Firewall anomaly monitoring method, device and system, and electronic device

Abstract

The application discloses a kind of abnormal monitoring method, device and system of firewall and electronic equipment, it is related to information security technical field, wherein, the method comprises: response monitoring instruction, running the monitoring script of firewall equipment, wherein, monitoring script is according to the operating state of each to be monitored firewall equipment of abnormal detection rule and is monitored, obtains state monitoring report, and abnormal detection rule is the detection rule that is induced after the operating abnormality of firewall equipment occurs in historical process, and each kind of firewall equipment is correspondingly set to one kind of monitoring script;Based on state monitoring report and the access IP address of firewall equipment, the operating state monitored is classified and analyzed, and obtains exception analysis report.The application solves the technical problem that the abnormal problem of firewall equipment cannot be effectively monitored in the related art, leading to continuous abnormality.

Description

Technical Field

[0001] This invention relates to the field of information security technology, and more specifically, to a method, apparatus, system, and electronic device for detecting anomalies in a firewall. Background Technology

[0002] Firewalls are fundamental network security devices. Whether at the network egress point or within the network itself, numerous firewall devices are needed to ensure network security. As customer networks and application scenarios become increasingly complex, firewalls inevitably encounter some difficult-to-reproduce anomalies in real-world applications. If these problems are not effectively and promptly detected and addressed by maintenance personnel, they can potentially have a significant impact on user businesses.

[0003] In related technologies, one method used for detecting anomalies in firewall devices is intrusion detection. For example, in intrusion detection of automotive Ethernet, this involves acquiring service-oriented data interaction middleware (SOME / IP) packets. If the SOME / IP packet's pre-defined detection process determines that the SOME / IP packet is abnormal, then the Ethernet packet is identified as an intrusion packet. This process uses at least one of the following detection steps to determine whether the Ethernet packet is an intrusion packet: the format of key fields in the SOME / IP packet header, the rules of the SOME / IP packet, and the session state of the SOME / IP packet. However, this detection method has significant drawbacks: it mainly relies on packet parsing to determine anomalies, lacking methods for locating, tracking, and analyzing the causes of anomalies.

[0004] Another method for detecting anomalies uses rule comparison. A portable terminal accesses the target network or firewall device to probe for activity. For existing firewall devices, the terminal automatically retrieves the corresponding configuration retrieval command from the command library based on the detected device model, obtaining the firewall's configuration information. This information is then compared with the configuration information retrieved from the correct rule library to determine if the target firewall's configuration is correct. If correct, the detection ends; otherwise, the terminal automatically modifies the configuration according to user-defined rules. Manual modification of the firewall configuration is also supported. However, this method has significant drawbacks: while it can determine if there are anomalies by comparing the firewall's configuration information with the correct rule library and modify the anomaly if found, it doesn't address the root cause of the anomaly. This increases labor and time costs, and the device's sustainable stability in real-world applications is poor.

[0005] There is currently no effective solution to the above problems. Summary of the Invention

[0006] This invention provides a method, apparatus, system, and electronic device for monitoring firewall anomalies, to at least solve the technical problem in related technologies where the anomalies of firewall devices cannot be effectively monitored, resulting in continuous anomalies.

[0007] According to one aspect of the present invention, a method for anomaly monitoring of a firewall is provided, comprising: responding to a monitoring command and running a monitoring script for a firewall device, wherein the monitoring script monitors the operating status of each firewall device to be monitored according to anomaly detection rules to obtain a status monitoring report, wherein the anomaly detection rules are detection rules summarized from historical processes after the firewall device has experienced operational anomalies, and each firewall device corresponds to a different monitoring script; and based on the status monitoring report and the access IP address of the firewall device, classifying and analyzing the monitored operating status to obtain an anomaly analysis report.

[0008] Optionally, before responding to monitoring commands and running monitoring scripts for firewall devices, the method further includes: when detecting operational anomalies in various firewall devices, obtaining detection commands issued within a preset historical time period and the anomaly matching rules used; when detecting operational anomalies in various firewall devices, obtaining anomaly types, anomaly descriptions, and handling suggestions for anomalies within a preset historical time period; when detecting operational anomalies in various firewall devices, obtaining monitoring scripts used when monitoring the firewall devices within a preset historical time period; and constructing a monitoring configuration table based on the detection commands, the anomaly matching rules, the anomaly types, the anomaly descriptions, the handling suggestions for anomalies, and the monitoring scripts.

[0009] Optionally, after constructing the monitoring configuration table, the method further includes: analyzing the detection commands and anomaly matching rules associated with the firewall device in the monitoring configuration table based on the device information of the firewall device, and obtaining a preliminary analysis report; and determining the anomaly detection rules used when monitoring the firewall device based on the preliminary analysis report.

[0010] Optionally, before responding to a monitoring command and running a monitoring script for the firewall device, the method further includes: selecting the monitoring script corresponding to the firewall device from a preset rule database, wherein the preset rule database contains monitoring scripts for all types of firewall devices.

[0011] Optionally, after obtaining the status monitoring report, the method further includes: extracting rule keywords from the status monitoring report using a preset string processing function; summarizing all the rule keywords using a preset rule analysis function to obtain a keyword set; summarizing the information of all the rule keywords in the keyword set, wherein the information of the rule keywords includes at least: the total number of times the keyword appears, the time point of the first appearance of the keyword, and the time point of the last appearance of the keyword; and recording the information of all the rule keywords in the anomaly analysis report according to a first preset report recording format.

[0012] Optionally, after obtaining the status monitoring report, the method further includes: analyzing the cause of the anomaly of the firewall device based on a preset rule database; and recording all the causes of the anomaly into the anomaly analysis report according to a second preset report recording format.

