A method and apparatus for detecting safety rule effectiveness
By configuring and parsing simulated attack data, the validity of security rules can be determined, which solves the problems of low detection coverage and high cost in existing technologies and achieves efficient and accurate security rule detection.
Patent Information
- Authority / Receiving Office
- CN · China
- Patent Type
- Patents(China)
- Current Assignee / Owner
- QI-ANXIN LEGENDSEC INFORMATION TECH (BEIJING) INC
- Filing Date
- 2023-03-01
- Publication Date
- 2026-07-21
AI Technical Summary
In existing technologies, methods for detecting the effectiveness of security rules rely on a large number of network logs, resulting in limited coverage, long detection time and high cost, and a high risk of missed detections and false detections.
By configuring simulated attack data, the data is parsed into simulated attack data using a preset parsing tool. The system then determines whether the target security rule is triggered. If not, the security rule is deemed invalid.
It improves the coverage and efficiency of safety rule detection, reduces detection time and cost, and avoids missed detections and false detections.
Smart Images
Figure CN116389066B_ABST
Abstract
Description
Technical Field
[0001] This invention relates to the field of network security technology, and in particular to a method and apparatus for detecting the validity of security rules. Background Technology
[0002] With the popularization of the Internet, the Internet has become an indispensable part of people's daily lives, and people's lives are filled with a large amount of online data. As data breaches occur frequently, data security is receiving more and more attention.
[0003] The core of data security is the detection of network data, and the core of data detection is the setting of security rules or policies. Security rules or policies need to be updated and phased out according to the actual network conditions. In other words, some rules and policies that become invalid due to changes need to be cleaned up in a timely manner to avoid these security rules or policies consuming too many storage resources.
[0004] Currently, the primary method for detecting the effectiveness of existing security rules or policies is to collect large amounts of network data, including both normal and attack data, and then use security rules or policies to analyze this data. The effectiveness of the security rules or policies is identified by the frequency or number of times they are triggered. However, the main drawback of this approach is that the collected network data cannot comprehensively cover all security rules or policies. Therefore, to achieve comprehensive detection, an even larger volume of network data needs to be collected, leading to greater time consumption and increased costs. Summary of the Invention
[0005] In view of the above problems, the present invention proposes a method and apparatus for detecting the validity of safety rules, the main purpose of which is to improve the accuracy and coverage of the detection of the validity of safety rules.
[0006] To achieve the above objectives, the present invention mainly provides the following technical solutions:
[0007] In a first aspect, the present invention provides a method for detecting the validity of security rules, the method comprising:
[0008] Acquire pending data with an attack identifier, the attack identifier corresponding to a target security rule, the pending data being generated based on simulated attack data, and the simulated attack data being used to verify the effectiveness of the target security rule;
[0009] The data to be processed is parsed into simulated attack data using a preset parsing tool;
[0010] Determine whether the simulated attack data triggers the target security rule corresponding to the attack identifier;
[0011] If not triggered, the target security rule is deemed invalid.
[0012] Secondly, the present invention provides an apparatus for detecting the validity of security rules, the apparatus comprising:
[0013] An acquisition unit is used to acquire data to be processed that has an attack identifier, the attack identifier corresponding to a target security rule, the data to be processed being generated based on simulated attack data, and the simulated attack data being used to verify the validity of the target security rule;
[0014] The parsing unit is used to parse the data to be processed obtained by the acquisition unit into simulated attack data using a preset parsing tool;
[0015] The detection unit is used to determine whether the simulated attack data obtained by the parsing unit triggers the target security rule corresponding to the attack identifier;
[0016] The determining unit is used to determine that the target security rule is invalid when the detection unit determines that the target security rule has not been triggered.
[0017] On the other hand, the present invention also provides a processor for running a program, wherein the program executes the above-described method for detecting the validity of security rules during runtime.
[0018] On the other hand, the present invention also provides a storage medium for storing a computer program, wherein the computer program, when running, controls the device where the storage medium is located to execute the above-mentioned method for detecting the validity of security rules.
