A method, apparatus and processing device for collecting an ips white sample

Abstract

The application provides a collection method and device of an IPS white sample and a processing equipment, which is used for configuring an IPS white sample for an IPS with higher precision on the basis of automatic processing. The IPS white sample with significantly improved coverage obtained by the method helps to improve the detection precision of the IPS and effectively reduce the false positive rate of the IPS. The collection method of the IPS white sample provided by the application comprises the following steps: after determining a target IPS of a white sample to be collected, acquiring a snort detection rule of the target IPS; identifying a vulnerability corresponding to the snort detection rule according to the rule content of the snort detection rule, wherein the vulnerability refers to a detection object involved when the snort detection rule is written; determining a network device associated with the vulnerability within a preset network device range; performing interactive operation on the network device in a normal application scenario by simulating a normal user; extracting a PCAP file of the interactive operation to obtain an IPS white sample adapted to the target IPS.

Description

Technical Field

[0001] The present application relates to the field of network security, and in particular to a method, apparatus, and processing device for collecting IPS white samples. Background Art

[0002] A white sample is a set of files, code, or data known to be safe, typically collected and managed by software developers, security experts, and others. These files, code, or data are considered "clean" and do not contain any malicious characteristics. They correspond to normal user behavior and can therefore be used as a reference to assess the security status of other unknown files, code, or data.

[0003] In the field of network security, white samples are often used in the development and testing of security tools such as anti-virus software, intrusion detection systems, and intrusion prevention systems. By comparing white samples with potential threats, it is easier to identify possible malicious activities and take appropriate measures to protect computer systems and networks.

[0004] Packet Capture (PCAP) white samples refer to PCAP files that have been preprocessed or filtered. These files only contain known non-malicious network traffic and can therefore be considered "clean" reference samples for evaluating the security status of other unknown traffic. However, the inventors of the present application have discovered a problem. For intrusion prevention systems (IPS), the collection of traditional IPS white samples mainly relies on network traffic capture tools, but cannot effectively cover the system scenarios corresponding to the snort detection rules involved in IPS. There is a problem of limited coverage, which leads to a high false alarm rate of IPS, which obviously needs to be improved. Summary of the Invention

[0005] The present application provides a method, device and processing equipment for collecting IPS white samples, which are used to meet the collection needs of IPS white samples. On the basis of automated processing, IPS white samples can be configured with higher precision. The IPS white samples with significantly improved coverage obtained in this way help to improve the detection accuracy of IPS and effectively reduce the false alarm rate of IPS.

[0006] In a first aspect, the present application provides a method for collecting IPS white samples, the method comprising:

[0007] After determining the target IPS for collecting white samples, obtain the snort detection rules of the target IPS;

[0008] Identify the vulnerabilities corresponding to the Snort detection rules according to the content of the Snort detection rules, where the vulnerabilities refer to the detection objects involved when writing Snort detection rules;

[0009] Determine the network devices associated with the vulnerability within the preset network device range;

[0010] By simulating normal users, interactive operations are performed on network devices in normal application scenarios;

[0011] Extract the PCAP file of the interactive operation to obtain the IPS white sample adapted to the target IPS.

[0012] In conjunction with the first aspect of the present application, in a first possible implementation of the first aspect of the present application, identifying vulnerabilities corresponding to the Snort detection rules according to the rule content of the Snort detection rules includes:

[0013] Obtain a pre-configured vulnerability number field list, where the vulnerability number field list identifies different vulnerability number fields corresponding to different vulnerabilities;

[0014] Guided by the vulnerability number field list, the specific vulnerability number field that matches the rule content of the snort detection rule is queried, and the query results obtained are used as the vulnerability corresponding to the detection rule.

[0015] In conjunction with the first aspect of the present application, in a second possible implementation of the first aspect of the present application, determining a network device associated with a vulnerability within a preset range of network devices includes:

[0016] Query the target products and services associated with the vulnerability through the pre-configured vulnerability database, where the vulnerability database stores different products and services corresponding to different vulnerabilities;

[0017] Locate network devices that provide target product services within the preset network device range.

[0018] In combination with the second possible implementation of the first aspect of the present application, in a third possible implementation of the first aspect of the present application, locating a network device that provides a target product service within a preset network device range includes:

[0019] Within the preset range of network devices, with the target product or service as the search keyword, the network space mapping engine is used to locate the network devices that provide the target product or service.

[0020] In combination with the second possible implementation of the first aspect of the present application, in a fourth possible implementation of the first aspect of the present application, locating a network device that provides a target product service within a preset network device range includes:

[0021] Search for the initial network device that provides the target product service within the preset network device range;

[0022] The survivability of each device in the initial network devices is batch detected by the script, and the determined survivability target is output as a network device.

[0023] In conjunction with the first aspect of the present application, in a fifth possible implementation of the first aspect of the present application, by simulating a normal user, performing interactive operations on the network device in a normal application scenario, including:

[0024] The crawler simulates the browsing operations of normal users on network devices in normal application scenarios, including page access and form submission.

[0025] In combination with the fifth possible implementation of the first aspect of the present application, in a sixth possible implementation of the first aspect of the present application, during the crawler operation, the following constraints are configured to achieve the user simulation goal without malicious payload:

[0026] Maximum page depth limit;

[0027] Access timeout;

[0028] Loading timeout;

[0029] Number of retries after page access failure;

[0030] Page analysis timeout;

[0031] Maximum number of interactions for a single page;

[0032] Page interaction depth limit;

[0033] Maximum page concurrency;

[0034] The total number of pages allowed to be accessed;

[0035] The most visited pages per site;

[0036] Filter similar element intensities at the same site.