[0013] Optionally, after classifying and analyzing the monitored operating status to obtain an anomaly analysis report, the method further includes: adjusting the monitoring script and anomaly detection rules used when monitoring the firewall device based on the anomaly analysis report.

[0014] According to another aspect of the present invention, an anomaly monitoring device for a firewall is also provided, comprising: a running unit, configured to respond to a monitoring command and run a monitoring script for a firewall device, wherein the monitoring script monitors the operating status of each firewall device to be monitored according to anomaly detection rules to obtain a status monitoring report, the anomaly detection rules being detection rules summarized from historical processes after the firewall device experienced operational anomalies, and a monitoring script corresponding to each firewall device; and an analysis unit, configured to classify and analyze the monitored operating status based on the status monitoring report and the access IP address of the firewall device to obtain an anomaly analysis report.

[0015] Optionally, the firewall anomaly monitoring device further includes: a first acquisition module, configured to acquire detection commands issued within a preset historical time period and anomaly matching rules used in the event of detecting various types of operational anomalies in the firewall devices before responding to monitoring commands and running monitoring scripts for the firewall devices; a second acquisition module, configured to acquire anomaly types, anomaly descriptions, and handling suggestions for the anomalies within a preset historical time period in the event of detecting various types of operational anomalies in the firewall devices; and to acquire monitoring scripts used when monitoring the firewall devices within a preset historical time period in the event of detecting various types of operational anomalies; and a first construction module, configured to construct a monitoring configuration table based on the detection commands, the anomaly matching rules, the anomaly types, the anomaly descriptions, the handling suggestions for the anomalies, and the monitoring scripts.

[0016] Optionally, the firewall anomaly monitoring device further includes: a first analysis module, used to analyze, based on the device information of the firewall device, the detection commands associated with the firewall device in the monitoring configuration table and the anomaly matching rules after the monitoring configuration table is constructed, to obtain a preliminary analysis report; and a first determination module, used to determine, based on the preliminary analysis report, the anomaly detection rules used when monitoring the firewall device.

[0017] Optionally, the firewall anomaly monitoring device further includes: a selection module, used to select the monitoring script corresponding to the firewall device from a preset rule database before running the monitoring script for the firewall device in response to a monitoring command, wherein the preset rule database contains monitoring scripts for all types of firewall devices.

[0018] Optionally, the firewall's anomaly detection device further includes: a first extraction module, used to extract rule keywords from the status monitoring report using a preset string processing function after obtaining the status monitoring report; a first aggregation module, used to aggregate all the rule keywords using a preset rule analysis function to obtain a keyword set; a second aggregation module, used to aggregate the information of all the rule keywords in the keyword set, wherein the information of the rule keywords includes at least: the total number of times the keyword appears, the time point of the first appearance of the keyword, and the time point of the last appearance of the keyword; and a first recording module, used to record the information of all the rule keywords into the anomaly analysis report according to a first preset report recording format.

[0019] Optionally, the firewall anomaly monitoring device further includes: a second analysis module, used to analyze the cause of the anomaly of the firewall device based on a preset rule database after receiving the status monitoring report; and a second recording module, used to record all the causes of the anomaly to the anomaly analysis report according to a second preset report recording format.

[0020] Optionally, the firewall's anomaly monitoring device further includes: an adjustment module, used to adjust the monitoring script and anomaly detection rules used when monitoring the firewall device based on the anomaly analysis report after classifying and analyzing the monitored operating status and obtaining the anomaly analysis report.

[0021] According to another aspect of the present invention, a firewall anomaly monitoring system is also provided, comprising: a configuration device, configured to analyze device information of multiple firewall devices, generate a monitoring script library and an anomaly detection rule library associated with all categories of the firewall devices, wherein the monitoring script library contains multiple monitoring scripts, each monitoring script corresponding to one category of the firewall devices, and the anomaly detection rule library contains multiple anomaly detection rules, each anomaly detection rule corresponding to one category of the firewall devices, the anomaly detection rules being detection rules summarized from historical processes after the firewall devices experienced operational anomalies; a continuous monitoring device, configured to respond to monitoring commands, run monitoring scripts for the firewall devices, and monitor the operational status of each firewall device to be monitored according to the anomaly detection rules, thereby obtaining a status monitoring report; and a dynamic analysis and alarm device, configured to classify and analyze the monitored operational status based on the status monitoring report and the access IP address of the firewall device, obtain an anomaly analysis report, and update the anomaly detection rules and the monitoring scripts using the anomaly analysis report.

[0022] According to another aspect of the present invention, an electronic device is also provided, comprising: a processor; and a memory for storing executable instructions of the processor; wherein the processor is configured to execute the anomaly detection method of the firewall described in any one of the preceding embodiments by executing the executable instructions.

[0023] In this invention, when monitoring the status of firewall devices, a monitoring script for the firewall devices is executed in response to monitoring commands. The monitoring script monitors the operating status of each firewall device according to anomaly detection rules and obtains a status monitoring report. The anomaly detection rules are the detection rules summarized from the historical process after firewall devices have experienced operational anomalies. A monitoring script is set up for each type of firewall device. Based on the status monitoring report and the access IP address of the firewall device, the monitored operating status is classified and analyzed to obtain an anomaly analysis report.