[0019] By employing the above technical solution, this invention provides a method and apparatus for detecting the validity of security rules. By adding pending data marked with attack identifiers during the data detection process, the target security rule is triggered to detect whether it is invalid. The pending data is pre-edited simulated attack data, enabling the tracking and identification of the target security rule's validity when pending data with attack identifiers is detected during data detection. Therefore, this invention can achieve targeted detection of target security rules based on the configured pending data, eliminating the need for extensive network logs, improving the efficiency and coverage of security rule detection, and avoiding missed or false detections of security rules.
[0020] The above description is merely an overview of the technical solution of the present invention. In order to better understand the technical means of the present invention and to implement it in accordance with the contents of the specification, and to make the above and other objects, features and advantages of the present invention more apparent and understandable, specific embodiments of the present invention are described below. Attached Figure Description
[0021] Various other advantages and benefits will become apparent to those skilled in the art upon reading the following detailed description of preferred embodiments. The accompanying drawings are for illustrative purposes only and are not intended to limit the invention. Furthermore, the same reference numerals denote the same parts throughout the drawings. In the drawings:
[0022] Figure 1 A flowchart of a method for detecting the validity of security rules according to an embodiment of the present invention is shown;
[0023] Figure 2 This invention presents a flowchart of another method for detecting the validity of security rules according to an embodiment of the present invention;
[0024] Figure 3 A schematic diagram of a device for detecting the validity of security rules according to an embodiment of the present invention is shown;
[0025] Figure 4 A schematic diagram of another device structure for detecting the validity of security rules, as proposed in an embodiment of the present invention, is shown. Detailed Implementation
[0026] Exemplary embodiments of the invention will now be described in more detail with reference to the accompanying drawings. While exemplary embodiments of the invention are shown in the drawings, it should be understood that the invention may be implemented in various forms and should not be limited to the embodiments set forth herein. Rather, these embodiments are provided so that this invention will be thorough and complete, and will fully convey the scope of the invention to those skilled in the art.
[0027] The current general process for network attack detection involves first collecting logs, typically generated from user network operations. These logs are then sent to a parser via a data bus. The parser parses the log data according to a specified method, allowing it to be analyzed using configured security rules. If a security rule is triggered, the corresponding operation is considered a network attack; otherwise, it's considered a legitimate operation. A common method for verifying the validity of security rules is to trigger them using a large volume of network logs. Rules that are not triggered are considered invalid. However, this method has a limited rule coverage, making it difficult to achieve comprehensive coverage. Consequently, some valid security rules are deemed invalid due to the lack of corresponding attack log data. Therefore, current methods for detecting the validity of security rules are inaccurate, and analyzing large amounts of log data increases detection time and may even consume normal system computing resources.
[0028] To address this issue, the inventors of this case propose a method for detecting the effectiveness of security rules. This method simulates network attacks by artificially configuring attack data and then uses the simulated network attack data to perform targeted rule detection, thereby improving the detection efficiency and coverage of security rules. The specific steps of the method for detecting the effectiveness of security rules in this invention are as follows: Figure 1 As shown, it includes:
[0029] 101. Obtain data to be processed that has an attack flag.
[0030] In this embodiment of the invention, during the detection of network data, targeted detection of security rules can be performed simultaneously by adding pending data carrying attack identifiers to the network data. The pending data with attack identifiers is generated by executing simulated attacks, which are simulated attack data edited for specific target security rules. This simulated attack data can be used to verify the effectiveness of the target security rule.
[0031] In addition to using this solution in applications that detect network data, it can also be used in scenarios where all security rules are detected independently. In this case, the data to be processed is generated based on simulated attack data that can comprehensively cover all security rules.
[0032] 102. Use a preset parsing tool to parse the data to be processed into simulated attack data.
[0033] In this embodiment, the format of the data to be processed is set according to the data collection requirements. The most common format is log data, which is obtained by executing simulated attack data, such as attack operations or attack scripts, in log format. However, simple log data is not conducive to subsequent data analysis. Therefore, it is necessary to parse the log content into simulated attack data using a corresponding parsing tool. It should be noted that the parsed simulated attack data can be different from the simulated attack data that generated the log. For example, the parsed simulated attack data may only contain attack-related parameters, not the attack script to be executed. In this step, the purpose of parsing the data to be processed using a preset parsing tool is to associate the parsed simulated attack data with an attack identifier. Therefore, the parsed simulated attack data is also marked with a corresponding attack identifier.
