A method, device and storage medium for determining an invalid firewall policy

Abstract

The embodiment of the specification relates to the field of information security, can be used in the field of intelligent operation and maintenance and financial technology, and specifically provides a method and device for determining invalid firewall policy, equipment and storage medium, wherein the method comprises: collecting the hit number of firewall policy in a firewall device once every set period; calculating the hit number change value of each firewall policy according to the current hit number of firewall policy and the hit number of firewall policy collected last time; if the hit number change value is 0, the corresponding firewall policy is determined as an invalid policy; if the hit number change value is less than the corresponding dynamic value, the corresponding firewall policy is marked; based on the hit number of firewall policy collected subsequently, the hit number change of the marked firewall policy is predicted to obtain whether the marked firewall policy is an invalid policy. The embodiment of the specification can accurately determine the invalid policy.

Description

Technical Field

[0001] This specification relates to the field of network security, and in particular, to a method, apparatus, device, and storage medium for determining invalid firewall policies. Background Technology

[0002] As cybersecurity threats become increasingly complex and network structures become more sophisticated, large financial industry data centers have deployed firewall devices between various network zones, and access between these zones is controlled by firewall policies.

[0003] In practical applications, there are often some policies that are not actually used or that have been deactivated and are no longer accessed. These policies are not used for a long time and will not be hit, so they are invalid policies. Invalid policies occupy firewall policy entries and memory, which will increase the pressure on the firewall over time, affect the firewall performance, and ultimately affect the business.

[0004] Therefore, there is an urgent need for a method to identify invalid firewall policies that can accurately determine invalid policies, thereby processing them and improving the overall performance of the firewall. Summary of the Invention

[0005] The purpose of the embodiments in this specification is to provide a method, apparatus, device, and storage medium for determining invalid firewall policies, so as to more accurately determine invalid policies, process invalid policies, and improve the overall performance of the firewall.

[0006] To achieve the above objectives, in one aspect, embodiments of this specification provide a method for determining invalid firewall policies, including:

[0007] The number of times the firewall policy is hit in the firewall device is collected every set period, where the number of hits is the cumulative number of times the firewall policy has been hit since it was put into use.

[0008] The change in the hit count of each firewall policy is calculated based on the current hit count and the hit count of the firewall policy collected in the last time.

[0009] If the change in the number of hits is 0, the corresponding firewall policy will be determined as an invalid policy.

[0010] If the change in the number of hits is less than the corresponding dynamic value, then the corresponding firewall policy is marked.

[0011] Based on the hit count of the subsequently collected firewall policies, the change in the hit count of the marked firewall policies is predicted, and it is determined whether the marked firewall policies are invalid.

[0012] Preferably, the step of predicting the change in the hit count of the marked firewall policy based on the subsequently collected firewall policy hit count, and determining whether the marked firewall policy is an invalid policy, further includes:

[0013] After each subsequent collection of the number of hits of the firewall policy, the growth rate of the change in the number of hits of the marked firewall policy compared with the change in the number of hits at the previous collection is calculated.

[0014] If the growth rate corresponding to a marked firewall policy is not negative for multiple consecutive times, it is determined that the marked firewall policy is not an invalid policy, the marking of the firewall policy is cancelled, and the hit count of the firewall policy does not need to be collected in the next data collection.

[0015] If the growth rate corresponding to a certain marked firewall policy is negative multiple times in a row, then based on the change value of the hit count of the marked firewall policy collected multiple times in a row, it is predicted whether there is a time when the change value of the hit count of the marked firewall policy is 0, so as to determine whether the marked firewall policy is an invalid policy.

[0016] Preferably, the step of predicting whether there is a moment when the hit count change value of the marked firewall policy is 0 based on the hit count change value collected multiple times in succession further includes:

[0017] Based on the change in the number of hits of the marked firewall policy collected multiple times, a change function of the marked firewall policy is fitted.

[0018] Determine whether there is a valid independent variable value when the function value of the change function is 0;

[0019] If so, there exists a time when the hit count change value of the marked firewall policy is 0;

[0020] If not, then the hit count change value of the marked firewall policy does not have a time when it is 0.

[0021] Preferably, after the moment when the hit count change value of the marked firewall policy reaches 0, the process further includes:

[0022] The target time is obtained based on the effective independent variable value corresponding to the function value of the change function being 0;

[0023] When the target time arrives, the hit count of the marked firewall policy is collected once, and it is determined whether the hit count of the marked firewall policy at the target time is equal to the hit count before the target time.

[0024] If so, the marked firewall policy will be cleared at the target time.

