Dynamic rule protection method, device and computer equipment of network application firewall

Abstract

The application relates to a dynamic rule protection method, device and computer equipment of a network application firewall. The method comprises the following steps: acquiring an access request and a source address of the access request; acquiring a credibility label of the source address based on a preset address label table; selecting a corresponding rule group from a preset network application firewall rule group based on the credibility label of the source address, and detecting the access request by using the rule group to obtain a detection result; and accessing a target address by using the access request if the detection result is passed. By using the method, the operation pressure of the network application firewall itself can be reduced, the security detection engine capacity can be prevented from long-term occupying the equipment performance, and the smooth continuity of the access network service is greatly ensured.

Description

Technical Field

[0001] This application relates to the field of network security technology, and in particular to a dynamic rule protection method, apparatus, and computer device for network application firewalls. Background Technology

[0002] With the emergence of a series of new Internet products such as Web 2.0, WeChat, and APIs, Internet applications based on the network environment are becoming more and more widespread. In the process of enterprise informatization, various applications are built on network platforms, facing various risks of hacker intrusion.

[0003] The core capability of a network application firewall is to have a variety of protection rules. However, firewall users are not clear about the best way to configure these protection rules. In order to deal with unknown hacker intrusions, staff usually load and enable all protection rules to make the rule level the most stringent. However, this also brings problems such as a large change in the load pressure on the network application firewall and an increase in the number of false alarms, which affects the smoothness of normal business access. Summary of the Invention

[0004] Therefore, it is necessary to provide a dynamic rule protection method, device, and computer equipment for network application firewalls that can reduce the operational pressure on the network application firewall itself and improve the smoothness of access to network services, in order to address the above-mentioned technical problems.

[0005] A first aspect is a dynamic rule-based protection method for a network application firewall, the method comprising:

[0006] Obtain the access request and the source address of the access request;

[0007] Based on a preset address tag table, obtain the credibility tag of the source address;

[0008] Based on the trustworthiness label of the source address, a corresponding rule group is selected from the preset network application firewall rule group, and the access request is detected using the rule group to obtain the detection result;

[0009] If the detection result is successful, the target address is accessed through the access request.

[0010] In one embodiment, obtaining the trustworthiness label of the source address based on a preset address label table includes:

[0011] Search the source address in the preset address label table;

[0012] If the source address has a record in the pre-stored address label table, obtain the credibility label of the source address from the record.

[0013] In one embodiment, after searching for the source address in a pre-stored address label table, the method further includes:

[0014] If the source address is not recorded in the address label table, then the source address is assigned a first label; wherein the first label is the label with the lowest credibility among the credibility labels.

[0015] In one embodiment, the trust label based on the source address is used to select a corresponding rule group from a preset network application firewall rule group, and the access request is detected using the rule group to obtain a detection result, including:

[0016] The credibility tags include first-tier tags and second-tier tags; wherein, the credibility of the first-tier tags is lower than that of the second-tier tags; the first-tier tags include low-credibility tags and medium-credibility tags; the second-tier tags include high-credibility tags;

[0017] The preset network application firewall rule group includes a first rule group and a second rule group; wherein, the first rule group has a higher level of protection than the second rule group;

[0018] If the credibility tag of the source address is the first tier tag, then the access request is detected using the first rule group to obtain a first detection result.

[0019] If the credibility label of the source address is the second echelon label, then the access request is detected using the second rule group to obtain a second detection result.

[0020] In one embodiment, it further includes:

[0021] If the detection result does not meet the dynamic update conditions, the current correspondence between the source address and the credibility label is retained in the address label table;

[0022] If the detection result meets the dynamic update condition, then the credibility label corresponding to the source address is changed, and the address label table is modified accordingly.

[0023] In one embodiment, if the detection result meets the dynamic update condition, then modifying the confidence tag corresponding to the source address and accordingly modifying the address tag table includes:

[0024] When the first detection result is obtained, if there is no network attack behavior in the first detection result during the observation period, the first echelon label corresponding to the source address will be changed;

[0025] When the second detection result is obtained, if the second detection result indicates a network attack, the second echelon label corresponding to the source address is changed to the first echelon label.

[0026] Based on the changed correspondence between the source address and the first echelon label or the second echelon label, the address label table is modified.

[0027] In one embodiment, when a first detection result is obtained, if the first detection result does not show any network attack behavior during the observation period, the first echelon label corresponding to the source address is changed, including:

[0028] When the first detection result is obtained, if the first detection result shows network attack behavior during the observation period, the observation period is recalculated, and the correspondence between the source address and the current first-tier label is retained;

[0029] If the first detection result does not show any network attack behavior during the observation period, the first-tier label corresponding to the source address will be changed.