[0034] The preset parsing tool used in this step depends on the format of the data to be processed. Based on the format, the corresponding parsing tool is used to parse the data and restore it to simulated attack data.
[0035] 103. Determine whether the simulated attack data triggers the target security rule corresponding to the attack identifier.
[0036] This step involves processing the simulated attack data with an attack identifier by using the corresponding target security rule based on the attack identifier. If the target security rule is triggered, it means that the target security rule can detect the attack data and is a valid security rule. Otherwise, if the target security rule is not triggered, step 104 is executed.
[0037] 104. The target security rules have been determined to be invalid.
[0038] If a target security rule is not triggered, it means that the target security rule can no longer effectively identify attack data, and at this point, the target security rule can be determined to be invalid. Once a security rule is determined to be invalid, a corresponding alarm message needs to be generated to prompt administrators to handle the invalid security rule in a timely manner.
[0039] Based on the above Figure 1 As can be seen from the implementation method, the embodiments of the present invention detect the effectiveness of the target security rule by processing simulated attack data that corresponds to the target security rule. In this way, it is possible to release data to be processed for different security rules in a periodic or quantitative manner according to the detection needs, so as to detect the effectiveness of different security rules. This method not only improves the coverage of security rule detection, but also improves the detection efficiency. Since the data to be processed in this embodiment is manually edited, it does not require the acquisition of a large amount of network data, which also makes the detection of the effectiveness of security rules more convenient and faster, and makes it easier for managers to effectively maintain security rules.
[0040] Furthermore, based on the above Figure 1 As can be seen from the embodiments of the present invention, the execution of the embodiments of the present invention requires pre-configuration of the data to be processed. Furthermore, after determining that a security rule has failed, since the simulated attack data is obtained by parsing the data to be processed, the reason for the failure of the security rule needs to be further determined. Therefore, the embodiments of the present invention will specifically describe the configuration process of the data to be processed and the process for determining the reason for failure, the specific steps of which are as follows: Figure 2 As shown, it includes:
[0041] 201. Generate pending data with attack identifiers.
[0042] In this embodiment, in order to detect security rules in a targeted manner, it is necessary to have data to be processed that carries attack identifiers corresponding to the security rules. This data to be processed needs to be configured and generated according to the target security rule to be detected.
[0043] Specifically, in this embodiment, a verification platform is configured with multiple agent terminals.
[0044] The verification platform is used to edit and store simulated attack data, and manage the method, frequency, and quantity of commands to be sent to different agents to execute the simulated attack data. In other words, users can use this verification platform to edit attack methods targeting specific security rules, such as attack operations or executable attack scripts, and store these attack methods as simulated attack data in label form. Simultaneously, users can also use the verification platform to manage how the simulated attack data is triggered on different agents, including periodically or manually sending execution commands to execute the corresponding simulated attack data on a specific agent, the frequency of sending execution commands, and the number of execution commands sent to different agents. Since there are multiple simulated attack data sets in this embodiment, the simulated attack data can be triggered by one agent or by different agents. Thus, users can use the verification platform to manage the specific methods by which different agents generate data to be processed.
[0045] The proxy client is used to generate pending data with corresponding attack identifiers by executing simulated attack data. Therefore, the proxy client also stores corresponding simulated attack data. Upon receiving an execution instruction from the verification platform, it can execute the corresponding simulated attack data according to the instruction to generate pending data with attack identifiers. This embodiment configures multiple proxy clients to prevent the inability to generate pending data due to a single proxy client going offline; it also provides users with more configuration options.
[0046] Furthermore, for the configured proxy end, it is also possible to periodically or in real-time detect whether the simulated attack data in the verification platform has changed. If it has changed, the modified simulated attack data is sent to the corresponding proxy end, that is, the proxy end storing the corresponding simulated attack data is updated in real time. In other words, this embodiment can also monitor the operations of the testing personnel in the verification platform, especially the adjustment of simulated attack data. Once it is found that the simulated attack data in the verification platform has been modified, it indicates that the method of detecting the validity of security rules has changed. At this time, it will no longer be triggered according to the previously set sending cycle, but will be updated in real time on the corresponding proxy end after the testing personnel modify the simulated attack data. After receiving the update, the corresponding proxy end can also initiate an execution operation in real time to generate data to be processed to verify the validity of the target security rule, thereby improving the real-time performance of security rule validity detection.