[0025] Preferably, the method for determining the dynamic value corresponding to the change in the number of hits includes:

[0026] Before collecting the hit count of each firewall policy, obtain the historical hit count change value for each firewall policy;

[0027] Outlier removal is performed on the historical hit count change values ​​to obtain the historical hit count change values ​​after removal;

[0028] Calculate the average value of the historical hit count changes after the removal, and use it as the dynamic value corresponding to the hit count change value.

[0029] Preferably, the method for determining the set period includes:

[0030] Count the number of firewall policies in all firewall devices;

[0031] Sort all firewall devices from largest to smallest according to the stated number;

[0032] The setting period for each firewall device is determined based on the sorting, with firewall devices ranked higher in the sort having shorter setting periods.

[0033] Preferred options also include:

[0034] If the change in the number of hits is not less than the corresponding dynamic value, then it is not necessary to collect the hit count of the corresponding firewall policy in subsequent collections or multiple consecutive collections.

[0035] On the other hand, embodiments of this specification provide an apparatus for determining invalid firewall policies, the apparatus comprising:

[0036] The data collection module is used to collect the number of times the firewall policy is hit in the firewall device at set intervals, wherein the number of hits is the cumulative number of times the firewall policy has been hit since it was put into use.

[0037] The calculation module is used to calculate the change in the hit count of each firewall policy based on the current hit count and the hit count of the firewall policy collected last time.

[0038] The determination module is used to determine the corresponding firewall policy as invalid if the change value of the hit count is 0.

[0039] The marking module is used to mark the corresponding firewall policy if the change value of the hit count is less than the corresponding dynamic value;

[0040] The prediction module is used to predict the change in the hit count of the marked firewall policy based on the hit count of the subsequently collected firewall policies, and to determine whether the marked firewall policy is an invalid policy.

[0041] In another aspect, embodiments of this specification also provide a computer device, including a memory, a processor, and a computer program stored in the memory, wherein the computer program, when executed by the processor, performs instructions according to any of the methods described above.

[0042] In another aspect, embodiments of this specification also provide a computer-readable storage medium having a computer program stored thereon, which, when executed by a processor of a computer device, performs instructions according to any one of the methods described above.

[0043] In another aspect, embodiments of this specification also provide a computer program product that, when run by a processor of a computer device, executes instructions according to any one of the methods described above.

[0044] As can be seen from the technical solutions provided in the embodiments of this specification above, the embodiments of this specification collect the number of hits of firewall policies in the firewall device at set intervals, and then calculate the change value of the number of hits for each firewall policy. Based on the change value of the number of hits, it is determined whether the firewall policy is an invalid policy or to mark the firewall policy. The change in the number of hits of the marked firewall policy is predicted, and then it is determined whether the marked firewall policy has the possibility of becoming an invalid policy in the future. The method of the embodiments of this specification can accurately determine invalid policies, and on this basis, it can predict the time when invalid policies will occur in advance, so as to provide early warning, handle invalid policies in a timely manner, and improve the overall performance of the firewall.

[0045] To make the above and other objects, features and advantages of this specification more apparent and understandable, preferred embodiments are described below in detail with reference to the accompanying drawings. Attached Figure Description

[0046] To more clearly illustrate the technical solutions in the embodiments or prior art of this specification, the drawings used in the description of the embodiments or prior art will be briefly introduced below. Obviously, the drawings described below are only some embodiments of this specification. For those skilled in the art, other drawings can be obtained based on these drawings without creative effort.

[0047] Figure 1 A flowchart illustrating a method for determining an invalid firewall policy provided in an embodiment of this specification is shown.

[0048] Figure 2 This document illustrates a flowchart illustrating how the number of hits of a marked firewall policy changes, as provided in an embodiment of this specification, to determine whether a marked firewall policy is invalid.

[0049] Figure 3 This document illustrates a flowchart illustrating whether there exists a moment when the change in the number of hits of a tagged firewall policy is zero, as provided in an embodiment of this specification.

[0050] Figure 4 This diagram illustrates the process after the hit count change value of the marked firewall policy provided in the embodiments of this specification reaches 0.

[0051] Figure 5 A flowchart illustrating the method for determining the dynamic value corresponding to the change in the number of hits provided in the embodiments of this specification is shown.

[0052] Figure 6 A flowchart illustrating the method for determining the set period provided in the embodiments of this specification is shown.

[0053] Figure 7 A schematic diagram of the module structure of an invalid firewall policy determination device provided in an embodiment of this specification is shown;

[0054] Figure 8 A schematic diagram of the structure of a computer device provided in an embodiment of this specification is shown.