[0037] In a second aspect, the present application provides a device for collecting IPS white samples, the device comprising:

[0038] An acquisition unit, configured to acquire the snort detection rules of the target IPS after determining the target IPS to collect white samples;

[0039] The identification unit is used to identify the vulnerability corresponding to the Snort detection rule according to the rule content of the Snort detection rule, wherein the vulnerability refers to the detection object involved in writing the Snort detection rule;

[0040] a determination unit, configured to determine a network device associated with a vulnerability within a preset range of network devices;

[0041] The simulation unit is used to simulate normal users to perform interactive operations on network devices in normal application scenarios;

[0042] The extraction unit is used to extract the PCAP file of the interactive operation to obtain the IPS white sample adapted to the target IPS.

[0043] In conjunction with the second aspect of the present application, in a first possible implementation of the second aspect of the present application, the identification unit is specifically configured to:

[0044] Obtain a pre-configured vulnerability number field list, where the vulnerability number field list identifies different vulnerability number fields corresponding to different vulnerabilities;

[0045] Guided by the vulnerability number field list, the specific vulnerability number field that matches the rule content of the snort detection rule is queried, and the query results obtained are used as the vulnerability corresponding to the detection rule.

[0046] In conjunction with the second aspect of the present application, in a second possible implementation of the second aspect of the present application, the determining unit is specifically configured to:

[0047] Query the target products and services associated with the vulnerability through the pre-configured vulnerability database, where the vulnerability database stores different products and services corresponding to different vulnerabilities;

[0048] Locate network devices that provide target product services within the preset network device range.

[0049] In conjunction with the second possible implementation of the second aspect of the present application, in a third possible implementation of the second aspect of the present application, the determining unit is specifically configured to:

[0050] Within the preset range of network devices, with the target product or service as the search keyword, the network space mapping engine is used to locate the network devices that provide the target product or service.

[0051] In conjunction with the second possible implementation of the second aspect of the present application, in a fourth possible implementation of the second aspect of the present application, the determining unit is specifically configured to:

[0052] Search for the initial network device that provides the target product service within the preset network device range;

[0053] The survivability of each device in the initial network devices is batch detected by the script, and the determined survivability target is output as a network device.

[0054] In conjunction with the second aspect of the present application, in a fifth possible implementation of the second aspect of the present application, the simulation unit is specifically configured to:

[0055] The crawler simulates the browsing operation of a normal user on a network device in a normal application scenario, including page access and form submission.

[0056] In combination with the fifth possible implementation manner of the second aspect of the present application, in a sixth possible implementation manner of the second aspect of the present application, the following constraint contents are configured to achieve the user simulation target of no malicious load in the working process of the crawler:

[0057] maximum page depth limit;

[0058] access timeout;

[0059] loading timeout;

[0060] retry number after page access failure;

[0061] page analysis timeout;

[0062] maximum interaction number of a single page;

[0063] page interaction depth limit;

[0064] maximum page concurrency;

[0065] total number of pages allowed to access;

[0066] maximum number of pages accessed per site;

[0067] filtering of similar element strength of the same site.

[0068] In a third aspect, the present application provides a processing device, comprising a processor and a memory, the memory storing a computer program, and the processor invoking the computer program in the memory to execute the method provided in the first aspect of the present application or any possible implementation manner of the first aspect of the present application.

[0069] In a fourth aspect, the present application provides a computer readable storage medium, the computer readable storage medium storing a plurality of instructions, and the instructions being adapted to be loaded by a processor to execute the method provided in the first aspect of the present application or any possible implementation manner of the first aspect of the present application.

[0070] From the above, the present application has the following beneficial effects:

[0071] In response to the demand for collecting IPS white samples, after determining the target IPS to collect white samples, this application obtains the snort detection rules of the target IPS, and then identifies the vulnerabilities corresponding to the snort detection rules according to the rule content of the snort detection rules, and determines the network devices associated with the vulnerabilities within the preset network device range. At this time, by simulating normal users, interactive operations are performed on the network devices in normal application scenarios, and the PCAP files of the interactive operations are extracted to obtain IPS white samples adapted to the target IPS. In the process of collecting IPS white samples, this application not only provides a set of efficient automated execution architecture, but also directly focuses on the vulnerabilities of the snort detection rules of the target IPS in the actual scenarios, and thereby tracks the relevant network devices, and extracts fixed-point IPS white samples in a simulated user manner. Starting from the detail level, a highly adapted IPS white sample configuration effect is achieved while precisely targeting the IPS vulnerabilities. Therefore, the IPS white samples with significantly improved coverage are helpful to improve the detection accuracy of the IPS and effectively reduce the false alarm rate of the IPS. BRIEF DESCRIPTION OF THE DRAWINGS

[0072] In order to more clearly illustrate the technical solutions in the embodiments of the present application, the following briefly introduces the drawings required for use in the description of the embodiments. Obviously, the drawings described below are only some embodiments of the present application. For those skilled in the art, other drawings can be obtained based on these drawings without creative work.

[0073] Figure 1 A flow chart of a method for collecting IPS white samples for this application;

[0074] Figure 2 This is a schematic diagram of the IPS white sample collection architecture for this application;

[0075] Figure 3 This is a schematic diagram of a query result for a vulnerability database in this application;

[0076] Figure 4 A schematic diagram of a query result for a network device in this application;

[0077] Figure 5 This is a schematic diagram of the results of the crawler application of this application;

[0078] Figure 6 A working logic diagram of the IPS white sample collection architecture of this application;

[0079] Figure 7 A schematic diagram of the structure of a collection device for IPS white samples of this application;

[0080] Figure 8This is a structural diagram of the processing equipment for this application. DETAILED DESCRIPTION

[0081] The following will be combined with the drawings in the embodiments of this application to clearly and completely describe the technical solutions in the embodiments of this application. Obviously, the embodiments described are only part of the embodiments of this application, not all of the embodiments. Based on the embodiments in this application, all other embodiments obtained by those skilled in the art without making creative efforts are within the scope of protection of this application.