[0047] In this embodiment, the configured verification platform needs to be able to periodically send execution commands to the corresponding agents to generate data to be processed, even when unattended. To this end, the verification platform also needs to confirm the online status of each agent in real time. Therefore, the verification platform needs to periodically send heartbeats to each agent, checking their online status based on the feedback heartbeat information. If an agent is found to be offline, a notification message needs to be issued to inform the testing or management personnel that the agent cannot properly complete the verification of the validity of the security rules.
[0048] Furthermore, since the data to be processed in this embodiment is generated and sent by the proxy, and the testing or management personnel manage it through the verification platform, it is also necessary to monitor whether the proxy is sending the data to be processed normally during the generation of the data to be processed. Specifically, the proxy can be configured to send the status information of the data to be processed back to the verification platform after sending the data to be processed. In this way, after the verification platform issues the instruction to execute the simulated attack data, it can determine whether the data to be processed has been generated and sent by detecting whether the feedback information of the corresponding proxy has been received. If it is not received, or if the feedback information received indicates that the data to be processed was not sent successfully, an alarm message of proxy failure needs to be issued to notify the testing or management personnel that the proxy is abnormal.
[0049] 202. Obtain the data to be processed that has an attack flag.
[0050] After the client is configured, it will periodically or irregularly send out pending data with attack indicators. This step begins the process of detecting the effectiveness of the target security rules by receiving and identifying this pending data with attack indicators.
[0051] 203. Use a preset parsing tool to parse the data to be processed into simulated attack data.
[0052] 204. Determine whether the simulated attack data triggers the target security rule corresponding to the attack identifier.
[0053] 205. The target security rule has been determined to be invalid.
[0054] The content of steps 202-205 above is the same as above. Figure 1 The steps 101-104 shown are the same, and their specific details will not be repeated here.
[0055] 206. Analyze and label the reasons for the failure of the target safety rules.
[0056] In this embodiment, in addition to detecting whether the target security rule is valid, it is also necessary to further analyze the specific reasons for the failure of the invalid target security rule. According to the above detection and processing process of the data to be processed, there are two main reasons why the target security rule may not be triggered: one is that the target security rule used in the detection process may have been modified by human intervention, causing the modified target security rule to be unable to detect the simulated attack data; the other is that the preset parsing tool used has changed, resulting in a change in the format of the parsed simulated attack data, which cannot be recognized by the target security rule.
[0057] Therefore, given these two different reasons, this embodiment needs to identify the cause of the failure of the target security rule currently deemed invalid, so that testing personnel can more efficiently troubleshoot and revise security rule issues. To this end, the specific steps for analyzing the cause of failure are as follows:
[0058] First, check if the target security rules have changed.
[0059] In this embodiment, a backup rule for the target security rule is first obtained. This backup rule is created simultaneously with the completion of the target security rule's editing, and all backup security rules are read-only, meaning the backup rules represent the original valid state of the target security rule. Then, the backup rule is modified to detect whether the target security rule has been tampered with; that is, the contents of the two rules are checked to see if they are completely identical. If they are different, a change in the target security rule is determined, and the reason for the target security rule's failure is marked as a rule change. If the contents of the two rules are completely identical, it indicates that the target security rule has not been tampered with, and the reason for its failure requires further analysis to determine whether the format of the simulated attack data has changed, i.e., whether the preset parsing tool has changed.
[0060] Furthermore, after marking the cause of the target security rule's failure as rule modification, this embodiment of the invention can also repair the failed target security rule to reduce the workload of manually handling failed target security rules. Specifically: based on the marking, a failure prompt message for the target security rule is generated. This failure prompt message includes a recovery flag that modifies the target security rule to a backup rule. This recovery flag is used by inspection personnel to view and trigger. When the recovery flag is detected to be triggered, the target security rule is restored to the backup rule, that is, the backup rule is used to overwrite the target security rule, ensuring the validity of the target security rule. This processing method is mainly for application scenarios where a one-click repair is performed after a target security rule has been manually tampered with.