[0055] Explanation of symbols in the attached drawings:

[0056] 100. Data Acquisition Module;

[0057] 200. Calculation module;

[0058] 300. Determine the module;

[0059] 400, Marking Module;

[0060] 500. Prediction module;

[0061] 802. Computer equipment;

[0062] 804, Processor;

[0063] 806. Memory;

[0064] 808. Drive mechanism;

[0065] 810. Input / Output Module;

[0066] 812. Input devices;

[0067] 814. Output devices;

[0068] 816. Presentation equipment;

[0069] 818. Graphical User Interface;

[0070] 820. Network interface;

[0071] 822. Communication link;

[0072] 824. Communication bus. Detailed Implementation

[0073] The technical solutions in the embodiments of this specification will be clearly and completely described below with reference to the accompanying drawings. Obviously, the described embodiments are only some embodiments of this specification, and not all embodiments. Based on the embodiments in this specification, all other embodiments obtained by those skilled in the art without creative effort are within the scope of protection of the embodiments of this specification.

[0074] As cybersecurity threats become increasingly complex and network structures become more sophisticated, large financial industry data centers have deployed firewall devices between various network zones, and access between these zones is controlled by firewall policies.

[0075] In practical applications, there are often some policies that are not actually used or that have been deactivated and are no longer accessed. These policies are not used for a long time and will not be hit, so they are invalid policies. Invalid policies occupy firewall policy entries and memory, which will increase the pressure on the firewall over time, affect the firewall performance, and ultimately affect the business.

[0076] To address the aforementioned issues, this specification provides a method for determining invalid firewall policies. Figure 1 This is a flowchart illustrating a method for determining an invalid firewall policy provided in an embodiment of this specification. This specification provides the operational steps described in the embodiments or flowchart, but based on conventional or non-inventive labor, more or fewer operational steps may be included. The order of steps listed in the embodiments is merely one possible execution order among many and does not represent the only possible execution order. In actual system or device products, the methods shown in the embodiments or drawings can be executed sequentially or in parallel.

[0077] It should be noted that the terms "first," "second," etc., in the description, claims, and accompanying drawings of the embodiments in this specification are used to distinguish similar objects and are not necessarily used to describe a specific order or sequence. It should be understood that such data can be interchanged where appropriate so that the embodiments described herein can be implemented in orders other than those illustrated or described herein. Furthermore, the terms "comprising" and "having," and any variations thereof, are intended to cover non-exclusive inclusion; for example, a process, method, apparatus, product, or device that includes a series of steps or units is not necessarily limited to those steps or units explicitly listed, but may include other steps or units not explicitly listed or inherent to such processes, methods, products, or devices.

[0078] Reference Figure 1 This specification provides a method for determining invalid firewall policies, the method comprising:

[0079] S101: Collect the number of times the firewall policy is hit in the firewall device every set period, wherein the number of hits is the cumulative number of times the firewall policy has been hit since it was put into use.

[0080] S102: Calculate the change in the hit count of each firewall policy based on the current hit count and the hit count of the firewall policy collected last time.

[0081] S103: If the change in the number of hits is 0, then the corresponding firewall policy is determined to be an invalid policy;

[0082] S104: If the change in the number of hits is less than the corresponding dynamic value, then mark the corresponding firewall policy;

[0083] S105: Based on the hit count of the firewall policy collected subsequently, predict the change in the hit count of the marked firewall policy to determine whether the marked firewall policy is an invalid policy.

[0084] For any firewall device, it may include one or more firewall policies. During normal use, firewall policies are generally hit. A hit means that the corresponding firewall policy is accessed and used. The number of hits for a firewall policy is the number of times it has been accessed and used. In the embodiments of this specification, the number of hits refers to the number of times a firewall policy has been hit since it was first implemented. For example, if firewall policy a in firewall device A has a hit count of 10, and after a set period, the hit count of firewall policy a is collected again and is 15, then the current hit count of firewall policy a is 15. The change in the hit count of firewall policy a is the current hit count minus the hit count of the previously collected firewall policy, which is 15 - 10 = 5 times.

[0085] If the hit count change value is 0, it means the firewall policy was not hit within the set period. This means the corresponding firewall policy occupies memory but is not accessed or invoked, thus it is determined to be an invalid policy, which can be cleared. If the hit count change value is not 0, it is checked whether it is less than the corresponding dynamic value. If it is not less, it means the firewall policy has hit many times within the set period and is unlikely to be accessed or invoked in the near future, so it may not become an invalid policy later. If it is less, it means the firewall policy has hit fewer times within the set period and may not be accessed or invoked in the near future, but it may become an invalid policy later.

