110] Reference Figure 3 , showing a forwarding schematic diagram provided by an embodiment of the present invention.

[0111] In an embodiment of the present invention, by connecting a security gateway to an SRv6 routing and forwarding network, when a user uses an SRv6 routing and forwarding service, service information is obtained; based on the service information, a security analysis is performed on the routing and forwarding service to determine whether the routing and forwarding service is a security abnormality service; if the routing and forwarding service is a security abnormality service, a risk level is marked on the security abnormality service to determine the security forwarding risk level of the security abnormality service; based on the security forwarding risk level of the security abnormality service, the security abnormality service is forwarded to an abnormal service system for processing, so that when the security gateway encounters a security problem, the service is risk-marked and forwarded to a designated area or system as soon as possible, so as to achieve safety, isolation, and effectiveness, which is conducive to improving the security protection of the SRV6 user service level.

[0112] In the embodiment of the present invention, the security gateway device is plug-and-play, and forms the user's own SRV6 business usage characteristics and security feature library through autonomous learning, establishes an indicator feature library based on user business and uses it as a security benchmark; performs security warnings for SRV6 security abnormal business inbound and outbound traffic and labels and classifies it according to risk levels; performs instant diversion for SRV6 security abnormal business inbound and outbound traffic, formulates a specific SRV6 forwarding path to forward (which can be combined with network slicing) to a designated area or system for disposal, so as to avoid affecting the main business and backbone network; for SRV6 security abnormal business traffic, the system can be deeply compatible with other security devices and systems, and can be linked to perform other operations and disposal.

[0113] It should be noted that, for the sake of simplicity, the method embodiments are described as a series of action combinations, but those skilled in the art should be aware that the embodiments of the present invention are not limited by the order of the actions described, because according to the embodiments of the present invention, certain steps can be performed in other orders or simultaneously. Secondly, those skilled in the art should also be aware that the embodiments described in the specification are all preferred embodiments, and the actions involved are not necessarily required by the embodiments of the present invention.

[0114] Reference Figure 4 , shows a structural block diagram of a device for processing security abnormality services provided by an embodiment of the present invention, which is applied to a security gateway, and the security gateway is connected to an SRv6 routing forwarding network, and specifically may include the following modules:

[0115] The acquisition module 401 is used to acquire service information when the user uses the SRv6 routing forwarding service;

[0116] An analysis module 402 is used to perform a security analysis on the routing and forwarding service according to the service information to determine whether the routing and forwarding service is a security abnormality service;

[0117] The marking module 403 is used to mark the risk level of the security abnormality service if the routing forwarding service is a security abnormality service, and determine the security forwarding risk level of the security abnormality service;

[0118] The forwarding module 404 is used to forward the security abnormality service to the abnormal service system for processing according to the security forwarding risk level of the security abnormality service.

[0119] In an optional embodiment, the device further includes:

[0120] A monitoring module is used to monitor the user's inlet and outlet traffic services and obtain inlet and outlet traffic service information;

[0121] A module is established to establish a security indicator feature library based on user services based on the inlet and outlet traffic service information.

[0122] In an optional embodiment, the security gateway includes a DPI deep packet inspection module, and the establishment module includes:

[0123] A calling submodule, used to call the DPI module, analyze the inlet and outlet traffic service information, and obtain the user service type;

[0124] An autonomous learning submodule, used to perform autonomous learning based on the inlet and outlet traffic service information to determine the service security index;

[0125] The feature library establishment submodule is used to establish a security indicator feature library based on user services according to the user service type and the service security indicator.

[0126] In an optional embodiment, the service security indicator includes at least one of a five-tuple, user access information, service traffic status, service usage duration, and service usage status.

[0127] In an optional embodiment, the analysis module includes:

[0128] An extraction submodule, used to extract multiple business security information from the business information;

[0129] A comparison submodule, used to compare the plurality of business security information with the corresponding business security indicators respectively;

[0130] An abnormal service determination submodule, configured to determine that the routing forwarding service is a security abnormal service if at least one service security information does not meet the corresponding security indicator;

[0131] The non-business determination submodule is used to determine that the routing forwarding business is not a security abnormal business if each business security information meets the corresponding security indicator.

[0132] In an optional embodiment, the forwarding module includes:

[0133] A diversion submodule, used for diverting the abnormal security business;

[0134] A risk type determination submodule, used to determine the risk type of the security abnormality business according to the security index that the security abnormality business does not meet;

[0135] The diversion forwarding submodule is used to forward the diverted business flow to the abnormal business system for processing according to the risk type of the abnormal security business and the security forwarding risk level.