[0061] Secondly, check if the preset parsing tool has changed.
[0062] For cases where the target security rules themselves have not been tampered with, further analysis will be conducted to determine whether the format of the simulated attack data conforms to the detection requirements of the target security rules. The format of the simulated attack data depends on the parsing result of the pre-defined parsing tool on the data to be processed. Therefore, the specific identification process in this embodiment is as follows:
[0063] First, obtain the original data format for security testing of simulated attack data, that is, obtain the data format of the data detected by the target security rules. This data format can also be obtained through pre-stored backups.
[0064] Second, identify the parsing data format of the simulated attack data parsed by the preset parsing tool. That is, determine the data format of the simulated attack data.
[0065] Third, compare the original data format with the parsed data format to determine if the preset parsing tool has changed.
[0066] If the original data format differs from the parsed data format, it indicates that the simulated attack data parsed by the default parsing tool has changed, causing the target security rules to be unable to recognize it. In this case, the reason for the target security rule's failure will be marked as a change in the parsing tool. Conversely, if the original data format and the parsed data format are the same, it is determined that the default parsing tool has not changed.
[0067] If the preset parsing tool remains unchanged, it means that the failure of the target security rule is not due to a change in the rule itself, nor is it due to a change in the data format caused by the parsing tool. Therefore, it can be determined that the failure did not occur during the processing of the data to be processed. In this case, this embodiment will mark the failed target security rule and generate alarm information for the marked target security rule to prompt the testing personnel to manually analyze and mark the failure cause of the target security rule.
[0068] Through the above Figure 2 As shown in the embodiments, when detecting the validity of security rules, this invention allows for the editing of the data to be processed corresponding to each security rule through a pre-configured client. This enables testing personnel to configure corresponding simulated attack data according to different security rules, achieving full coverage of security rule validity detection. Furthermore, the client also allows for setting rules for sending the data to be processed, ensuring periodic detection even without human intervention and effectively controlling the scale of the detection. In addition, after identifying failed security rules, this invention can further analyze the specific reasons for the failure based on the detection process and mark them in the detection results to inform the testing personnel of the reasons for the failure, helping them to quickly resolve the issue and improving the processing efficiency of security rule detection.
[0069] Furthermore, as a response to the above Figure 1 , 2 The implementation of the method embodiment shown in this invention provides a device for detecting the validity of security rules, which is used to improve the accuracy and coverage of security rule validity detection. The embodiment of this device corresponds to the foregoing method embodiment. For ease of reading, this embodiment will not repeat the details of the foregoing method embodiment, but it should be understood that the device in this embodiment can implement all the contents of the foregoing method embodiment. Specifically, as shown... Figure 3 As shown, the device includes:
[0070] The acquisition unit 301 is used to acquire data to be processed with an attack identifier, the attack identifier corresponding to a target security rule, the data to be processed being generated based on simulated attack data, and the simulated attack data being used to verify the validity of the target security rule;
[0071] The parsing unit 302 is used to parse the data to be processed obtained by the acquisition unit 301 into simulated attack data using a preset parsing tool;
[0072] The detection unit 303 is used to determine whether the simulated attack data obtained by the parsing unit 302 triggers the target security rule corresponding to the attack identifier;
[0073] The determining unit 304 is used to determine that the target security rule is invalid when the detection unit 303 determines that the target security rule has not been triggered.
[0074] Furthermore, such as Figure 4 As shown, the device further includes:
[0075] Extraction unit 305 is used to obtain backup rules of the failed target security rules determined by determination unit 304, wherein the backup rules are security rules in the original valid state corresponding to the target security rules;
[0076] The identification unit 306 is used to detect whether the target security rule has been tampered with using the backup rule obtained by the extraction unit 305;
[0077] The marking unit 307 is used to mark the reason for the failure of the target security rule as a rule change when the identification unit 306 determines that the target security rule has been tampered with.
[0078] The judgment unit 308 is used to detect whether the preset parsing tool has changed when the identification unit 306 determines that the target security rule has not been tampered with.