[0086] For firewall policies whose hit count change value is less than the corresponding dynamic value, the corresponding firewall policy needs to be marked. Subsequently, the hit count of the marked firewall policy is still collected at set intervals. Based on the subsequent collected hit counts, the change in the hit count of the marked firewall policy is predicted, thereby determining whether the marked firewall policy is actually invalid. However, for firewall policies whose hit count change value is not less than the corresponding dynamic value, the hit count of the corresponding firewall policy does not need to be collected in subsequent collections. This case-by-case collection and prediction improves the efficiency of collecting invalid firewall policies and also improves the accuracy of invalid policy identification.

[0087] In the embodiments described in this specification, reference is made to Figure 2 The step of predicting the change in the hit count of the marked firewall policy based on the subsequently collected firewall policy hit count, and determining whether the marked firewall policy is an invalid policy, further includes:

[0088] S201: After each subsequent collection of the number of hits of the firewall policy, calculate the growth rate of the change in the number of hits of the marked firewall policy compared to the change in the number of hits at the time of the previous collection.

[0089] S202: If the growth rate corresponding to a certain marked firewall policy is not negative for multiple consecutive times, then the marked firewall policy is determined to be an invalid policy, the marking of the firewall policy is cancelled, and the hit count of the firewall policy does not need to be collected in the next data collection.

[0090] S203: If the growth rate corresponding to a certain marked firewall policy is negative multiple times in a row, then based on the hit count change value of the marked firewall policy collected multiple times in a row, predict whether there is a time when the hit count change value of the marked firewall policy is 0, so as to determine whether the marked firewall policy is an invalid policy.

[0091] The growth rate is a value used to measure the increase in the number of hits. A positive growth rate means that the number of hits has increased, a growth rate of 0 means that the number of hits has remained unchanged, and a negative growth rate means that the number of hits has decreased.

[0092] Taking firewall policy a marked in firewall device A as an example, its hit count was 10 in the first data collection, 15 in the second data collection after the set period (a change of 5 hits), 19 in the third data collection (a change of 4 hits), and 22 in the fourth data collection (a change of 3 hits). The growth rate of the change in hit count in the third data collection compared to the previous data collection was (4-5) / 5 = -20%, and the growth rate of the change in hit count in the fourth data collection compared to the previous data collection was (3-4) / 4 = -25%. It can be seen that the growth rate of the marked firewall policy a was negative for both of the first two data collections.

[0093] In the embodiments of this specification, depending on the actual situation, it can be considered that two consecutive negative values ​​meet the execution condition of S203, or two consecutive non-negative values ​​meet the execution condition of S202. Obviously, the marked firewall policy a needs to execute S203. Based on the hit count change value collected twice (i.e., the third and fourth times), it is predicted whether the hit count change value a of the marked firewall policy is 0 at any time, so as to determine whether it is an invalid policy. It should be noted that determining whether it is an invalid policy here does not mean that it is currently an invalid policy, but that it may become an invalid policy in the future, so as to predict the time when the invalid policy will be generated in advance, and thus provide early warning, handle the invalid policy in a timely manner, and improve the overall performance of the firewall.

[0094] During each data collection, the dynamic value corresponding to the change in the number of hits will change. However, if there is even one data collection instance where the change in the number of hits is less than the corresponding dynamic value, the corresponding firewall policy needs to be marked. But as long as the growth rate corresponding to the marked firewall policy is not negative (positive or 0) for multiple consecutive times, the marking of the firewall policy can be removed. Of course, it is possible for a firewall policy to be marked, then unmarked, and then marked again.

[0095] Specifically, refer to Figure 3 The step of predicting whether there exists a moment when the hit count change value of the marked firewall policy is 0, based on the continuously collected hit count change value of the marked firewall policy, further includes:

[0096] S301: Based on the change value of the hit count of the marked firewall policy collected multiple times, a change function of the marked firewall policy is fitted.

[0097] S302: Determine whether there is a valid independent variable value when the function value of the change function is 0;

[0098] S303: If so, there is a time when the hit count change value of the marked firewall policy is 0;

[0099] S304: If not, then the hit count change value of the marked firewall policy does not have a time when it is 0.

[0100] Taking firewall policy a marked in firewall device A as an example, the hit count changed by 5 times in the second collection after the set period, 4 times in the third collection, and 3 times in the fourth collection. Based on these consecutive changes in the hit count, the change function of the marked firewall policy a can be fitted as y = -x + 7. It is determined that when the function value y is 0, x is 7, indicating the existence of a valid independent variable value. This means that there is a time when the hit count change of the marked firewall policy a is 0, which is the seventh collection time. Therefore, it is concluded that the marked firewall policy a may become an invalid policy at the seventh collection time, thus achieving the purpose of prior prediction.