[0136] In an optional embodiment, the traffic splitting and forwarding submodule includes:

[0137] A policy determination unit, configured to re-determine an SRv6 forwarding policy and an SRv6 forwarding path list according to the risk type of the security abnormality service and the security forwarding risk level;

[0138] The processing unit is used to forward the diverted service flow to the abnormal service system for processing according to the SRv6 forwarding strategy and the SRv6 forwarding path list.

[0139] In an embodiment of the present invention, by connecting a security gateway to an SRv6 routing and forwarding network, when a user uses an SRv6 routing and forwarding service, service information is obtained; based on the service information, a security analysis is performed on the routing and forwarding service to determine whether the routing and forwarding service is a security abnormality service; if the routing and forwarding service is a security abnormality service, a risk level is marked on the security abnormality service to determine the security forwarding risk level of the security abnormality service; based on the security forwarding risk level of the security abnormality service, the security abnormality service is forwarded to an abnormal service system for processing, so that when the security gateway encounters a security problem, the service is risk-marked and forwarded to a designated area or system as soon as possible, so as to achieve safety, isolation, and effectiveness, which is conducive to improving the security protection of the SRV6 user service level.

[0140] As for the device embodiment, since it is basically similar to the method embodiment, the description is relatively simple, and the relevant parts can be referred to the partial description of the method embodiment.

[0141] An embodiment of the present invention further provides an electronic device, including:

[0142] It includes a processor, a memory, and a computer program stored in the memory and capable of running on the processor. When the computer program is executed by the processor, each process of the above-mentioned security exception business processing method embodiment is implemented, and the same technical effect can be achieved. To avoid repetition, it will not be repeated here.

[0143] An embodiment of the present invention also provides a computer-readable storage medium, on which a computer program is stored. When the computer program is executed by a processor, the various processes of the above-mentioned security exception business processing method embodiment are implemented, and the same technical effect can be achieved. To avoid repetition, it will not be repeated here.

[0144] The various embodiments in this specification are described in a progressive manner, and each embodiment focuses on the differences from other embodiments. The same or similar parts between the various embodiments can be referenced to each other.

[0145] It will be appreciated by those skilled in the art that the embodiments of the present invention may be provided as methods, devices, or computer program products. Therefore, the embodiments of the present invention may take the form of a complete hardware embodiment, a complete software embodiment, or an embodiment combining software and hardware. Moreover, the embodiments of the present invention may take the form of a computer program product implemented on one or more computer-usable storage media (including but not limited to disk storage, CD-ROM, optical storage, etc.) containing computer-usable program codes.

[0146] The embodiments of the present invention are described with reference to the flowcharts and / or block diagrams of the methods, terminal devices (systems), and computer program products according to the embodiments of the present invention. It should be understood that each process and / or block in the flowchart and / or block diagram, as well as the combination of the processes and / or blocks in the flowchart and / or block diagram, can be implemented by computer program instructions. These computer program instructions can be provided to a processor of a general-purpose computer, a special-purpose computer, an embedded processor, or other programmable data processing terminal device to generate a machine, so that the instructions executed by the processor of the computer or other programmable data processing terminal device generate instructions for implementing the processes in the flowchart and / or block diagram. Figure 1 A process or multiple processes and / or boxes Figure 1 A device that provides the functions specified in a block or multiple blocks.

[0147] These computer program instructions may also be stored in a computer readable memory capable of directing a computer or other programmable data processing terminal device to operate in a specific manner, so that the instructions stored in the computer readable memory produce a manufactured product including an instruction device, which implements the process Figure 1 A process or multiple processes and / or boxes Figure 1 A function specified in one or more boxes.

[0148] These computer program instructions can also be loaded onto a computer or other programmable data processing terminal device so that a series of operating steps are executed on the computer or other programmable terminal device to produce a computer-implemented process, thereby providing instructions for implementing the process in the computer or other programmable terminal device. Figure 1 A process or multiple processes and / or boxes Figure 1 The steps for the functions specified in one or more boxes.

[0149] Although the preferred embodiments of the present invention have been described, those skilled in the art may make additional changes and modifications to these embodiments once they have learned the basic creative concept. Therefore, the appended claims are intended to be interpreted as including the preferred embodiments and all changes and modifications that fall within the scope of the embodiments of the present invention.

[0150] Finally, it should be noted that, in this article, relational terms such as first and second, etc. are only used to distinguish one entity or operation from another entity or operation, and do not necessarily require or imply any such actual relationship or order between these entities or operations. Moreover, the terms "include", "comprise" or any other variants thereof are intended to cover non-exclusive inclusion, so that a process, method, article or terminal device including a series of elements includes not only those elements, but also other elements not explicitly listed, or also includes elements inherent to such process, method, article or terminal device. In the absence of further restrictions, the elements defined by the sentence "comprise a ..." do not exclude the existence of other identical elements in the process, method, article or terminal device including the elements.