[0079] Furthermore, such as Figure 4 As shown, the determination unit 308 includes:
[0080] The acquisition module 3081 is used to acquire the raw data format for security testing of simulated attack data;
[0081] The identification module 3082 is used to identify the parsed data format of the simulated attack data parsed by the preset parsing tool; if the original data format obtained by the acquisition module 3081 is the same as the parsed data format, it is determined that the preset parsing tool has not changed; if the original data format obtained by the acquisition module 3081 is different from the parsed data format, it is marked that the reason for the failure of the target security rule is that the parsing tool has changed.
[0082] Furthermore, such as Figure 4 As shown, the determination unit 308 further includes:
[0083] The alarm module 3083 is used to mark the target security rule and generate alarm information after the identification module 3082 determines that the preset parsing tool has not changed. The alarm information is used to prompt the analysis of the failure cause of the target security rule.
[0084] Furthermore, such as Figure 4 As shown, the device further includes:
[0085] The recovery unit 309 is used to generate failure prompt information for the target security rule after the marking unit 307 marks the reason for the failure of the target security rule as a rule change. The failure prompt information contains a recovery flag that modifies the target security rule to the backup rule. When the recovery flag is detected to be triggered, the target security rule is restored to the backup rule.
[0086] Furthermore, such as Figure 4 As shown, the device further includes:
[0087] The configuration unit 310 is used to configure multiple proxy terminals before the acquisition unit 301 acquires the data to be processed with attack identifiers. The proxy terminals are used to generate data to be processed with corresponding attack identifiers by executing simulated attack data.
[0088] The configuration unit 310 is also used to set up a verification platform, which is used to edit and store simulated attack data, and manage the method, cycle and quantity of sending instructions to different agents to execute simulated attack data.
[0089] Furthermore, such as Figure 4 As shown, the device further includes:
[0090] The monitoring unit 311 is used to periodically detect whether the simulated attack data in the verification platform configured by the configuration unit 310 has changed; if it has changed, the modified simulated attack data is sent to the corresponding agent.
[0091] Furthermore, the configuration unit 310 is also used to detect the connection status between the verification platform and each agent using heartbeat information; if no feedback information is received from the agent after sending the instruction to execute simulated attack data to the agent, an alarm information of agent failure is issued, wherein the feedback information is the status information of sending the data to be processed.
[0092] Furthermore, embodiments of the present invention also provide a processor for running a program, wherein the program executes the above-described... Figure 1-2 The method for detecting the effectiveness of security rules described herein.
[0093] Furthermore, embodiments of the present invention also provide a storage medium for storing a computer program, wherein the computer program, when running, controls the device where the storage medium is located to execute the above-described... Figure 1-2 The method for detecting the effectiveness of security rules described herein.
[0094] In the above embodiments, the descriptions of each embodiment have different focuses. For parts not described in detail in a certain embodiment, please refer to the relevant descriptions in other embodiments.
[0095] It is understood that the relevant features in the above methods and apparatus can be referenced interchangeably. Furthermore, the terms "first," "second," etc., in the above embodiments are used to distinguish between embodiments and do not represent the superiority or inferiority of any particular embodiment.
[0096] Those skilled in the art will clearly understand that, for the sake of convenience and brevity, the specific working processes of the systems, devices, and units described above can be referred to the corresponding processes in the foregoing method embodiments, and will not be repeated here.
[0097] The algorithms and displays provided herein are not inherently related to any particular computer, virtual system, or other device. Various general-purpose systems can also be used in conjunction with the teachings herein. The required structure for constructing such systems is apparent from the above description. Furthermore, this invention is not directed to any particular programming language. It should be understood that the contents of the invention described herein can be implemented using various programming languages, and the above description of specific languages is for the purpose of disclosing the best mode of implementation of the invention.
[0098] In addition, the memory may include non-permanent memory in computer-readable media, such as random access memory (RAM) and / or non-volatile memory, such as read-only memory (ROM) or flash RAM, and the memory includes at least one memory chip.