[0101] In the embodiments described in this specification, reference is made to Figure 4 After the hit count change value of the marked firewall policy reaches 0, the following is also included:

[0102] S401: Obtain the target time based on the effective independent variable value corresponding to the function value of the change function being 0;

[0103] S402: When the target time arrives, collect the hit count of the marked firewall policy once, and determine whether the hit count of the marked firewall policy at the target time is equal to the hit count before the target time;

[0104] S403: If so, then clear the marked firewall policy at the target time.

[0105] Continuing the example above, when the function value of the change function is 0, the corresponding independent variable value is 7. The seventh sampling time is taken as the target time. When the seventh sampling time arrives, the hit count of the marked firewall policy is collected once. To improve efficiency and save costs, after obtaining the target time, the hit count of the corresponding marked firewall policy can be omitted before the target time arrives, or the collection frequency can be reduced, for example, by performing interval collection, collecting the hit count of the marked firewall policy once at a set interval. If the hit count of the marked firewall policy at the target time is equal to the hit count before the target time, it means that the marked firewall policy has become an invalid policy at the target time, and the prediction was successful. At this time, a clearing operation can be performed in time to remove the marked firewall policy.

[0106] In the embodiments described in this specification, reference is made to Figure 5 The method for determining the dynamic value corresponding to the change in the number of hits includes:

[0107] S501: Before collecting the hit count of each firewall policy, obtain the historical hit count change value for each firewall policy.

[0108] S502: Remove outliers from the historical hit count change values ​​to obtain the removed historical hit count change values;

[0109] S503: Calculate the average value of the historical hit count changes after the removal, and use it as the dynamic value corresponding to the hit count changes.

[0110] Each time data is collected, the dynamic value corresponding to the firewall policy changes. This dynamic value reflects the change in the number of hits the firewall policy should meet, which can be determined based on the historical hit count changes of the firewall policy. Outliers in the historical hit count changes refer to situations where the firewall policy is frequently invoked within a certain period, or infrequently invoked within the same period. These infrequent or infrequent invocations may be due to newly launched services or other uncommon reasons, resulting in extremely large or small hit count changes. To better measure the hit count changes and more accurately calculate the dynamic value, these outliers need to be removed. Outliers are generally characterized by extremely large or small values, such as values ​​exceeding other hit count changes by 3-5 times or being less than 1 / 3-1 / 5 of other hit count changes. The average of the removed historical hit count changes is calculated as the dynamic value corresponding to the hit count change.

[0111] In the embodiments described in this specification, reference is made to Figure 6 The method for determining the set period includes:

[0112] S601: Count the number of firewall policies in all firewall devices;

[0113] S602: Sort all firewall devices from largest to smallest according to the stated number;

[0114] S603: Determine the setting period for each firewall device according to the sorting, wherein the setting period for the firewall device ranked higher is shorter.

[0115] Specifically, each firewall device has one or more firewall policies. The configuration period for a firewall device is related to the number of firewall policies. In particular, the more firewall policies there are, the more likely there are invalid policies. Therefore, all firewall devices are sorted according to the number of firewall policies. The firewall device with the most firewall policies has a shorter configuration period, and the firewall device with the fewest firewall policies has a longer configuration period.

[0116] In addition, the corresponding setting period can be determined by taking into account the number of firewall policies in the firewall device, the throughput of the firewall device, and the service type corresponding to the firewall device.

[0117] Specifically as follows:

[0118] Step 1: Normalize the number of firewall policies, the throughput of the firewall, and the service type corresponding to the firewall to obtain three sets of normalized data.

[0119] Step 2: Based on the weights corresponding to the three sets of data after normalization, perform a weighted calculation on the three sets of data after normalization to obtain the score of the firewall device;

[0120] Step 3: Sort all firewall devices from highest to lowest score;

[0121] Step 4: Determine the setting period for each firewall device according to the sorting, where the setting period for firewall devices ranked higher in the sorting is shorter.

[0122] It's important to note that the number of firewall policies, the throughput of a firewall device, and the corresponding service type belong to three different dimensions. Therefore, normalization is needed to convert these three different dimensions into three sets of data under the same dimension. Based on the actual situation, if the number of firewall policies is m, the corresponding throughput of the appropriate firewall device is n. Assuming firewall device A has M firewall policies and N throughput, the first set of normalized data is M / m, and the second set is N / n. Regarding service types, some are more important, such as money transfers, where shorter periods are better; others are less important, such as queries, where longer periods are acceptable. Therefore, all firewall devices can be sorted according to the importance of the service type, with higher importance ranking lower. The sorting number of the firewall device is used as its corresponding third set of data, thus obtaining the three sets of data.