[0082] The terms "first", "second", etc. in the specification and claims of this application and the above-mentioned drawings are used to distinguish similar objects and are not necessarily used to describe a specific order or sequence. It should be understood that the data used in this way can be interchangeable where appropriate so that the embodiments described herein can be implemented in a sequence other than that illustrated or described herein. In addition, the terms "including" and "having" and any variations thereof are intended to cover non-exclusive inclusions. For example, a process, method, system, product or device that includes a series of steps or modules is not necessarily limited to those steps or modules clearly listed, but may include other steps or modules that are not clearly listed or that are inherent to these processes, methods, products or devices. The naming or numbering of steps in this application does not mean that the steps in the method flow must be executed in the time / logical sequence indicated by the naming or numbering. The process steps that have been named or numbered can be changed in the execution order according to the technical purpose to be achieved, as long as the same or similar technical effects can be achieved.

[0083] The division of modules in this application is a logical division. In actual application, there may be other division methods. For example, multiple modules can be combined or integrated into another system, or some features can be ignored or not executed. In addition, the mutual coupling or direct coupling or communication connection shown or discussed can be through some interfaces, and the indirect coupling or communication connection between modules can be electrical or other similar forms, which are not limited in this application. Moreover, the modules or submodules described as separate components may or may not be physically separated, may or may not be physical modules, or may be distributed into multiple circuit modules. Some or all of the modules can be selected according to actual needs to achieve the purpose of the solution of this application.

[0084] Before introducing the method for collecting IPS white samples provided in this application, the background content involved in this application is first introduced.

[0085] The IPS white sample collection method, device and computer-readable storage medium provided in this application can be applied to processing equipment to meet the collection needs of IPS white samples. On the basis of automated processing, IPS white samples can also be configured with higher precision. The IPS white samples with significantly improved coverage obtained in this way help to improve the detection accuracy of IPS and effectively reduce the false alarm rate of IPS.

[0086] The IPS white sample collection method mentioned in this application can be performed by an IPS white sample collection device, or by various types of processing devices such as network nodes, servers, physical hosts, or even user equipment (UE) that integrate the IPS white sample collection device. The IPS white sample collection device can be implemented using hardware or software. The UE can specifically be a terminal device such as a smartphone, tablet computer, laptop computer, desktop computer, or personal digital assistant (PDA). The processing device can also be configured as a device cluster.

[0087] It can be understood that in specific application scenarios, the processing device of the present application is usually located in the company's internal network architecture, and is usually specifically a network node in the network architecture, such as the network node where the IPS itself is located, and other network nodes that collaborate with the network node where the IPS is located. Of course, in addition to the network nodes in the network architecture, it can also be configured as a server, physical host or even UE and other specific hardware devices according to actual needs. The IPS white sample collection method provided in this application can be used to provide white sample configuration services for the IPS, and the specific device form of the processing device can be flexibly adjusted according to actual conditions.

[0088] The following is a brief introduction to the IPS, white samples, etc. involved in this application.

[0089] IPS can be understood as a network security device used to monitor and analyze network traffic, detect and prevent malicious attacks against computer systems, networks and applications. Unlike an intrusion detection system (IDS), IPS can take proactive measures to block intrusions. It can not only identify and record intrusion events, but also automatically take measures when intrusion attempts occur, such as closing connections, banning IP addresses, blocking ports, etc., thereby protecting networks and systems from attacks.

[0090] IPS uses a variety of technologies to achieve its functions, including signature detection, protocol-based analysis, statistical analysis, and machine learning. It monitors network traffic in real time and performs in-depth analysis of the traffic to detect various malicious activities, such as viruses, worms, DoS and DDoS attacks, malware, and phishing.

[0091] In addition to providing real-time threat defense, IPS can also be used for network performance optimization and compliance inspection. By monitoring network traffic and detecting potential flaws and vulnerabilities, IPS can help organizations better protect their critical information resources and business processes, ensuring compliance with various regulations and standards.

[0092] White samples refer to a set of files, codes, or data that are known to be safe, typically collected and managed by software developers, security experts, and others. These files, codes, or data are considered "clean" and do not contain any malicious characteristics, so they can be used as a reference to assess the security status of other unknown files, codes, or data.

[0093] In the field of network security, whitelisting is often used in the development and testing of security tools such as antivirus software, intrusion detection systems, and intrusion prevention systems. By comparing whitelisting with potential threats, these tools can more easily identify possible malicious activity and take appropriate measures to protect computer systems and networks.

[0094] In contrast to white samples, black samples refer to a group of known malicious files, codes, or data, which are usually used for analysis and research on viruses, malware, and network attacks. Black samples and white samples together form an important foundation for security testing and analysis, which can help better understand the current threat environment and improve the level of information security.

[0095] PCAP white samples refer to PCAP files that have been preprocessed or filtered. These files only contain known non-malicious network traffic and can therefore be considered "clean" reference samples for evaluating the security status of other unknown traffic. They can record data packets transmitted through network interfaces. PCAP white samples are usually collected and managed by network security experts, researchers, and internal corporate security teams for testing and optimization of security tools such as antivirus software, intrusion detection systems, and intrusion prevention systems.

[0096] In contrast to black samples, PCAP white samples only contain legitimate network traffic (corresponding to normal user behavior), such as web requests, DNS queries, FTP transfers, email delivery, etc., and do not contain any malicious activities such as viruses, worms, DDoS attacks, etc. By comparing PCAP white samples with other unknown traffic, security engineers can more easily identify possible malicious traffic and take corresponding measures to protect computer systems and networks.

[0097] For IPS Snort detection rules, PCAP white samples can be used to help test and verify the correctness and reliability of the rules. Specifically, Pcap white samples can be used in the following two aspects:

[0098] 1. Rule testing:

[0099] After designing the Snort detection rules, use a set of screened PCAP white samples to verify the accuracy and reliability of the rules. This can avoid problems such as false positives and improve the detection efficiency and accuracy of the rules.

[0100] 2. Performance evaluation:

[0101] PCAP white samples can also be used to evaluate the performance and resource usage of Snort detection rules. By simulating real network traffic and measuring parameters such as the processing speed and memory usage of Snort detection rules, methods can be found to optimize rules and adjust system configurations to improve system security and performance.