[0030] Secondly, this application also provides a dynamic rule protection device for a network application firewall. The device includes:

[0031] The request acquisition module is used to acquire the access request and the source address of the access request;

[0032] The tag acquisition module is used to acquire the credibility tag of the source address based on a preset address tag table;

[0033] The rule group detection module is used to select a corresponding rule group from a preset network application firewall rule group based on the trustworthiness label of the source address, and use the rule group to detect the access request to obtain the detection result;

[0034] The target address access module is used to access the target address through the access request if the detection result is successful.

[0035] Thirdly, this application also provides a computer device. The computer device includes a memory and a processor, the memory storing a computer program, and the processor executing the computer program to implement the dynamic rule protection method for the network application firewall described in the first aspect.

[0036] Fourthly, this application also provides a computer-readable storage medium. The computer-readable storage medium stores a computer program thereon, which, when executed by a processor, implements the dynamic rule protection method for the network application firewall described in the first aspect.

[0037] The aforementioned dynamic rule protection method, device, and computer equipment for network application firewalls obtain the trustworthiness label of the source address of the access request, make a preliminary judgment on the compliance of the client's access request, and then use the network application firewall rule group corresponding to the trustworthiness label to perform a corresponding level of security detection on the access request. Only when the detection result passes can the target address be accessed, thereby achieving a dynamic protection effect for each access request, reducing the operating pressure of the network application firewall itself, avoiding the long-term occupation of device performance by the security detection engine, and greatly ensuring the smooth continuity of network access services. Attached Figure Description

[0038] The accompanying drawings, which are included to provide a further understanding of this application and form part of this application, illustrate exemplary embodiments of this application and are used to explain this application, but do not constitute an undue limitation of this application. In the drawings:

[0039] Figure 1 This is a hardware structure block diagram of a dynamic rule protection method for a network application firewall in one embodiment;

[0040] Figure 2 This is a flowchart illustrating a dynamic rule protection method for a network application firewall in one embodiment.

[0041] Figure 3 This is a flowchart illustrating a dynamic rule protection method for a network application firewall in a preferred embodiment.

[0042] Figure 4 This is a flowchart illustrating the steps for performing security checks on access requests in a preferred embodiment;

[0043] Figure 5 This is a structural block diagram of a dynamic rule protection device for a network application firewall in one embodiment. Detailed Implementation

[0044] To make the objectives, technical solutions, and advantages of this application clearer, the following detailed description is provided in conjunction with the accompanying drawings and embodiments. It should be understood that the specific embodiments described herein are merely illustrative and not intended to limit the scope of this application. All other embodiments obtained by those skilled in the art based on the embodiments provided in this application without inventive effort are within the scope of protection of this application.

[0045] Obviously, the accompanying drawings described below are merely some examples or embodiments of this application. Those skilled in the art can apply this application to other similar scenarios based on these drawings without any creative effort. Furthermore, it is understood that although the efforts made in this development process may be complex and lengthy, for those skilled in the art related to the content disclosed in this application, any changes to design, manufacturing, or production based on the technical content disclosed in this application are merely conventional technical means and should not be construed as insufficient disclosure of this application.

[0046] In this application, the reference to "embodiment" means that a specific feature, structure, or characteristic described in connection with an embodiment may be included in at least one embodiment of this application. The appearance of this phrase in various places in the specification does not necessarily refer to the same embodiment, nor is it a separate or alternative embodiment that is mutually exclusive with other embodiments. It will be explicitly and implicitly understood by those skilled in the art that the embodiments described in this application may be combined with other embodiments without conflict.

[0047] Unless otherwise defined, the technical or scientific terms used in this application shall have the ordinary meaning understood by one of ordinary skill in the art to which this application pertains. The terms “a,” “an,” “an,” “the,” and similar words used in this application do not indicate quantity limitation and may indicate singular or plural. The terms “comprising,” “including,” “having,” and any variations thereof used in this application are intended to cover non-exclusive inclusion; for example, a process, method, system, product, or device that includes a series of steps or modules (units) is not limited to the listed steps or units, but may also include steps or units not listed, or may include other steps or units inherent to these processes, methods, products, or devices. The terms “connected,” “linked,” “coupled,” and similar words used in this application are not limited to physical or mechanical connections, but may include electrical connections, whether direct or indirect. “Multiple” used in this application refers to two or more. “And / or” describes the relationship between related objects, indicating that three relationships may exist; for example, “A and / or B” can represent: A alone, A and B simultaneously, and B alone. The character " / " generally indicates that the preceding and following objects are in an "or" relationship. The terms "first," "second," and "third" used in this application are merely to distinguish similar objects and do not represent a specific ordering of the objects.