[0123] The weights corresponding to the three sets of data can be set according to the actual situation, such as 20%, 30%, and 50% respectively. After multiplying each set of data by its corresponding weight, the results are summed to obtain the score of each firewall device. All firewall devices are then sorted from highest to lowest score, with the firewall device ranked higher having a shorter set period.

[0124] The method for determining the set period in the embodiments of this specification allows for a more flexible and reasonable determination of the set period for each firewall device, thereby making the collection frequency of firewall policy hit counts more scientific and reasonable.

[0125] Based on the above-described method for determining an invalid firewall policy, this specification also provides a corresponding apparatus for determining an invalid firewall policy. The apparatus may include a system (including a distributed system), software (application), module, component, server, client, etc., using the method described in this specification, combined with necessary implementation hardware. Based on the same innovative concept, the apparatuses in one or more embodiments provided in this specification are as described in the following embodiments. Since the implementation schemes and methods for solving the problem are similar, the implementation of specific apparatuses in this specification can refer to the implementation of the aforementioned method, and repeated details will not be repeated. As used below, the terms "unit" or "module" can refer to a combination of software and / or hardware that implements a predetermined function. Although the apparatuses described in the following embodiments are preferably implemented in software, hardware implementations, or a combination of software and hardware, are also possible and contemplated.

[0126] Specifically, Figure 7 This is a schematic diagram of the module structure of one embodiment of the device for determining an invalid firewall policy provided in this specification. (Refer to...) Figure 7As shown in the embodiments of this specification, an invalid firewall policy determination device includes: a collection module 100, a calculation module 200, a determination module 300, a marking module 400, and a prediction module 500.

[0127] The data collection module 100 is used to collect the number of times the firewall policy is hit in the firewall device at set intervals, wherein the number of hits is the cumulative number of times the firewall policy has been hit since it was put into use.

[0128] The calculation module 200 is used to calculate the change in the hit count of each firewall policy based on the current hit count of the firewall policy and the hit count of the firewall policy collected in the last time.

[0129] The determination module 300 is used to determine the corresponding firewall policy as invalid if the change value of the hit count is 0.

[0130] The marking module 400 is used to mark the corresponding firewall policy if the change value of the hit count is less than the corresponding dynamic value;

[0131] The prediction module 500 is used to predict the change in the hit count of the marked firewall policy based on the hit count of the subsequently collected firewall policy, and to determine whether the marked firewall policy is an invalid policy.

[0132] Reference Figure 8As shown, based on the above-described method for determining an invalid firewall policy, one embodiment of this specification also provides a computer device 802, wherein the above method operates on the computer device 802. The computer device 802 may include one or more processors 804, such as one or more central processing units (CPUs) or graphics processing units (GPUs), each processing unit implementing one or more hardware threads. The computer device 802 may also include any memory 806 for storing any kind of information such as code, settings, data, etc. In one specific embodiment, a computer program is stored on the memory 806 and can run on the processor 804. When the computer program is run by the processor 804, it can execute instructions according to the above method. Non-limitingly, for example, the memory 806 may include any type of RAM, any type of ROM, flash memory, hard disk, optical disk, etc. More generally, any memory can use any technology to store information. Further, any memory can provide volatile or non-volatile retention of information. Further, any memory can represent a fixed or removable component of the computer device 802. In one scenario, when processor 804 executes associated instructions stored in any memory or combination of memories, computer device 802 can perform any operation of the associated instructions. Computer device 802 also includes one or more drive mechanisms 808 for interacting with any memory, such as hard disk drive mechanisms, optical disk drive mechanisms, etc.

[0133] Computer device 802 may also include an input / output module 810 (I / O) for receiving various inputs (via input device 812) and providing various outputs (via output device 814). A specific output mechanism may include a presentation device 816 and an associated graphical user interface 818 (GUI). In other embodiments, the input / output module 810 (I / O), input device 812, and output device 814 may be omitted, and the device may function solely as a computer device within a network. Computer device 802 may also include one or more network interfaces 820 for exchanging data with other devices via one or more communication links 822. One or more communication buses 824 couple the components described above together.

[0134] Communication link 822 can be implemented in any way, such as via a local area network, a wide area network (e.g., the Internet), a point-to-point connection, or any combination thereof. Communication link 822 may include any combination of hardwired links, wireless links, routers, gateway functions, name servers, etc., governed by any protocol or combination of protocols.

[0135] Corresponding to Figures 1-6In addition to the methods described above, embodiments of this specification also provide a computer-readable storage medium storing a computer program that, when executed by a processor, performs the steps of the methods described above.

[0136] This specification also provides computer-readable instructions, wherein when a processor executes the instructions, the program therein causes the processor to perform the following... Figures 1 to 6 The method shown.