[0102] In short, when writing Snort detection rules, PCAP white samples are an indispensable resource. They can help better understand network threats and attack patterns and design efficient and accurate defense strategies. At the same time, they can also be used to test the correctness and reliability of Snort detection rules, as well as evaluate the performance and efficiency of the system. They are of great significance to IPS.

[0103] However, the existing technology for collecting PCAP white samples, if it relies on manual configuration, will obviously have significantly lower efficiency and accuracy. In terms of automated configuration, it still remains at the stage of relying on historical normal user behavior, and only uses very rough data. Both of them face the problem of being unable to effectively cover the system scenarios corresponding to the snort detection rules involved in IPS, and there is a problem of limited coverage, resulting in a high false alarm rate of IPS.

[0104] Next, we will introduce the method for collecting IPS white samples provided by this application.

[0105] First, see Figure 1 , Figure 1A flow chart of the method for collecting IPS white samples of the present application is shown. The method for collecting IPS white samples provided by the present application may specifically include the following steps S101 to S105:

[0106] Step S101, after determining the target IPS for collecting white samples, obtaining the Snort detection rules of the target IPS;

[0107] It can be understood that the work of IPS may involve the application of snort detection rules. Through the pre-configured snort detection rules, IPS can perform attack detection on the behavior of current traffic (or network packets).

[0108] Among them, the snort detection rule can be understood as a type of detection rule under the snort scenario. Snort corresponds to a specific IPS application scenario in actual conditions. As a large category of application products, this application does not make specific descriptions. The focus of this application is to provide more accurate IPS white sample data support for the application of its snort detection rules.

[0109] In this case, it is obvious that after determining the current target IPS, it is more convenient to obtain the snort detection rules applied thereto, and conventional data extraction methods can be used, so this application will not elaborate on this.

[0110] Step S102, identifying vulnerabilities corresponding to the Snort detection rules according to the rule content of the Snort detection rules, wherein the vulnerabilities refer to the detection objects involved in writing the Snort detection rules;

[0111] It is understandable that for snort detection rules, when they are applied, detection and processing are carried out on certain detection objects. In the specific detection process, detection and processing can be carried out on some pre-targeted vulnerabilities. This is set when the snort detection rules are written before. In this way, after obtaining the snort detection rules, it is possible to identify / analyze them from the content of the rules, obtain the corresponding vulnerabilities, and provide data basis for the next step of data processing.

[0112] For the vulnerability itself, in addition to directly extracting its specific vulnerability content, you can also use vulnerability identifiers for more concise identification.

[0113] Among them, it is easy to understand that the vulnerabilities identified here are usually multiple in number. Of course, it is not ruled out that there is only one special case.

[0114] Step S103, determining the network device associated with the vulnerability within a preset network device range;

[0115] It can be understood that the vulnerability identified above is a vulnerability directly related to the target IPS in the current network architecture. This application continues to deepen the process and, based on the identified vulnerability, determines the network devices in the current network architecture that are strongly related to it, or in other words, the network devices that have the vulnerability in the application services provided.

[0116] For the network devices identified here, it is obvious that their specific device form not only changes with the current network architecture configuration, but also with the vulnerabilities identified previously.

[0117] The scope of network equipment mentioned here is obviously directly related to the network architecture in which it is located, or it can also be understood in terms of the scope of network architecture, in order to closely fit the actual application scenarios.

[0118] Step S104, simulating a normal user to perform interactive operations on the network device under normal application scenarios;

[0119] After determining the detection targets required by the target IPS in the current network architecture (the network devices determined previously and strongly related to the snort detection rules), the extraction and processing of traffic samples can be carried out.

[0120] Here, this application does not directly extract the corresponding traffic samples in the normal working process of the network device (for real users), but based on the previously locked vulnerabilities, it simulates normal users to achieve a more efficient and controllable traffic sample extraction effect, so as to further fit the actual scenario that the vulnerability depends on.

[0121] Specifically, it is necessary to simulate normal users and, within the scope of normal user behavior, set the proportion of different user behaviors, the load brought by user behaviors, etc., to achieve a precise and controllable simulation effect, so as to restore the required interactive operations of network devices in normal application scenarios, thereby providing a precise and controllable space for extracting traffic samples.

[0122] Step S105: extract the interactive operation PCAP file to obtain an IPS white sample adapted to the target IPS.

[0123] As described above, in the process of interactively operating the previously focused network device by simulating a normal user, a PCAP file of the corresponding format can be recorded in real time to obtain the IPS white sample that is collected by this application and adapted to the target IPS.

[0124] Alternatively, after completing the interactive operation, a PCAP file of a corresponding format may be extracted based on information such as logs to obtain the IPS white sample to be collected by this application and adapted to the target IPS.

[0125] Among them, the corresponding format referred to here refers to the preset format of the IPS white sample to be collected and adapted by the target IPS in this application. It can be understood that when obtaining the PCAP file based on the relevant information of the interactive operation, it may involve the conversion of the file format, the preprocessing of the file content, etc.

[0126] from Figure 1 As can be seen from the illustrated embodiment, in response to the demand for collecting IPS white samples, after determining the target IPS for collecting white samples, the present application obtains the snort detection rules of the target IPS, then identifies the vulnerabilities corresponding to the snort detection rules based on the rule content of the snort detection rules, and determines the network devices associated with the vulnerabilities within the preset network device range. At this time, by simulating normal users, interactive operations are performed on the network devices in normal application scenarios, and the PCAP files of the interactive operations are extracted to obtain IPS white samples adapted to the target IPS. In the process of collecting IPS white samples, the present application not only provides a set of efficient automated execution architecture, but also directly focuses on the vulnerabilities of the snort detection rules of the target IPS in the actual scenario, and thereby tracks the relevant network devices, and extracts fixed-point IPS white samples in a simulated user manner. In this way, starting from the detail level, a highly adapted IPS white sample configuration effect is achieved while accurately targeting the IPS vulnerabilities. Therefore, the obtained IPS white samples with significantly improved coverage help to improve the detection accuracy of the IPS and effectively reduce the false alarm rate of the IPS.