[0099] Those skilled in the art will understand that embodiments of the present invention can be provided as methods, systems, or computer program products. Therefore, the present invention can take the form of a completely hardware embodiment, a completely software embodiment, or an embodiment combining software and hardware aspects. Furthermore, the present invention can take the form of a computer program product embodied on one or more computer-usable storage media (including, but not limited to, disk storage, CD-ROM, optical storage, etc.) containing computer-usable program code.
[0100] This invention is described with reference to flowchart illustrations and / or block diagrams of methods, apparatus (systems), and computer program products according to embodiments of the invention. It will be understood that each block of the flowchart illustrations and / or block diagrams, and combinations of blocks in the flowchart illustrations and / or block diagrams, can be implemented by computer program instructions. These computer program instructions can be provided to a processor of a general-purpose computer, special-purpose computer, embedded processor, or other programmable data processing apparatus to produce a machine, such that the instructions, which execute via the processor of the computer or other programmable data processing apparatus, generate instructions for implementing the flowchart illustrations and / or block diagrams. Figure 1 One or more processes and / or boxes Figure 1 A device that provides the functions specified in one or more boxes.
[0101] These computer program instructions may also be stored in a computer-readable storage medium that can direct a computer or other programmable data processing device to function in a particular manner, such that the instructions stored in the computer-readable storage medium produce an article of manufacture including instruction means, which are implemented in a process Figure 1 One or more processes and / or boxes Figure 1 The function specified in one or more boxes.
[0102] These computer program instructions may also be loaded onto a computer or other programmable data processing equipment to cause a series of operational steps to be performed on the computer or other programmable equipment to produce a computer-implemented process, thereby providing instructions that execute on the computer or other programmable equipment for implementing the process. Figure 1 One or more processes and / or boxes Figure 1 The steps of the function specified in one or more boxes.
[0103] In a typical configuration, a computing device includes one or more processors (CPU), input / output interfaces, network interfaces, and memory.
[0104] Memory may include non-persistent memory in computer-readable media, such as random access memory (RAM) and / or non-volatile memory, such as read-only memory (ROM) or flash RAM. Memory is an example of computer-readable media.
[0105] Computer-readable media includes both permanent and non-permanent, removable and non-removable media that can store information using any method or technology. Information can be computer-readable instructions, data structures, modules of programs, or other data. Examples of computer storage media include, but are not limited to, phase-change memory (PRAM), static random access memory (SRAM), dynamic random access memory (DRAM), other types of random access memory (RAM), read-only memory (ROM), electrically erasable programmable read-only memory (EEPROM), flash memory or other memory technologies, CD-ROM, digital versatile optical disc (DVD) or other optical storage, magnetic tape, magnetic magnetic disk storage or other magnetic storage devices, or any other non-transferable medium that can be used to store information accessible by a computing device. As defined herein, computer-readable media does not include transient computer-readable media, such as modulated data signals and carrier waves.
[0106] It should also be noted that the terms "comprising," "including," or any other variations thereof are intended to cover non-exclusive inclusion, such that a process, method, article, or apparatus that comprises a list of elements includes not only those elements but also other elements not expressly listed, or elements inherent to such process, method, article, or apparatus. Unless otherwise specified, an element defined by the phrase "comprising one..." does not exclude the presence of other identical elements in the process, method, article, or apparatus that includes that element.
[0107] Those skilled in the art will understand that embodiments of the present invention can be provided as methods, systems, or computer program products. Therefore, the present invention can take the form of a completely hardware embodiment, a completely software embodiment, or an embodiment combining software and hardware aspects. Furthermore, the present invention can take the form of a computer program product embodied on one or more computer-usable storage media (including, but not limited to, disk storage, CD-ROM, optical storage, etc.) containing computer-usable program code.
[0108] The above are merely embodiments of the present invention and are not intended to limit the invention. Various modifications and variations can be made to the present invention by those skilled in the art. Any modifications, equivalent substitutions, improvements, etc., made within the spirit and principle of the present invention should be included within the scope of the claims of the present invention.