[0137] This specification also provides an embodiment of a computer program product, wherein when the computer program product is run by the processor of a computer device, it executes as follows: Figures 1 to 6 The method shown.

[0138] It should be understood that in the various embodiments of this specification, the sequence number of each process does not imply the order of execution. The execution order of each process should be determined by its function and internal logic, and should not constitute any limitation on the implementation process of the embodiments of this specification.

[0139] It should also be understood that, in the embodiments of this specification, the term "and / or" is merely a description of the relationship between related objects, indicating that three relationships can exist. For example, A and / or B can represent: A existing alone, A and B existing simultaneously, and B existing alone. Furthermore, in the embodiments of this specification, the character " / " generally indicates that the preceding and following related objects have an "or" relationship.

[0140] Those skilled in the art will recognize that the units and algorithm steps of the various examples described in conjunction with the embodiments disclosed in this specification can be implemented in electronic hardware, computer software, or a combination of both. To clearly illustrate the interchangeability of hardware and software, the components and steps of each example have been generally described in terms of functionality in the foregoing description. Whether these functions are implemented in hardware or software depends on the specific application and design constraints of the technical solution. Those skilled in the art can use different methods to implement the described functions for each specific application, but such implementations should not be considered beyond the scope of the embodiments in this specification.

[0141] Those skilled in the art will clearly understand that, for the sake of convenience and brevity, the specific working processes of the systems, devices, and units described above can be referred to the corresponding processes in the foregoing method embodiments, and will not be repeated here.

[0142] In the several embodiments provided in this specification, it should be understood that the disclosed systems, apparatuses, and methods can be implemented in other ways. For example, the apparatus embodiments described above are merely illustrative; for instance, the division of units is only a logical functional division, and in actual implementation, there may be other division methods. For example, multiple units or components may be combined or integrated into another system, or some features may be ignored or not executed. Furthermore, the couplings or direct couplings or communication connections shown or discussed may be indirect couplings or communication connections through some interfaces, devices, or units, or they may be electrical, mechanical, or other forms of connection.

[0143] The units described as separate components may or may not be physically separate. The components shown as units may or may not be physical units; that is, they may be located in one place or distributed across multiple network units. Some or all of the units can be selected to achieve the purpose of the embodiments described in this specification, depending on actual needs.

[0144] Furthermore, the functional units in the various embodiments of this specification can be integrated into one processing unit, or each unit can exist physically separately, or two or more units can be integrated into one unit. The integrated unit can be implemented in hardware or as a software functional unit.

[0145] If the integrated unit is implemented as a software functional unit and sold or used as an independent product, it can be stored in a computer-readable storage medium. Based on this understanding, the technical solutions of the embodiments of this specification, in essence, or the parts that contribute to the prior art, or all or part of the technical solutions, can be embodied in the form of a software product. This computer software product is stored in a storage medium and includes several instructions to cause a computer device (which may be a personal computer, server, or network device, etc.) to execute all or part of the steps of the methods described in the various embodiments of this specification. The aforementioned storage medium includes various media capable of storing program code, such as USB flash drives, portable hard drives, read-only memory (ROM), random access memory (RAM), magnetic disks, or optical disks.

[0146] This specification uses specific embodiments to illustrate the principles and implementation methods of the embodiments. The above description of the embodiments is only for the purpose of helping to understand the methods and core ideas of the embodiments in this specification. At the same time, for those skilled in the art, there will be changes in the specific implementation methods and application scope based on the ideas of the embodiments in this specification. Therefore, the content of this specification should not be construed as a limitation on the embodiments in this specification.

Claims

1. A method for determining an invalid firewall policy, characterized in that, The method includes: The number of times the firewall policy is hit in the firewall device is collected every set period, where the number of hits is the cumulative number of times the firewall policy has been hit since it was put into use. The change in the hit count of each firewall policy is calculated based on the current hit count and the hit count of the firewall policy collected in the last time. If the change in the number of hits is 0, the corresponding firewall policy will be determined as an invalid policy. If the change in the number of hits is less than the corresponding dynamic value, then the corresponding firewall policy is marked. Based on the hit count of the firewall policy collected subsequently, the change in the hit count of the marked firewall policy is predicted to determine whether the marked firewall policy is an invalid policy; wherein, the dynamic value is determined based on the historical hit count change value of the firewall policy. The step of predicting the change in the hit count of the marked firewall policy based on the subsequently collected firewall policy hit count, and determining whether the marked firewall policy is an invalid policy, further includes: After each subsequent collection of the number of hits of the firewall policy, the growth rate of the change in the number of hits of the marked firewall policy compared with the change in the number of hits at the previous collection is calculated. If the growth rate corresponding to a marked firewall policy is not negative for multiple consecutive times, it is determined that the marked firewall policy is not an invalid policy, the marking of the firewall policy is cancelled, and the hit count of the firewall policy does not need to be collected in the next data collection. If the growth rate corresponding to a certain marked firewall policy is negative multiple times in a row, then based on the change value of the hit count of the marked firewall policy collected multiple times in a row, it is predicted whether there is a time when the change value of the hit count of the marked firewall policy is 0, so as to determine whether the marked firewall policy is an invalid policy.