[0024] In this invention, during the operation of firewall devices, monitoring scripts running daily can detect various abnormal problems of firewall devices and automatically analyze the causes of abnormalities, thereby improving the efficiency of abnormal problem analysis and the speed of problem resolution, enhancing the sustainable stability of firewall devices in practical application scenarios, and solving the technical problem in related technologies that cannot effectively monitor abnormal problems of firewall devices, resulting in continuous abnormalities. Attached Figure Description

[0025] The accompanying drawings, which are included to provide a further understanding of the invention and form part of this application, illustrate exemplary embodiments of the invention and, together with their description, serve to explain the invention and do not constitute an undue limitation thereof. In the drawings:

[0026] Figure 1 This is a flowchart of an optional firewall anomaly detection method according to an embodiment of the present invention;

[0027] Figure 2 This is a flowchart illustrating continuous monitoring of a firewall device via a monitoring engine according to an embodiment of the present invention;

[0028] Figure 3 This is a schematic diagram of an optional firewall anomaly detection device according to an embodiment of the present invention;

[0029] Figure 4 This is a schematic diagram of another optional firewall anomaly detection system according to an embodiment of the present invention;

[0030] Figure 5 This is a hardware structure block diagram of an electronic device (or mobile device) according to an embodiment of the present invention. Detailed Implementation

[0031] To enable those skilled in the art to better understand the present invention, the technical solutions of the present invention will be clearly and completely described below with reference to the accompanying drawings of the embodiments of the present invention. Obviously, the described embodiments are only some embodiments of the present invention, and not all embodiments. Based on the embodiments of the present invention, all other embodiments obtained by those skilled in the art without creative effort should fall within the scope of protection of the present invention.

[0032] It should be noted that the terms "first," "second," etc., in the specification, claims, and accompanying drawings of this invention are used to distinguish similar objects and are not necessarily used to describe a specific order or sequence. It should be understood that such data can be interchanged where appropriate so that the embodiments of the invention described herein can be implemented in orders other than those illustrated or described herein. Furthermore, the terms "comprising" and "having," and any variations thereof, are intended to cover a non-exclusive inclusion; for example, a process, method, system, product, or apparatus that comprises a series of steps or units is not necessarily limited to those steps or units explicitly listed, but may include other steps or units not explicitly listed or inherent to such processes, methods, products, or apparatus.

[0033] It should be noted that the firewall anomaly monitoring method and device in this disclosure can be used in the field of information security. When continuously monitoring firewall devices for anomalies, it can also be used in any field other than information security. When continuously monitoring firewall devices for anomalies, the application field of the firewall anomaly monitoring method and device in this disclosure is not limited.

[0034] It should be noted that the user information (including but not limited to user device information, user personal information, etc.) and data (including but not limited to data used for analysis, stored data, displayed data, developer terminal data, etc.) involved in this application are all information and data authorized by the user or fully authorized by all parties. Furthermore, the collection, use and processing of related data must comply with the relevant laws, regulations and standards of the relevant countries and regions, and corresponding operation entry points are provided for users to choose to authorize or refuse.

[0035] This embodiment can be applied to systems / devices / apparatus for anomaly monitoring of firewall devices. By extracting anomaly information and matching rules from firewall monitoring logs, it continuously improves the automated analysis rule base and adapts and adjusts monitoring scripts. This enables continuous monitoring, timely alerting, and dynamic analysis of specified firewall devices on the client's live network. Furthermore, by providing anomaly avoidance measures, maintenance personnel can handle issues promptly, preventing impact on business operations. Simultaneously, through continuous collection and dynamic analysis of anomaly information, it gradually identifies patterns in problem occurrences, providing better anomaly resolution strategies. This allows R&D personnel to resolve such complex issues more quickly, improving product quality.

[0036] This invention is applicable to scenarios involving the continuous tracking, timely detection, and scalable automated analysis of anomalies in firewall devices within actual production environments. It is also suitable for scenarios involving the continuous tracking and localization of certain difficult-to-reproduce anomalies.

[0037] The present invention will now be described in detail with reference to various embodiments.

[0038] Example 1

[0039] According to an embodiment of the present invention, an embodiment of an anomaly detection method for a firewall is provided. It should be noted that the steps shown in the flowchart in the accompanying drawings can be executed in a computer system such as a set of computer-executable instructions. Furthermore, although a logical order is shown in the flowchart, in some cases, the steps shown or described may be executed in a different order than that shown here.

[0040] Figure 1 This is a flowchart of an optional firewall anomaly detection method according to an embodiment of the present invention, such as... Figure 1 As shown, the method includes the following steps:

[0041] Step S102: Respond to the monitoring command and run the monitoring script for the firewall device. The monitoring script monitors the operating status of each firewall device to be monitored according to the anomaly detection rules and obtains a status monitoring report. The anomaly detection rules are the detection rules summarized from the historical process after the firewall device has experienced anomalies. Each type of firewall device has a corresponding monitoring script.

[0042] Step S104: Based on the status monitoring report and the access IP address of the firewall device, the monitored operating status is classified and analyzed to obtain an anomaly analysis report.

[0043] Through the above steps, monitoring commands can be responded to, and monitoring scripts for firewall devices can be run. These scripts monitor the operational status of each firewall device according to anomaly detection rules, generating a status monitoring report. The anomaly detection rules are derived from historical anomalies encountered by firewall devices. A specific monitoring script is configured for each firewall device. Based on the status monitoring report and the firewall device's access IP address, the monitored operational status is categorized and analyzed, resulting in an anomaly analysis report. In this embodiment, during firewall device operation, routinely running monitoring scripts can detect anomalies in various firewall devices and automatically analyze the causes of these anomalies. This improves the efficiency of anomaly analysis and the speed of problem resolution, enhancing the sustainable stability of firewall devices in practical application scenarios. This solves the technical problem in related technologies where effective monitoring of firewall device anomalies is impossible, leading to continuous anomalies.

[0044] This embodiment enables the monitoring of firewall anomalies in actual production environments, preventing frequent anomalies from going undetected and potentially causing major production accidents.