[0127] Specifically, the above-mentioned IPS white sample configuration architecture realizes a more accurate sample configuration range (based on vulnerabilities, targeted configuration), is conducive to the simplification of sample scale (after targeted configuration, the data scale can be compressed, and invalid or meaningless samples can be avoided), can accurately classify and manage samples according to vulnerabilities, and achieves high-speed and effective sample automation configuration effects.

[0128] In order to further understand the content of the solution of this application, the following is based on an application example in actual application of this application to continue to explain the above Figure 1 Each step of the illustrated embodiment and its possible implementation in practical applications are described in detail.

[0129] See Figure 2 The following is a schematic diagram of the IPS white sample collection architecture of the present application. In practical applications, the IPS white sample collection architecture of the present application may involve the module contents of the rule analysis module, the vulnerability information query module, the asset search module, the data simulation module, and the data capture module. It is worth noting that these modules do not correspond one-to-one to the various steps involved above, but correspond to the contents of the previous steps S102 to S105. The details are as follows:

[0130] 1. Rule analysis module

[0131] The rule analysis module corresponds to the previous step S102 and is used to analyze the acquired Snort detection rules to identify the vulnerabilities involved in the rule content.

[0132] As an exemplary implementation, step 102 of identifying the vulnerability corresponding to the Snort detection rule according to the rule content of the Snort detection rule may specifically include:

[0133] Obtain a pre-configured vulnerability number field list, where the vulnerability number field list identifies different vulnerability number fields corresponding to different vulnerabilities;

[0134] Guided by the vulnerability number field list, the specific vulnerability number field that matches the rule content of the snort detection rule is queried, and the query results obtained are used as the vulnerability corresponding to the detection rule.

[0135] It can be understood that the application of snort detection rules to vulnerabilities can specifically involve their vulnerability identification, that is, the specific vulnerability number field here. In this regard, for the range of vulnerabilities that snort detection rules can involve, this application can use a preset vulnerability number field list to cover different vulnerabilities, thereby providing queries for specific vulnerabilities. The vulnerability number field list not only facilitates vulnerability query services in specific applications, but also has a standardizing effect on the vulnerabilities that may be involved.

[0136] The vulnerability number field involved here takes the Common Vulnerabilities & Exposures (CVE) number as an example. For the vulnerability query involved here, you can use the following set of example codes to configure it:

[0137]

[0138] It can be seen that in specific applications, this application can use regular expressions to perform specific query targets.

[0139] As another example, the query result may be as follows:

[0140] all enable alert http any any->any any(msg:"Control Web Panel loginRemote command execution vulnerability";msg_cn:"Control Web Panel login remote command execution vulnerability"; reliability: 90; attack_chain: intrusion; flow: to_server, established; content: " / login / index.php"; http_uri; nocase; content: "login=$("; http_uri; nocase; pcre: " / login=\$\((ping|echo)\${IFS}.* / iU"; content: "username=root&password=toor&commit=Login"; nocase; sid:813581; priority:8; class type:arbitrary-code-execution;success:0;year:2022;template:Unix-like,Webserver;os:Other;cv e:CVE-2022-44877;cwe:CWE-77;)

[0141] It can be understood that according to the "cve:CVE-2022-44877" information carried in the rule content, it can be determined that there is a vulnerability in the snort detection rule here, and the corresponding vulnerability number is CVE-2022-44877.

[0142] In addition to the CVE number, you can also use specific numbers such as the China National Vulnerability Database (CNVD), the China National Vulnerability Database of Information (CNNVD) number, or the company's internal number.

[0143] 2. Vulnerability Information Query Module

[0144] The vulnerability information query module corresponds to the previous step S103, and is used in combination with the subsequent asset search module to determine the network devices associated with the vulnerability. In this process, the vulnerability information query module is specifically used to provide relevant data basis for determining the network devices associated with the vulnerability based on the previously determined vulnerabilities.

[0145] Specifically, as another exemplary implementation, step S103 determines the network devices associated with the vulnerability within a preset range of network devices, including:

[0146] Query the target products and services associated with the vulnerability through the pre-configured vulnerability database, where the vulnerability database stores different products and services corresponding to different vulnerabilities;

[0147] Locate network devices that provide target product services within the preset network device range.

[0148] It can be seen that in specific operations, compared to directly querying network devices with previously identified vulnerabilities in the network architecture, the present application can also introduce indirect query settings, that is, as set here, after pre-determining the products and services corresponding to different vulnerabilities, a vulnerability library is built. The vulnerability library does not simply describe different vulnerabilities, but describes different products and services corresponding to different vulnerabilities. Therefore, it can also be understood by the correspondence between different vulnerabilities and different products and services. The vulnerability library is used to locate the products and services involved in the previously identified vulnerabilities, and then the target products and services that are associated with the vulnerabilities are determined to quickly locate the relevant network devices.

[0149] In this mechanism, there is a premise, that is, for different network devices in the network architecture, it is necessary to determine in advance the products and services that can be provided. It is understandable that whether it is traversing in advance or trying to traverse each network device to see if there are vulnerabilities, it requires a large cost (including computing power and time), and traversing the product services of network devices is obviously easier to implement in a low-cost manner. Therefore, using the vulnerability library and its product services as an intermediate medium in the query process can significantly reduce the query cost and improve the query efficiency.

[0150] For the vulnerability database, the information stored about the vulnerability may include: vulnerability name, vulnerability number, vulnerability description, affected version, etc.

[0151] Taking the CVE-2022-44877 vulnerability mentioned above as an example, you can refer to Figure 3 The diagram shows a query result diagram of a vulnerability library of this application. Through the CVE-2022-44877 number, information about the product service - ControlWeb Panel can be obtained.