2. The method for determining invalid firewall policies according to claim 1, characterized in that, The step of predicting whether there exists a moment when the hit count change value of the marked firewall policy is 0, based on the hit count change value collected multiple times consecutively, further includes: Based on the change in the number of hits of the marked firewall policy collected multiple times, a change function of the marked firewall policy is fitted. Determine whether there is a valid independent variable value when the function value of the change function is 0; If so, there exists a time when the hit count change value of the marked firewall policy is 0; If not, then the hit count change value of the marked firewall policy does not have a time when it is 0.

3. The method for determining invalid firewall policies according to claim 2, characterized in that, After the hit count change value of the marked firewall policy reaches 0, the following is also included: The target time is obtained based on the effective independent variable value corresponding to the function value of the change function being 0; When the target time arrives, the hit count of the marked firewall policy is collected once, and it is determined whether the hit count of the marked firewall policy at the target time is equal to the hit count before the target time. If so, the marked firewall policy will be cleared at the target time.

4. The method for determining invalid firewall policies according to claim 1, characterized in that, The method for determining the dynamic value corresponding to the change in the number of hits includes: Before collecting the hit count of each firewall policy, obtain the historical hit count change value for each firewall policy; Outlier removal is performed on the historical hit count change values ​​to obtain the historical hit count change values ​​after removal; Calculate the average value of the historical hit count changes after the removal, and use it as the dynamic value corresponding to the hit count change value.

5. The method for determining invalid firewall policies according to claim 1, characterized in that, The method for determining the set period includes: Count the number of firewall policies in all firewall devices; Sort all firewall devices from largest to smallest according to the stated number; The setting period for each firewall device is determined based on the sorting, with firewall devices ranked higher in the sort having shorter setting periods.

6. The method for determining invalid firewall policies according to claim 1, characterized in that, Also includes: If the change in the number of hits is not less than the corresponding dynamic value, then it is not necessary to collect the hit count of the corresponding firewall policy in subsequent collections or multiple consecutive collections.

7. A device for determining an invalid firewall policy, characterized in that, The device includes: The data collection module is used to collect the number of times the firewall policy is hit in the firewall device at set intervals, wherein the number of hits is the cumulative number of times the firewall policy has been hit since it was put into use. The calculation module is used to calculate the change in the hit count of each firewall policy based on the current hit count and the hit count of the firewall policy collected last time. The determination module is used to determine the corresponding firewall policy as invalid if the change value of the hit count is 0. The marking module is used to mark the corresponding firewall policy if the change value of the hit count is less than the corresponding dynamic value; The prediction module is used to predict the change in the hit count of the marked firewall policy based on the hit count of the subsequently collected firewall policies, and to determine whether the marked firewall policy is an invalid policy. The dynamic value is determined based on the historical hit count changes of the firewall policy. Specifically, the prediction module is used for: After each subsequent collection of the number of hits of the firewall policy, the growth rate of the change in the number of hits of the marked firewall policy compared with the change in the number of hits at the previous collection is calculated. If the growth rate corresponding to a marked firewall policy is not negative for multiple consecutive times, it is determined that the marked firewall policy is not an invalid policy, the marking of the firewall policy is cancelled, and the hit count of the firewall policy does not need to be collected in the next data collection. If the growth rate corresponding to a certain marked firewall policy is negative multiple times in a row, then based on the change value of the hit count of the marked firewall policy collected multiple times in a row, it is predicted whether there is a time when the change value of the hit count of the marked firewall policy is 0, so as to determine whether the marked firewall policy is an invalid policy.

8. A computer device comprising a memory, a processor, and a computer program stored in the memory, characterized in that, When the computer program is run by the processor, it executes the instructions of the method according to any one of claims 1-6.

9. A computer-readable storage medium having a computer program stored thereon, characterized in that, When the computer program is run by the processor of the computer device, it executes the instructions of the method according to any one of claims 1-6.

10. A computer program product, characterized in that, When the computer program product is run by the processor of a computer device, it executes the instructions of the method according to any one of claims 1-6.

Images