[0045] The present invention will now be described in detail with reference to the above-described implementation steps.

[0046] In this embodiment, before monitoring the operating status of the firewall devices installed on each client, monitoring scripts, automated analysis rule databases, etc. are pre-configured.

[0047] Optionally, before responding to monitoring commands and running monitoring scripts for firewall devices, the process may include: obtaining detection commands issued within a preset historical time period and the anomaly matching rules used when various firewall devices are detected to be malfunctioning; obtaining anomaly types, anomaly descriptions, and handling suggestions for anomalies within a preset historical time period when various firewall devices are detected to be malfunctioning; obtaining monitoring scripts used when monitoring firewall devices within a preset historical time period when various firewall devices are detected to be malfunctioning; and constructing a monitoring configuration table based on the detection commands, anomaly matching rules, anomaly types, anomaly descriptions, handling suggestions, and monitoring scripts.

[0048] In this embodiment, the main configuration contents when constructing the monitoring configuration table include the configuration of anomaly detection rules (detection commands, anomaly matching rules), the configuration of anomaly handling suggestions (anomaly type (e.g., known problem, suspected problem), anomaly description (e.g., *** problem), handling suggestions (e.g., clean up ** files, close ** files, restart ** processes, etc.)), and the configuration of anomaly monitoring scripts (monitoring scripts). By collecting anomalies and initially summarizing keywords when specific anomalies occur in the firewall, anomaly detection rules are proposed (obtaining anomaly detection rules), as well as temporary handling suggestions for suspected or known anomalies, and the corresponding monitoring scripts for executing these rules are configured.

[0049] The headers included in the monitoring configuration table above include, but are not limited to: firewall device name, device model, detection command, anomaly matching rules, anomaly type, anomaly description, handling suggestions, and monitoring script.

[0050] Optionally, after constructing the monitoring configuration table, the following steps are also included: based on the device information of the firewall device, analyzing the detection commands and anomaly matching rules associated with the firewall device in the monitoring configuration table to obtain a preliminary analysis report; based on the preliminary analysis report, determining the anomaly detection rules to be used when monitoring the firewall device.

[0051] Alternatively, before responding to monitoring commands and running the monitoring script for the firewall device, the method may include: selecting a monitoring script corresponding to the firewall device from a preset rule database, wherein the preset rule database contains monitoring scripts for all types of firewall devices.

[0052] In this application, after constructing the monitoring configuration table, the device information of the firewall device to be monitored is determined. Based on the information of all firewall devices in the production environment collected (including but not limited to: device model, access IP, remote login method, and anomaly detection rules that need to be monitored for each model of device), the corresponding monitoring script is selected from the rule database for each firewall device (if there is no monitoring script, the default monitoring script is used to detect it) for configuration.

[0053] Step S102: Respond to the monitoring command and run the monitoring script for the firewall device. The monitoring script monitors the operating status of each firewall device to be monitored according to the anomaly detection rules and obtains a status monitoring report. The anomaly detection rules are the detection rules summarized from the historical process after the firewall device has experienced anomalies. Each type of firewall device has a corresponding monitoring script.

[0054] In this embodiment, when running the monitoring script for firewall devices, the monitoring engine can generate a corresponding monitoring process for each firewall device that needs to be monitored. The monitoring script runs through this monitoring process, and based on anomaly detection rules, the monitoring script periodically monitors, judges, and collects information on anomalies in all firewall devices. Each execution of the monitoring script generates an independent monitoring report.

[0055] Optionally, after obtaining the status monitoring report, the process further includes: extracting rule keywords from the status monitoring report using a preset string processing function; summarizing all rule keywords using a preset rule analysis function to obtain a keyword set; summarizing the information of all rule keywords in the keyword set, wherein the information of all rule keywords includes at least: the total number of times the keyword appears, the time of the first appearance of the keyword, and the time of the last appearance of the keyword; and recording the information of all rule keywords in the anomaly analysis report according to the first preset report recording format.

[0056] Alternatively, after obtaining the status monitoring report, the process may also include: analyzing the causes of the firewall device's anomalies based on a preset rule database; and recording all causes of anomalies in the anomaly analysis report according to a second preset report recording format.

[0057] Figure 2 This is a flowchart illustrating continuous monitoring of a firewall device via a monitoring engine according to an embodiment of the present invention, such as... Figure 2 As shown, the steps are as follows:

[0058] Step 01: After starting the process, load the automated analysis rules belonging to the firewall device. These automated analysis rules can be obtained from an automated analysis rule database, which stores various types of analysis rules. Each analysis rule includes, but is not limited to, a corresponding firewall device, keyword, detection command, cause of anomaly, and solution.

[0059] Step 02: Receive the analysis results;

[0060] Step 03: Match rule keywords from the analysis results; when matching rule keywords, the string processing function in the script execution function library is used.

[0061] Step 04: After all analysis rules have been executed, all keyword hit results are summarized, and the cause of the anomaly is determined through the automated rule library. The cause of the anomaly is determined by the rule analysis function in the script execution function library.

[0062] Step 05: Output an anomaly analysis report. This report may include: the total number of times the keyword appears, the time of the first appearance of the keyword, the time of the last appearance of the keyword, and possible reasons for the anomaly.

[0063] pass Figure 2 The implementation shown can monitor the operating status of firewall devices by combining various functions in the script execution function library and various analysis rules, regularly identify and collect information on network anomalies of all firewall devices, and generate anomaly analysis reports.

[0064] Step S104: Based on the status monitoring report and the access IP address of the firewall device, the monitored operating status is classified and analyzed to obtain an anomaly analysis report.