[0152] Among them, in specific applications, it is preferred to use a self-built vulnerability library. Of course, it is not ruled out that vulnerability library products publicly available on the market can be used for deeper use.

[0153] 3. Asset Search Module

[0154] The asset search module is responsible for locating the network devices that provide the target product services based on the vulnerabilities corresponding to the target products and services obtained by the vulnerability information query module, thereby achieving the asset search goal.

[0155] As another exemplary implementation, the process of locating a network device providing a target product service within a preset network device range in the above embodiment may specifically include:

[0156] Within the preset range of network devices, with the target product or service as the search keyword, the network space mapping engine is used to locate the network devices that provide the target product or service.

[0157] It can be seen that the positioning / search for network devices here is initiated using the service identifier of the target product service as the search keyword, and in the specific query process, this application also introduces the application of a cyberspace mapping engine.

[0158] It can be understood that the cyberspace mapping engine can capture deeper device information of network devices in the network architecture, so that it can be combined with artificial intelligence algorithm models to significantly improve the recognition efficiency of providing target product services. It is also convenient to configure different identification strategies and combine with computing infrastructure. For network devices, high-precision asset mapping can be achieved, thereby achieving more accurate tracking of vulnerabilities corresponding to network devices and improving data relevance.

[0159] Among them, the cyberspace mapping engine can also be originally configured in the network architecture to assist in managing network devices in the network architecture. In this case, the use of the cyberspace mapping engine can be achieved by calling services.

[0160] As another example, the application programming interface (API) of the spatial mapping engine can be called to obtain a list of assets (consisting of network devices) in the network architecture that are related to the current target product and service, such as obtaining the first 50 assets, removing duplicates, and putting them into a list to be detected.

[0161] The cyberspace mapping engine involved here may specifically be tools such as fofa, shoda or eaglechart.

[0162] Taking the aforementioned product service - Control Web Panel as an example, by searching its keyword: web.body = "Control Web Panel", you can search for several Control Web Panel related assets. For the convenience of display, this application can also introduce visualization settings. For details, you can also refer to Figure 4 A schematic diagram of a query result of the network device of the present application is shown, and the content shown is the result presented by searching the corresponding keyword through the browser.

[0163] Of course, in addition to browsers, visualization goals can also be achieved through other application services.

[0164] In addition, as another exemplary implementation, the process of locating a network device providing a target product service within a preset network device range in the above embodiment may further include:

[0165] Search for the initial network device that provides the target product service within the preset network device range;

[0166] The survivability of each device in the initial network devices is batch detected by the script, and the determined survivability target is output as a network device.

[0167] It can be understood that for the embodiments herein, the present application believes that in actual applications, some of the queried network devices may have been in an "inactive" state, that is, the device is in a state of exiting the network architecture (not yet completely exiting the network architecture) or the device is in an abnormal state (such as a failure or temporarily offline). For such network devices, it is obviously difficult to serve the interactive operations based on simulating normal users involved later. Therefore, through survival detection, they can be effectively eliminated and network devices that can meet application requirements can be screened out.

[0168] As another example, the following code snippet retrieves a single target asset:

[0169]

[0170]

[0171] In addition, it can be understood that the batch detection processing carried out by the script introduced in the embodiment here can also promote more efficient automated execution effects.

[0172] 4. Data simulation module

[0173] The data simulation module corresponds to the previous step S104 and is used to simulate a normal user initiating an interactive operation on the network device obtained by the query, so as to obtain relevant traffic samples.

[0174] As another exemplary implementation, step S104 may include the following steps:

[0175] The crawler simulates the browsing operations of normal users on network devices in normal application scenarios, including page access and form submission.

[0176] As can be seen, the embodiment herein limits the interactive operations involved in page access and form submission, which is biased towards web applications and corresponds to more specific application scenarios. In addition, this application introduces the application of crawlers, which achieve more efficient user simulation effects through crawlers.

[0177] Moreover, for the crawler introduced here, in specific operations, it is also convenient to configure relevant application conditions from a detailed level, so as to achieve better user simulation effects.

[0178] Specifically, as another exemplary implementation, during the crawler's operation, the following constraints can be configured to achieve the user simulation goal without malicious payloads:

[0179] Maximum page depth limit;

[0180] Access timeout;

[0181] Loading timeout;

[0182] Number of retries after page access failure;

[0183] Page analysis timeout;

[0184] Maximum number of interactions for a single page;

[0185] Page interaction depth limit;

[0186] Maximum page concurrency;

[0187] The total number of pages allowed to be accessed;

[0188] The number of most visited pages on each site;

[0189] Filter similar element intensities at the same site.

[0190] It is easy to see that 11 constraints are exposed here. In the process of simulating normal user-initiated interactive operations, while restoring normal user behavior, it can also promote higher authenticity, avoid the system from falsely triggering attack defenses, and achieve efficient and stable user simulation effects, thereby promoting the efficient and stable acquisition of traffic samples.

[0191] Of course, it should be understood that in addition to the above 11 constraints, other constraints may also be involved or adopted in specific operations, and they can be adjusted according to actual conditions.

[0192] As another example, the specific constraints at the code level may be as follows:

[0193]

[0194] For the application of crawlers, you can also refer to Figure 5 A schematic diagram of the results of the crawler application of this application is shown for a more vivid understanding.

[0195] 5. Data Capture Module

[0196] The data capture module corresponds to the previous step S105 and is used to generate the final target, ie, the IPS white sample.

[0197] Specifically, the data capture module can use tools such as tcpdump or wireshark to filter the network device and its network card and capture the corresponding messages. After processing a task, it uses pexpect to send a termination command to end the packet capture and classify and store them by vulnerability name + asset name. For example, a PCAP file of a vulnerability can be obtained:

[0198] CVE-2022-44877_Control_Web_Panel.pcapCVE-2018-2894_Weblogic.pcap.