[0048] The method embodiments provided in this example can be executed on a terminal, computer, or similar computing device. For example, it can run on a terminal. Figure 1This is a hardware structure block diagram of the dynamic rule protection method of the network application firewall in this embodiment. For example... Figure 1 As shown, a terminal may include one or more ( Figure 1 Only one is shown in the diagram. A processor 102 and a memory 104 for storing data are also included. The processor 102 may be, but is not limited to, a microprocessor (MCU) or a programmable logic device (FPGA). The terminal may also include a transmission device 106 for communication functions and an input / output device 108. Those skilled in the art will understand that… Figure 1 The structure shown is for illustrative purposes only and does not limit the structure of the terminal described above. For example, the terminal may also include components that are larger than... Figure 1 The more or fewer components shown, or having the same Figure 1 The different configurations shown are illustrated.

[0049] The memory 104 can be used to store computer programs, such as application software programs and modules, like the computer program corresponding to the dynamic rule protection method of the network application firewall in this embodiment. The processor 102 executes various functional applications and data processing by running the computer program stored in the memory 104, thereby implementing the above-described method. The memory 104 may include high-speed random access memory, and may also include non-volatile memory, such as one or more magnetic storage devices, flash memory, or other non-volatile solid-state memory. In some instances, the memory 104 may further include memory remotely located relative to the processor 102, and these remote memories can be connected to the terminal via a network. Examples of such networks include, but are not limited to, the Internet, corporate intranets, local area networks, mobile communication networks, and combinations thereof.

[0050] The transmission device 106 is used to receive or send data via a network. This network includes a wireless network provided by the terminal's communication provider. In one example, the transmission device 106 includes a Network Interface Controller (NIC), which can connect to other network devices via a base station to communicate with the Internet. In another example, the transmission device 106 can be a Radio Frequency (RF) module used for wireless communication with the Internet.

[0051] This embodiment provides a dynamic rule-based protection method for network application firewalls. Figure 2 This is a flowchart illustrating the dynamic rule protection method of the network application firewall in this embodiment, as shown below. Figure 2 As shown, the process includes the following steps:

[0052] Step S210: Obtain the access request and the source address of the access request.

[0053] Specifically, a network application firewall is deployed outside the web site server. HTTP requests from internet clients first pass through the network application firewall, which then obtains the HTTP request and the source IP address that generated it.

[0054] Step S220: Obtain the credibility label of the source address based on the preset address label table.

[0055] Specifically, there are three types of trust labels: "high trust label," "medium trust label," and "low trust label." The "medium trust label" has a higher security level than the "low trust label," and the "high trust label" has a higher security level than the "medium trust label." Each source address corresponds to a trust label to reflect its security. The mapping between source addresses and their corresponding trust labels is stored in an address label table. By querying a source address, the trust label corresponding to that source address can be obtained.

[0056] Step S230: Based on the trust label of the source address, select the corresponding rule group from the preset network application firewall rule group, and use the rule group to detect the access request to obtain the detection result.

[0057] Specifically, the preset network application firewall rule groups include a first rule group and a second rule group. Each rule group contains several protection rules, but the first rule group has stricter detection requirements than the second. If the source address's trust label is "low trust label" or "medium trust label," the access request from that source address is sent to the first rule group for security detection; if the source address's trust label is "high trust label," the access request is sent to the second rule group for security detection. This ensures that request messages corresponding to lower security levels ("low trust label" or "medium trust label") are fully inspected, while request messages corresponding to higher security levels ("high trust label") are only inspected using some key rules, saving computing resources and improving detection speed.

[0058] Step S240: If the detection result is successful, then access the target address through an access request.

[0059] Specifically, if no network attack behavior is detected in the detection results, the access to the target address will proceed as planned; if a network attack behavior is detected in the detection results, the access request will be blocked.

[0060] In the aforementioned dynamic rule protection method of the network application firewall, the compliance of the client's access request is initially judged by obtaining the trustworthiness label of the source address of the access request. Then, the network application firewall rule group corresponding to the trustworthiness label is used to perform a security test of the access request at the corresponding level. Only when the test result is passed can the target address be accessed. This achieves dynamic protection for each access request, reduces the operating pressure of the network application firewall itself, avoids the security detection engine capability occupying device performance for a long time, and greatly ensures the smooth continuity of network access services.

[0061] In one embodiment, based on step S220 above, the credibility tag of the source address is obtained based on a preset address tag table, which may specifically include the following steps:

[0062] Step S221: Search for the source address in the preset address label table.

[0063] Specifically, there are three types of trust labels: "high trust label", "medium trust label" and "low trust label". Each known source address is assigned a trust label, and the known source addresses and their trust labels are stored in the address label table in a one-to-one correspondence.

[0064] Step S222: If the source address has a record in the pre-stored address label table, obtain the source address's credibility label from the record.