Claims
1. A method for detecting the validity of safety rules, characterized in that, The method includes: Acquire pending data with an attack identifier, the attack identifier corresponding to a target security rule, the pending data being generated based on simulated attack data, and the simulated attack data being used to verify the validity of the target security rule; The data to be processed is parsed into simulated attack data using a preset parsing tool; Determine whether the simulated attack data triggers the target security rule corresponding to the attack identifier; If not triggered, the target security rule is determined to be invalid; After determining that the target security rule has failed, the method further includes: Obtain the backup rule for the target security rule, wherein the backup rule is the security rule in its original valid state corresponding to the target security rule; The backup rules are used to detect whether the target security rules have been tampered with; If so, then mark the reason why the target security rule failed as a rule change; If not, then detect whether the preset parsing tool has changed. Detecting whether the preset parsing tool has changed includes: Obtain the raw data format for security testing of simulated attack data; Identify the parsed data format of the simulated attack data parsed by the preset parsing tool; If the original data format is the same as the parsed data format, then the preset parsing tool is unchanged; If the original data format is different from the parsed data format, the reason for the failure of the target security rule is marked as a change in the parsing tool.
2. The method according to claim 1, characterized in that, After confirming that the preset parsing tool remains unchanged, the method further includes: The target security rule is marked, and an alarm message is generated. The alarm message is used to prompt analysis of the cause of failure of the target security rule.
3. The method according to claim 1, characterized in that, After marking the reason for the failure of the target security rule as a rule change, the method further includes: Generate a failure message for the target security rule, the failure message containing a recovery flag to modify the target security rule into the backup rule; When the recovery flag is detected to be triggered, the target security rule is restored to the backup rule.
4. The method according to claim 1, characterized in that, Before acquiring the data to be processed that has an attack identifier, the method further includes: Configure multiple proxy terminals, which are used to generate pending data with corresponding attack identifiers by executing simulated attack data; Configure a verification platform, which is used to edit and store simulated attack data, and manage the method, frequency and quantity of sending instructions to different agents to execute simulated attack data.
5. The method according to claim 4, characterized in that, The method further includes: Regularly check whether the simulated attack data in the verification platform has changed; If the data is changed, the modified simulated attack data will be sent to the corresponding proxy.
6. The method according to claim 4, characterized in that, The configuration verification platform includes: The connection status between the verification platform and each agent is detected using heartbeat information. If the system does not receive feedback information regarding the pending data sent by the agent after sending the instruction to execute simulated attack data to the agent, it will issue an alarm message indicating a fault in the agent. The feedback information is the status information of the pending data being sent.
7. A device for detecting the validity of safety rules, characterized in that, The device includes: An acquisition unit is used to acquire data to be processed that has an attack identifier, the attack identifier corresponding to a target security rule, the data to be processed being generated based on simulated attack data, and the simulated attack data being used to verify the validity of the target security rule; The parsing unit is used to parse the data to be processed obtained by the acquisition unit into simulated attack data using a preset parsing tool; The detection unit is used to determine whether the simulated attack data obtained by the parsing unit triggers the target security rule corresponding to the attack identifier; The determining unit is configured to determine that the target security rule is invalid when the detection unit determines that the target security rule has not been triggered; The device further includes: An extraction unit is used to obtain a backup rule for a target security rule that has been determined to be invalid by the determination unit. The backup rule is a security rule in the original valid state corresponding to the target security rule. An identification unit is used to detect whether the target security rule has been tampered with using the backup rule obtained by the extraction unit; A marking unit is used to mark the reason for the failure of the target security rule as a rule change when the identification unit determines that the target security rule has been tampered with; A judgment unit is configured to detect whether the preset parsing tool has changed when the identification unit determines that the target security rule has not been tampered with. The judgment unit includes: The acquisition module is used to acquire the raw data format for security testing of simulated attack data; The identification module is used to identify the parsed data format of the simulated attack data parsed by the preset parsing tool; if the original data format obtained by the acquisition module is the same as the parsed data format, it is determined that the preset parsing tool has not changed; if the original data format obtained by the acquisition module is different from the parsed data format, it is marked that the reason for the failure of the target security rule is that the parsing tool has changed.
8. A processor, characterized in that, The processor is used to run a program, wherein the program executes the method for detecting the validity of security rules as described in any one of claims 1-6.
9. A storage medium, characterized in that, The storage medium is used to store a computer program, wherein the computer program, when running, controls the device where the storage medium is located to execute the method for detecting the validity of security rules as described in any one of claims 1-6.