[0199] After obtaining the PCAP files of all vulnerabilities, all PCAP files can be merged and processed to output IPS white samples.

[0200] From the description here, we can also see that, as mentioned earlier, this application can also involve accurate sample classification management based on vulnerabilities (which can also be extended to the merged IPS white samples). This further enhances the data value of IPS white samples and can be applied more conveniently and efficiently.

[0201] To facilitate understanding of the above content (including the content of each embodiment), you can also continue to refer to Figure 6 A working logic diagram of the IPS white sample collection architecture of the present application is shown for a more complete and vivid understanding.

[0202] The above is an introduction to the IPS white sample collection method provided in this application. In order to facilitate better implementation of the IPS white sample collection method provided in this application, this application also provides an IPS white sample collection device from the perspective of functional modules.

[0203] See Figure 7 , Figure 7 This is a schematic diagram of the structure of the IPS white sample collection device of the present application. In the present application, the IPS white sample collection device 700 may specifically include the following structure:

[0204] An acquisition unit 701 is configured to acquire the Snort detection rules of the target IPS after determining the target IPS from which the white sample is to be collected;

[0205] Identification unit 702, for identifying vulnerabilities corresponding to snort detection rules according to the rule content of the snort detection rules, wherein the vulnerability refers to the detection object involved in writing the snort detection rules;

[0206] A determination unit 703 is configured to determine a network device associated with a vulnerability within a preset range of network devices;

[0207] The simulation unit 704 is used to simulate a normal user to perform interactive operations on the network device in a normal application scenario;

[0208] The extraction unit 705 is used to extract the PCAP file of the interactive operation to obtain the IPS white sample adapted to the target IPS.

[0209] In an exemplary implementation, the identification unit 702 is specifically configured to:

[0210] Obtain a pre-configured vulnerability number field list, where the vulnerability number field list identifies different vulnerability number fields corresponding to different vulnerabilities;

[0211] Guided by the vulnerability number field list, the specific vulnerability number field that matches the rule content of the snort detection rule is queried, and the query result is used as the vulnerability corresponding to the detection rule.

[0212] In another exemplary implementation, the determining unit 703 is specifically configured to:

[0213] Query the target products and services associated with the vulnerability through the pre-configured vulnerability database, where the vulnerability database stores different products and services corresponding to different vulnerabilities;

[0214] Locate the network devices that provide target product services within the preset network device range.

[0215] In another exemplary implementation, the determining unit 703 is specifically configured to:

[0216] Within the preset range of network devices, with the target product or service as the search keyword, the network space mapping engine is used to locate the network devices that provide the target product or service.

[0217] In another exemplary implementation, the determining unit 703 is specifically configured to:

[0218] Search for the initial network device that provides the target product service within the preset network device range;

[0219] The survivability of each device in the initial network devices is batch detected by the script, and the determined survivability target is output as a network device.

[0220] In another exemplary implementation, the simulation unit 704 is specifically configured to:

[0221] The crawler simulates the browsing operations of normal users on network devices in normal application scenarios, including page access and form submission.

[0222] In another exemplary implementation, during the crawler's operation, the following constraints are configured to achieve the user simulation goal without malicious payload:

[0223] Maximum page depth limit;

[0224] Access timeout;

[0225] Loading timeout;

[0226] Number of retries after page access failure;

[0227] Page analysis timeout;

[0228] Maximum number of interactions for a single page;

[0229] Page interaction depth limit;

[0230] Maximum page concurrency;

[0231] The total number of pages allowed to be accessed;

[0232] The most visited pages per site;

[0233] Filter similar element intensities at the same site.

[0234] This application also provides a processing device from the perspective of hardware structure, see Figure 8 , Figure 8 The schematic diagram of the structure of the processing device of the present application is shown. Specifically, the processing device of the present application may include a processor 801, a memory 802 and an input / output device 803. The processor 801 is used to execute the computer program stored in the memory 802 to implement the following Figure 1 The steps of the method for collecting IPS white samples in the corresponding embodiment; or, when the processor 801 is used to execute the computer program stored in the memory 802, the following is implemented Figure 7The memory 802 is used to store the functions of each unit in the embodiment corresponding to the processor 801. Figure 1 The computer program required for the method of collecting IPS white samples in the corresponding embodiment.

[0235] For example, the computer program may be divided into one or more modules / units, one or more of which are stored in the memory 802 and executed by the processor 801 to complete the present application. One or more modules / units may be a series of computer program instruction segments capable of performing specific functions, and the instruction segments are used to describe the execution process of the computer program in a computer device.

[0236] The processing device may include, but is not limited to, a processor 801, a memory 802, and an input / output device 803. Those skilled in the art will appreciate that the illustrations are merely examples of processing devices and do not limit the processing device. The processing device may include more or fewer components than shown, or a combination of certain components, or different components. For example, the processing device may also include a network access device, a bus, etc., and the processor 801, the memory 802, the input / output device 803, etc. are connected via a bus.

[0237] The processor 801 may be a central processing unit (CPU), or other general-purpose processors, digital signal processors (DSP), application-specific integrated circuits (ASIC), field-programmable gate arrays (FPGA), or other programmable logic devices, discrete gate or transistor logic devices, discrete hardware components, etc. A general-purpose processor may be a microprocessor or any conventional processor. The processor is the control center of the processing device and connects various parts of the entire device using various interfaces and lines.

[0238] The memory 802 can be used to store computer programs and / or modules. The processor 801 implements various functions of the computer device by running or executing the computer programs and / or modules stored in the memory 802 and accessing the data stored in the memory 802. The memory 802 may mainly include a program storage area and a data storage area. The program storage area may store an operating system, at least one application required for a function, etc.; the data storage area may store data created based on the use of the processing device, etc. In addition, the memory may include high-speed random access memory and non-volatile memory, such as a hard disk, internal memory, a plug-in hard disk, a smart media card (SMC), a secure digital (SD) card, a flash card, at least one disk storage device, a flash memory device, or other volatile solid-state storage device.