[0065] Optionally, after classifying and analyzing the monitored operating status to obtain an anomaly analysis report, the method also includes: adjusting the monitoring scripts and anomaly detection rules used when monitoring firewall devices based on the anomaly analysis report.

[0066] In this embodiment, the automated analysis rule database can be continuously adjusted to improve the monitoring scripts and anomaly detection rules used when monitoring firewall devices, thereby continuously improving the accuracy of automated analysis and ensuring the sustainability of the solution.

[0067] In this embodiment, the monitoring reports generated each time the monitoring script is executed can be continuously integrated and analyzed. After each monitoring execution is completed, an independent monitoring report is generated for each monitored firewall device. The reports are categorized and analyzed according to the firewall access IP address, and the abnormal rules are matched and counted to analyze the first hit time and the last hit time of the hit rules.

[0068] The optional anomaly analysis report includes the firewall device's access IP address, device model, detection command, anomaly detection rules, anomaly type, anomaly description, handling suggestions, number of hits, first keyword hit time, and last keyword hit time.

[0069] This embodiment enables automated analysis of firewall anomalies in a real production environment, avoiding the difficulties in error localization and the excessive costs of manpower and equipment after anomalies are discovered.

[0070] Through this embodiment, customized detection scripts for different firewalls can be written for different firewall product types, resulting in high maintainability, reusability, and scalability.

[0071] The invention will now be described in conjunction with another alternative embodiment.

[0072] Example 2

[0073] This embodiment provides an anomaly monitoring device for a firewall. The anomaly monitoring device includes multiple implementation units, each of which corresponds to a specific implementation step in Embodiment 1 above.

[0074] Figure 3 This is a schematic diagram of an optional firewall anomaly detection device according to an embodiment of the present invention, such as... Figure 3 As shown, the anomaly monitoring device may include: an operation unit 31 and an analysis unit 33, wherein,

[0075] The running unit 31 is used to respond to monitoring commands and run monitoring scripts for firewall devices. The monitoring scripts monitor the operating status of each firewall device to be monitored according to anomaly detection rules and obtain a status monitoring report. The anomaly detection rules are the detection rules summarized from the historical process after the firewall devices experienced operational anomalies. Each type of firewall device has a corresponding monitoring script.

[0076] Analysis unit 33 is used to classify and analyze the monitored operating status based on the status monitoring report and the access IP address of the firewall device, and obtain an anomaly analysis report.

[0077] The aforementioned firewall anomaly monitoring device can respond to monitoring commands through the operation unit 31 and run monitoring scripts for the firewall devices. These scripts monitor the operational status of each firewall device according to anomaly detection rules, generating a status monitoring report. The anomaly detection rules are derived from historical anomalies experienced by firewall devices. Each firewall device has a corresponding monitoring script. The analysis unit 33, based on the status monitoring report and the firewall device's access IP address, categorizes and analyzes the monitored operational status, generating an anomaly analysis report. In this embodiment, during firewall device operation, the routinely running monitoring scripts can detect anomalies in various firewall devices and automatically analyze the causes of these anomalies. This improves the efficiency of anomaly analysis and the speed of problem resolution, enhancing the sustainable stability of the firewall device in practical application scenarios. This solves the technical problem in related technologies where effective monitoring of firewall device anomalies is impossible, leading to continuous anomalies.

[0078] Optionally, the firewall anomaly monitoring device further includes: a first acquisition module, used to acquire detection commands issued in a preset historical time period and anomaly matching rules used in the event of anomalies detected in various firewall devices before responding to monitoring commands and running monitoring scripts for the firewall devices; a second acquisition module, used to acquire anomaly types, anomaly descriptions, and handling suggestions for anomalies in the preset historical time period when anomalies are detected in various firewall devices; and to acquire monitoring scripts used when monitoring firewall devices in the preset historical time period when anomalies are detected in various firewall devices; and a first construction module, used to construct a monitoring configuration table based on detection commands, anomaly matching rules, anomaly types, anomaly descriptions, handling suggestions for anomalies, and monitoring scripts.

[0079] Optionally, the firewall anomaly monitoring device further includes: a first analysis module, used to analyze the detection commands and anomaly matching rules associated with the firewall device in the monitoring configuration table based on the device information of the firewall device after the monitoring configuration table is constructed, and obtain a preliminary analysis report; and a first determination module, used to determine the anomaly detection rules to be used when monitoring the firewall device based on the preliminary analysis report.

[0080] In this embodiment, the main configuration contents when constructing the monitoring configuration table include the configuration of anomaly detection rules (detection commands, anomaly matching rules), the configuration of anomaly handling suggestions (anomaly type (e.g., known problem, suspected problem), anomaly description (e.g., *** problem), handling suggestions (e.g., clean up ** files, close ** files, restart ** processes, etc.)), and the configuration of anomaly monitoring scripts (monitoring scripts). By collecting anomalies and initially summarizing keywords when specific anomalies occur in the firewall, anomaly detection rules are proposed (obtaining anomaly detection rules), as well as temporary handling suggestions for suspected or known anomalies, and the corresponding monitoring scripts for executing these rules are configured.

[0081] The headers included in the monitoring configuration table above include, but are not limited to: firewall device name, device model, detection command, anomaly matching rules, anomaly type, anomaly description, handling suggestions, and monitoring script.

[0082] Optionally, the firewall anomaly detection device further includes a selection module, used to select a monitoring script corresponding to the firewall device from a preset rule database before running the monitoring script for the firewall device in response to a monitoring command, wherein the preset rule database contains monitoring scripts for all types of firewall devices.