[0151] The above is a detailed introduction to a method, device, electronic device and storage medium for processing security exception services provided by the present invention. Specific examples are used in this article to illustrate the principles and implementation methods of the present invention. The description of the above embodiments is only used to help understand the method of the present invention and its core idea; at the same time, for general technical personnel in this field, according to the idea of ​​the present invention, there will be changes in the specific implementation method and application scope. In summary, the content of this specification should not be understood as a limitation on the present invention.

Claims

1. A method for processing security abnormality services, characterized in that: Applied to a security gateway, the security gateway includes a DPI deep packet inspection module, the security gateway is connected to an SRv6 routing forwarding network, and the method includes: Monitor the user's inbound and outbound traffic services and obtain inbound and outbound traffic service information; Based on the inlet and outlet traffic service information, a security indicator feature library based on user services is established; When users use SRv6 routing forwarding services, obtain service information; Performing a security analysis on the routing and forwarding service according to the service information to determine whether the routing and forwarding service is a security abnormality service; If the routing forwarding service is a security abnormality service, marking the risk level of the security abnormality service to determine the security forwarding risk level of the security abnormality service; forwarding the security abnormality service to the abnormal service system for processing according to the security forwarding risk level of the security abnormality service; Wherein, the establishment of a security indicator feature library based on user services based on the inlet and outlet traffic service information includes: Calling the DPI module to analyze the inlet and outlet traffic service information to obtain the user service type; Perform autonomous learning based on the inlet and outlet traffic business information to determine business security indicators; A security indicator feature library based on user services is established according to the user service type and the service security indicator.

2. The method according to claim 1, characterized in that The service security indicator includes at least one of a five-tuple, user access information, service flow status, service usage duration, and service usage status.

3. The method according to claim 1, characterized in that The performing security analysis on the routing forwarding service according to the service information to determine whether the routing forwarding service is a security abnormality service includes: Extracting multiple business security information from the business information; Comparing the plurality of business security information with the corresponding business security indicators respectively; If at least one service security information does not meet the corresponding security indicator, determining that the routing forwarding service is a security abnormality service; If each service security information meets the corresponding security indicator, it is determined that the routing forwarding service is not a security abnormality service.

4. The method according to claim 3, characterized in that The forwarding of the security abnormality service to the abnormal service system for processing according to the security forwarding risk level of the security abnormality service includes: Diverting the abnormal security business; Determining the risk type of the security abnormality business according to the security index that the security abnormality business does not meet; According to the risk type of the abnormal security service and the security forwarding risk level, the diverted service flow is forwarded to the abnormal service system for processing.

5. The method according to claim 4, characterized in that The forwarding of the diverted service flow to the abnormal service system for processing according to the risk type of the abnormal security service and the security forwarding risk level includes: Re-determining the SRv6 forwarding strategy and the SRv6 forwarding path list according to the risk type of the abnormal security service and the security forwarding risk level; According to the SRv6 forwarding strategy and the SRv6 forwarding path list, the diverted service flow is forwarded to the abnormal service system for processing.

6. A device for processing security abnormality services, characterized in that: Applied to a security gateway, the security gateway includes a DPI deep packet inspection module, the security gateway is connected to an SRv6 routing forwarding network, and the device includes: A monitoring module is used to monitor the user's inlet and outlet traffic services and obtain inlet and outlet traffic service information; Establishing a module for establishing a security indicator feature library based on user services based on the inlet and outlet traffic service information; An acquisition module is used to obtain service information when a user uses the SRv6 routing forwarding service; An analysis module, configured to perform a security analysis on the routing and forwarding service according to the service information, and determine whether the routing and forwarding service is a security abnormality service; A marking module, for marking the risk level of the abnormal security service if the routing forwarding service is an abnormal security service, and determining the security forwarding risk level of the abnormal security service; A forwarding module, used for forwarding the security abnormality service to an abnormal service system for processing according to the security forwarding risk level of the security abnormality service; Wherein, the establishment module includes: A calling submodule, used to call the DPI module, analyze the inlet and outlet traffic service information, and obtain the user service type; An autonomous learning submodule, used to perform autonomous learning based on the inlet and outlet traffic service information to determine the service security index; The feature library establishment submodule is used to establish a security indicator feature library based on user services according to the user service type and the service security indicator.

7. An electronic device, characterized in that: include: A processor, a memory, and a computer program stored in the memory and capable of running on the processor, wherein when the computer program is executed by the processor, the steps of the method for processing security abnormality business as described in any one of claims 1 to 5 are implemented.

8. A computer-readable storage medium, characterized in that: The computer-readable storage medium stores a computer program, and when the computer program is executed by a processor, the steps of the method for processing security abnormality services according to any one of claims 1 to 5 are implemented.

Images