[0239] When the processor 801 is used to execute the computer program stored in the memory 802, it can specifically implement the following functions:

[0240] After determining the target IPS for collecting white samples, obtain the snort detection rules of the target IPS;

[0241] Identify the vulnerabilities corresponding to the Snort detection rules according to the content of the Snort detection rules, where the vulnerabilities refer to the detection objects involved when writing Snort detection rules;

[0242] Determine the network devices associated with the vulnerability within the preset network device range;

[0243] By simulating normal users, interactive operations are performed on network devices in normal application scenarios;

[0244] Extract the PCAP file of the interactive operation to obtain the IPS white sample adapted to the target IPS.

[0245] Those skilled in the art will clearly understand that for the convenience and brevity of description, the specific working process of the IPS white sample collection device, processing equipment and corresponding units described above can refer to the following: Figure 1 The description of the method for collecting the IPS white sample in the corresponding embodiment will not be repeated here.

[0246] Those skilled in the art will appreciate that all or part of the steps in the various methods of the above embodiments may be accomplished by instructions, or by controlling related hardware through instructions. The instructions may be stored in a computer-readable storage medium and loaded and executed by a processor.

[0247] To this end, the present application provides a computer-readable storage medium, which stores a plurality of instructions, which can be loaded by a processor to execute the present application as follows: Figure 1 The steps of the method for collecting IPS white samples in the corresponding embodiment, the specific operations can be referred to as follows Figure 1 The description of the method for collecting the IPS white sample in the corresponding embodiment will not be repeated here.

[0248] The computer-readable storage medium may include a read-only memory (ROM), a random access memory (RAM), a magnetic disk or an optical disk, etc.

[0249] Due to the instructions stored in the computer readable storage medium, the present application can be executed as follows: Figure 1 The steps of the method for collecting IPS white samples in the corresponding embodiment, therefore, the present application can be realized as follows Figure 1 The beneficial effects that can be achieved by the method for collecting IPS white samples in the corresponding embodiment are detailed in the previous description and will not be repeated here.

[0250] The above is a detailed introduction to the IPS white sample collection method, device, processing equipment and computer-readable storage medium provided by this application. Specific examples are used herein to illustrate the principles and implementation methods of this application. The description of the above embodiments is only used to help understand the method and core ideas of this application. At the same time, for those skilled in the art, based on the ideas of this application, there will be changes in the specific implementation methods and application scope. In summary, the content of this specification should not be understood as a limitation on this application.

Claims

1. A method for collecting IPS white samples, characterized in that: The method comprises: After determining the target IPS for collecting white samples, obtaining the snort detection rules of the target IPS; Identify, according to the rule content of the snort detection rule, a vulnerability corresponding to the snort detection rule, wherein the vulnerability refers to a detection object involved in writing the snort detection rule; Determine the network device associated with the vulnerability within a preset range of network devices; By simulating a normal user, performing interactive operations on the network device in normal application scenarios; Extract the PCAP file of the interactive operation to obtain the IPS white sample adapted to the target IPS.

2. The method according to claim 1, characterized in that The step of identifying a vulnerability corresponding to the snort detection rule according to the rule content of the snort detection rule comprises: Obtain a pre-configured vulnerability number field list, wherein the vulnerability number field list identifies different vulnerability number fields corresponding to different vulnerabilities; Using the vulnerability number field list as a guide, the specific vulnerability number field that matches the rule content of the snort detection rule is queried, and the query result obtained is used as the vulnerability corresponding to the detection rule.

3. The method according to claim 1, characterized in that Determining the network device associated with the vulnerability within a preset range of network devices includes: Query the target product and service associated with the vulnerability through a pre-configured vulnerability library, wherein the vulnerability library stores different products and services corresponding to different vulnerabilities; The network device providing the target product service is located within the preset network device range.

4. The method according to claim 3, characterized in that The locating, within the preset network device range, the network device providing the target product service includes: Within the preset network device range, with the target product service as the search keyword, a network space mapping engine is used to locate the network device that provides the target product service.

5. The method according to claim 3, characterized in that The locating, within the preset network device range, the network device providing the target product service includes: Searching for an initial network device that provides the target product service within the preset network device range; The survivability of each device in the initial network devices is batch detected by a script, and the determined survivability target is output as the network device.

6. The method according to claim 1, characterized in that The performing of interactive operations on the network device in a normal application scenario by simulating a normal user includes: The crawler simulates the browsing operations of a normal user on the network device in the normal application scenario, including page access and form submission.

7. The method according to claim 6, characterized in that During the crawler's operation, the following constraints are configured to achieve the user simulation goal without malicious payload: Maximum page depth limit; Access timeout; Loading timeout; Number of retries after page access failure; Page analysis timeout; Maximum number of interactions for a single page; Page interaction depth limit; Maximum page concurrency; The total number of pages allowed to be accessed; The most visited pages per site; Filter similar element intensities at the same site.

8. A device for collecting IPS white samples, characterized in that: The device comprises: An acquisition unit, configured to acquire a Snort detection rule of the target IPS after determining the target IPS to collect white samples; An identification unit, configured to identify a vulnerability corresponding to the snort detection rule according to the rule content of the snort detection rule, wherein the vulnerability refers to a detection object involved in writing the snort detection rule; a determination unit, configured to determine a network device associated with the vulnerability within a preset range of network devices; A simulation unit, configured to simulate a normal user to perform interactive operations on the network device under normal application scenarios; The extraction unit is used to extract the PCAP file of the interactive operation to obtain the IPS white sample adapted to the target IPS.

9. A processing device, characterized in that The method comprises a processor and a memory, wherein a computer program is stored in the memory, and when the processor calls the computer program in the memory, the method according to any one of claims 1 to 7 is executed.

10. A computer-readable storage medium, characterized in that The computer-readable storage medium stores a plurality of instructions, and the instructions are suitable for being loaded by a processor to execute the method according to any one of claims 1 to 7.

Images