[0083] In this application, after constructing the monitoring configuration table, the device information of the firewall device to be monitored is determined. Based on the information of all firewall devices in the production environment collected (including but not limited to: device model, access IP, remote login method, and anomaly detection rules that need to be monitored for each model of device), the corresponding monitoring script is selected from the rule database for each firewall device (if there is no monitoring script, the default monitoring script is used to detect it) for configuration.

[0084] Optionally, the firewall's anomaly detection device further includes: a first extraction module, used to extract rule keywords from the status monitoring report using a preset string processing function after receiving the status monitoring report; a first aggregation module, used to aggregate all rule keywords using a preset rule analysis function to obtain a keyword set; a second aggregation module, used to aggregate the information of all rule keywords in the keyword set, wherein the information of all rule keywords includes at least: the total number of times the keyword appears, the time point of the first appearance of the keyword, and the time point of the last appearance of the keyword; and a first recording module, used to record the information of all rule keywords to the anomaly analysis report according to a first preset report recording format.

[0085] Optionally, the firewall anomaly monitoring device further includes: a second analysis module, used to analyze the cause of the firewall device anomaly based on a preset rule database after receiving the status monitoring report; and a second recording module, used to record all anomaly causes to the anomaly analysis report according to a second preset report recording format.

[0086] Optionally, the firewall's anomaly monitoring device also includes an adjustment module, which, after classifying and analyzing the monitored operating status and obtaining an anomaly analysis report, adjusts the monitoring scripts and anomaly detection rules used when monitoring the firewall device based on the anomaly analysis report.

[0087] The invention will now be described in detail with reference to another alternative embodiment.

[0088] Figure 4 This is a schematic diagram of another optional firewall anomaly detection system according to an embodiment of the present invention, such as... Figure 4 As shown, the anomaly monitoring device may include:

[0089] The configuration device is used to analyze the device information of multiple firewall devices and generate a monitoring script library and an anomaly detection rule library that are associated with all types of firewall devices. The monitoring script library contains multiple monitoring scripts, each corresponding to a type of firewall device. The anomaly detection rule library contains multiple anomaly detection rules, each corresponding to a type of firewall device. The anomaly detection rules are the detection rules summarized from the historical process after firewall devices experienced operational anomalies.

[0090] like Figure 4 As shown, the configuration device can collect information from the firewall (FW), which collects information from the firewall device monitoring script library, and can also obtain an automated analysis rule database (corresponding to the anomaly detection rule library mentioned above).

[0091] The configuration information for the device mainly includes anomaly detection rules (detection commands, anomaly matching rules), anomaly handling suggestions (anomaly type, anomaly description, handling suggestions), and anomaly monitoring script configuration (monitoring scripts). By collecting anomalies and initially summarizing keywords when specific anomalies occur in the firewall, rules for determining anomalies are proposed, along with temporary handling suggestions for suspected or known anomalies. The corresponding monitoring scripts for executing these rules are also configured.

[0092] During the configuration device collection phase, information on all firewall devices in the production environment (including device model, access IP, remote login method, and abnormal rules that need to be monitored for each device model) is collected. The system then selects the corresponding monitoring script for each firewall from the rule database (if no monitoring script is available, the system will use the default monitoring script to perform the detection) and configures it.

[0093] The continuous monitoring device is used to respond to monitoring commands and run monitoring scripts for firewall devices. The monitoring scripts monitor the operating status of each firewall device to be monitored according to anomaly detection rules and obtain a status monitoring report.

[0094] In this embodiment, the monitoring device uses a monitoring engine to generate corresponding monitoring script processes for each firewall device that needs to be monitored. Based on anomaly detection rules, it periodically judges and collects information on anomalies in the current network for all devices. Each execution of the monitoring script generates an independent analysis report.

[0095] like Figure 4 As shown, the continuous monitoring device deploys monitoring servers, each running multiple monitoring script processes. Each monitoring script process monitors each firewall device. Figure 4 The states are illustrated using FW1, FW2...FWn.

[0096] The dynamic analysis and alarm device is used to classify and analyze the monitored operating status based on the status monitoring report and the access IP address of the firewall device, obtain an anomaly analysis report, and update the anomaly detection rules and monitoring scripts based on the anomaly analysis report.

[0097] The dynamic analysis and alarm device includes a dynamic analysis module and an alarm module. The dynamic analysis module mainly performs continuous integrated analysis of the results generated by each monitoring execution. After each monitoring execution is completed, each monitored firewall device generates independent detection results. At this time, the dynamic analysis module will classify and analyze the results based on the firewall's access IP address, match and count abnormal rules, and analyze the first hit time and the last hit time of the hit rules.

[0098] like Figure 4 As shown, dynamic analysis and advanced devices can summarize various automated analysis reports, and then send the identified problems to developers and the known problems to operations and maintenance personnel. Developers can then synthesize unknown anomalies, output anomaly detection rules, generate new automated analysis rules, and update the automated analysis rule database.

[0099] Each completed dynamic analysis generates an anomaly analysis report. Based on the number of times monitored devices are detected, the report summarizes all accumulated increases in the number of detections for each device. The analysis results and handling suggestions are then sent to the client via the alarm module (supporting email, SMS, enterprise chat software, syslog, and the customer's private operation and maintenance alarm system) for processing. Additionally, at the end of each day, the overall analysis results are sent to the development terminal via the alarm module. This allows the development terminal to accelerate the reproduction, analysis, and resolution of anomalies by analyzing the time periods of detections, the frequency of problem occurrence, and collecting anomaly log information from devices during those periods.

[0100] The various components of the anomaly detection system work together and complement each other to form a continuously optimized and improved solution and system. When analysts find that the anomaly analysis report results are inaccurate or contain errors, they can flexibly adjust the configuration of the devices and the automated rule database, and optimize the automated analysis process. For anomalies that are difficult to reproduce, the automated rule database can be optimized, the corresponding monitoring scripts adjusted, and continuous monitoring devices used to obtain the characteristics and conditions under which these anomalies occur. This provides data support for resolving such anomalies, allowing developers to address these issues more quickly.

[0101] The above embodiments automate the analysis of firewall anomalies in actual production environments, avoiding difficulties in error localization and excessive labor and equipment costs after anomaly detection. Furthermore, it allows for customized monitoring scripts for different firewall devices, enabling the creation of different monitoring scripts for different firewall product types. This results in high maintainability, reusability, and scalability, and utilizes a technology for continuous monitoring and detection based on keywords, detection rules, and detection processes.

[0102] According to another aspect of the present invention, an electronic device is also provided, including: a processor; and a memory for storing executable instructions of the processor; wherein the processor is configured to execute the firewall anomaly detection method of any of the above-described embodiments by executing the executable instructions.

[0103] Figure 5 This is a hardware structure block diagram of an electronic device (or mobile device) according to an embodiment of the present invention. Figure 5As shown, the electronic device may include one or more processors 502 (shown as 502a, 502b, ..., 502n in the figure) 502 (processor 502 may include, but is not limited to, a microprocessor MCU or a programmable logic device FPGA, etc.) and a memory 504 for storing data. In addition, it may include: a display, an input / output interface (I / O interface), a universal serial bus (USB) port (which may be included as one of the ports of the I / O interface), a network interface, a keyboard, a power supply, and / or a camera. Those skilled in the art will understand that... Figure 5 The structure shown is for illustrative purposes only and does not limit the structure of the electronic device described above. For example, the electronic device may also include components that are more... Figure 5 The more or fewer components shown, or having the same Figure 5 The different configurations shown.

[0104] The sequence numbers of the above embodiments of the present invention are for descriptive purposes only and do not represent the superiority or inferiority of the embodiments.

[0105] In the above embodiments of the present invention, the descriptions of each embodiment have different focuses. For parts not described in detail in a certain embodiment, please refer to the relevant descriptions of other embodiments.

[0106] In the several embodiments provided in this application, it should be understood that the disclosed technical content can be implemented in other ways. The device embodiments described above are merely illustrative; for example, the division of units can be a logical functional division, and in actual implementation, there may be other division methods. For instance, multiple units or components may be combined or integrated into another system, or some features may be ignored or not executed. Furthermore, the displayed or discussed mutual coupling, direct coupling, or communication connection may be through some interfaces; the indirect coupling or communication connection between units or modules may be electrical or other forms.

[0107] The units described as separate components may or may not be physically separate. The components shown as units may or may not be physical units; that is, they may be located in one place or distributed across multiple units. Some or all of the units can be selected to achieve the purpose of this embodiment according to actual needs.

[0108] Furthermore, the functional units in the various embodiments of the present invention can be integrated into one processing unit, or each unit can exist physically separately, or two or more units can be integrated into one unit. The integrated unit can be implemented in hardware or as a software functional unit.

[0109] If the integrated unit is implemented as a software functional unit and sold or used as an independent product, it can be stored in a computer-readable storage medium. Based on this understanding, the technical solution of the present invention, in essence, or the part that contributes to the prior art, or all or part of the technical solution, can be embodied in the form of a software product. This computer software product is stored in a storage medium and includes several instructions to cause a computer device (which may be a personal computer, server, or network device, etc.) to execute all or part of the steps of the methods described in the various embodiments of the present invention. The aforementioned storage medium includes various media capable of storing program code, such as USB flash drives, read-only memory (ROM), random access memory (RAM), portable hard drives, magnetic disks, or optical disks.

[0110] The above description is only a preferred embodiment of the present invention. It should be noted that for those skilled in the art, several improvements and modifications can be made without departing from the principle of the present invention, and these improvements and modifications should also be considered within the scope of protection of the present invention.

Claims

1. A method for anomaly detection in a firewall, characterized in that, include: In response to monitoring commands, a monitoring script for the firewall device is run. The monitoring script monitors the operating status of each firewall device to be monitored according to anomaly detection rules and obtains a status monitoring report. The anomaly detection rules are the detection rules summarized from the historical process after the firewall device has experienced anomalies. Each monitoring script corresponds to a type of firewall device. Based on the status monitoring report and the access IP address of the firewall device, the monitored operating status is categorized and analyzed to obtain an anomaly analysis report; Before responding to monitoring commands and running monitoring scripts for the firewall device, the following steps are also included: When an operational anomaly is detected in any of the aforementioned firewall devices, the monitoring scripts used to monitor the firewall devices during a preset historical time period are retrieved. These monitoring scripts are used to determine the anomaly detection rules. Before responding to monitoring commands and running monitoring scripts for the firewall device, the following steps are also included: When an abnormal operation is detected in any of the aforementioned firewall devices, the detection commands issued within a preset historical time period and the abnormal problem matching rules used are obtained. When an abnormal operation of any of the aforementioned firewall devices is detected, the abnormal problem type, abnormal problem description information, and handling suggestions for the abnormal problem are obtained from a preset historical time period. Based on the detection command, the anomaly matching rules, the anomaly type, the anomaly description information, the handling suggestions for the anomaly, and the monitoring script, a monitoring configuration table is constructed; After receiving the status monitoring report, the following is also included: The rule keywords in the status monitoring report are extracted using a preset string processing function; All the rule keywords are summarized using a preset rule analysis function to obtain a keyword set; Summarize the information of all the rule keywords in the keyword set, wherein the information of the rule keywords includes at least: the total number of times the keyword appears, the time of the first appearance of the keyword, and the time of the last appearance of the keyword; According to the first preset report recording format, the information of all the rule keywords is recorded in the anomaly analysis report.

2. The anomaly monitoring method according to claim 1, characterized in that, After building the monitoring configuration table, the following is also included: Based on the device information of the firewall device, the detection commands and anomaly matching rules associated with the firewall device in the monitoring configuration table are analyzed to obtain a preliminary analysis report; Based on the preliminary analysis report, the anomaly detection rules used when monitoring the firewall device are determined.

3. The anomaly monitoring method according to claim 1, characterized in that, Before responding to monitoring commands and running monitoring scripts for the firewall device, the following steps are also included: The monitoring script corresponding to the firewall device is selected from the preset rule database, wherein the preset rule database contains monitoring scripts for all types of firewall devices.

4. The anomaly monitoring method according to claim 1, characterized in that, After receiving the status monitoring report, the following is also included: The causes of the firewall device's anomalies are analyzed based on a preset rule database. Record all the causes of the anomalies in the anomaly analysis report according to the second preset report recording format.

5. The anomaly monitoring method according to claim 1, characterized in that, After classifying and analyzing the monitored operational statuses to obtain an anomaly analysis report, the report also includes: Based on the anomaly analysis report, adjust the monitoring script and anomaly detection rules used when monitoring the firewall device.

6. An anomaly detection device for a firewall, characterized in that, include: The running unit is used to respond to monitoring commands and run monitoring scripts for firewall devices. The monitoring scripts monitor the operating status of each firewall device to be monitored according to anomaly detection rules and obtain a status monitoring report. The anomaly detection rules are the detection rules summarized from the historical process after the firewall devices have experienced operational anomalies. Each type of firewall device is configured with a corresponding monitoring script. The analysis unit is used to classify and analyze the monitored operating status based on the status monitoring report and the access IP address of the firewall device, and obtain an anomaly analysis report. The device is also used to obtain monitoring scripts used when monitoring the firewall devices during a preset historical time period when an operational anomaly is detected in various firewall devices, wherein the monitoring scripts used when monitoring the firewall devices during the preset historical time period are used to determine the anomaly detection rules. The device further includes: a first acquisition module, configured to acquire detection commands issued within a preset historical time period and anomaly matching rules used, before running a monitoring script for the firewall device in response to a monitoring command, and upon detecting operational anomalies in various firewall devices; a second acquisition module, configured to acquire anomaly types, anomaly descriptions, and handling suggestions for anomalies within a preset historical time period, and to acquire monitoring scripts used when monitoring the firewall devices within a preset historical time period, upon detecting operational anomalies in various firewall devices; and a first construction module, configured to construct a monitoring configuration table based on the detection commands, anomaly matching rules, anomaly types, anomaly descriptions, handling suggestions, and monitoring scripts. The device further includes: a first extraction module, used to extract rule keywords from the status monitoring report using a preset string processing function after obtaining the status monitoring report; a first summarization module, used to summarize all rule keywords using a preset rule analysis function to obtain a keyword set; a second summarization module, used to summarize the information of all rule keywords in the keyword set, wherein the information of all rule keywords includes at least: the total number of times the keyword appears, the time point of the first appearance of the keyword, and the time point of the last appearance of the keyword; and a first recording module, used to record the information of all rule keywords to the anomaly analysis report according to a first preset report recording format.

7. An anomaly detection system for a firewall, characterized in that, include: A configuration device is used to analyze the device information of multiple firewall devices and generate a monitoring script library and an anomaly detection rule library that are associated with all categories of the firewall devices. The monitoring script library contains multiple monitoring scripts, each of which corresponds to one category of the firewall devices. The anomaly detection rule library contains multiple anomaly detection rules, each of which corresponds to one category of the firewall devices. The anomaly detection rules are detection rules summarized from historical processes after the firewall devices experienced operational anomalies. A continuous monitoring device is used to respond to monitoring commands and run monitoring scripts for firewall devices. The monitoring scripts monitor the operating status of each firewall device to be monitored according to anomaly detection rules and obtain a status monitoring report. The dynamic analysis and alarm device is used to classify and analyze the monitored operating status based on the status monitoring report and the access IP address of the firewall device, obtain an anomaly analysis report, and update the anomaly detection rules and the monitoring script by the anomaly analysis report. The system is also used to obtain monitoring scripts used when monitoring the firewall devices during a preset historical time period when an operational anomaly is detected in various firewall devices, wherein the monitoring scripts used when monitoring the firewall devices during the preset historical time period are used to determine the anomaly detection rules. The system is further configured to, before responding to monitoring commands and running monitoring scripts for firewall devices, acquire detection commands and anomaly matching rules issued within a preset historical time period when various types of firewall devices are detected to be malfunctioning; acquire anomaly types, anomaly descriptions, and handling suggestions for anomalies within the preset historical time period when various types of firewall devices are detected to be malfunctioning; and construct a monitoring configuration table based on the detection commands, anomaly matching rules, anomaly types, anomaly descriptions, handling suggestions, and monitoring scripts. The system is further configured to, after obtaining the status monitoring report, extract rule keywords from the status monitoring report using a preset string processing function; summarize all the rule keywords using a preset rule analysis function to obtain a keyword set; summarize the information of all the rule keywords in the keyword set, wherein the information of the rule keywords includes at least: the total number of times the keyword appears, the time point of the first appearance of the keyword, and the time point of the last appearance of the keyword; and record the information of all the rule keywords in the anomaly analysis report according to a first preset report recording format.

8. An electronic device, characterized in that, include: processor; as well as Memory for storing the executable instructions of the processor; The processor is configured to execute the anomaly detection method of the firewall according to any one of claims 1 to 5 by executing the executable instructions.

Images