[0065] Step S223: If the source address is not recorded in the address label table, then assign the first label to the source address; wherein, the first label is the label with the lowest credibility among the credibility labels.

[0066] Specifically, if a source address appears for the first time and there is no record in the address label table, the source address is assigned a "low confidence label". The newly appearing source address and its confidence label are then added to the address label table.

[0067] In this embodiment, the credibility tag of the source address is queried by checking the record of the source address in the address tag table. If there is no record, the tag with the lowest credibility can be assigned, thereby comprehensively covering all the obtained source addresses and realizing the automatic judgment of the threat level of the source address.

[0068] In one embodiment, based on step S230 above, based on the trustworthiness label of the source address, a corresponding rule group is selected from a preset network application firewall rule group, and the access request is detected using the rule group to obtain the detection result. Specifically, this may include the following steps:

[0069] Step S231: The credibility labels include first-tier labels and second-tier labels; wherein, the credibility of the first-tier labels is lower than that of the second-tier labels; the first-tier labels include low-credibility labels and medium-credibility labels; the second-tier labels include high-credibility labels.

[0070] The security of low-confidence tags, medium-confidence tags, and high-confidence tags increases sequentially.

[0071] Step S232: The preset network application firewall rule groups include a first rule group and a second rule group; wherein, the protection level of the first rule group is higher than that of the second rule group.

[0072] Specifically, two sets of rules are pre-set, with different numbers and types of protection rules enabled in each set.

[0073] Step S233: If the credibility label of the source address is a first-tier label, then the access request is detected using the first rule group to obtain the first detection result.

[0074] Step S234: If the credibility label of the source address is a second-tier label, then the access request is detected using the second rule group to obtain the second detection result.

[0075] Specifically, when the source address corresponds to a low-confidence or medium-confidence label, the first rule group is used to detect the access request; when the source address corresponds to a high-confidence label, the second rule group is used to detect the access request.

[0076] In this embodiment, when the source address is under different tag states, it is detected by the corresponding rule group. Instead of determining multiple rule groups based on the address of the network application (i.e. the target address), only two rule groups are pre-set, which can realize the detection of all access requests. This reduces the cost of manually surveying and planning multiple rule groups and improves the operational efficiency of staff.

[0077] In one embodiment, the dynamic rule protection method of the network application firewall described above further includes the following steps:

[0078] Step S250: If the detection result does not meet the dynamic update conditions, then retain the current correspondence between the source address and the credibility label in the address label table.

[0079] The dynamic update conditions can be configured with different update rules based on different trust labels. Specifically, the dynamic update conditions include a first dynamic update condition and a second dynamic update condition. The first dynamic update condition has a built-in observation period and only applies to low-trust and medium-trust labels. If an access request from a source address with a low-trust or medium-trust label is not detected as a network attack within the observation period, the first dynamic update condition is satisfied. The second dynamic update condition does not have an observation period and only applies to high-trust labels. If an access request from a source address with a high-trust label is detected as a network attack, the second dynamic update condition is satisfied.

[0080] Step S260: If the detection result meets the dynamic update conditions, change the confidence label corresponding to the source address and modify the address label table accordingly.

[0081] Specifically, if the first or second dynamic update condition is met, the credibility tag of the corresponding source address will be adjusted.

[0082] In this embodiment, the security level of the source address is promptly fed back based on the detection results, and the reliability of the compliance detection of access requests is ensured through closed-loop adjustment.

[0083] In one embodiment, based on step S260 above, if the detection result meets the dynamic update condition, the confidence label corresponding to the source address is modified, and the address label table is modified accordingly. Specifically, this may include the following steps:

[0084] Step S261: When the first detection result is obtained, if there is no network attack behavior in the first detection result during the observation period, the first echelon label corresponding to the source address is changed.

[0085] Specifically, according to step S233 above, the first detection result is the detection result output by the first rule group. When the first rule group is used to detect access requests corresponding to low-confidence tags, if its first detection result shows no network attack behavior during the observation period, the corresponding source address is modified from the low-confidence tag to the medium-confidence tag; when the first rule group is used to detect access requests corresponding to medium-confidence tags, if its first detection result shows no network attack behavior during the observation period, the corresponding source address is modified from the medium-confidence tag to the high-confidence tag.

[0086] Specifically, upon receiving the first detection result, if network attack behavior is detected within the observation period, the observation period is restarted, and the correspondence between the source address and the current first-tier label is retained. The observation period is at least one consecutive calendar day, and a calendar day is counted only if the source address generates at least one access request on that day. The observation period for changing a low-confidence label to a medium-confidence label and the observation period for changing a medium-confidence label to a high-confidence label can be set by the user as needed; they can be set to the same period or different periods.

[0087] Step S262: When the second detection result is obtained, if the second detection result indicates a network attack, the second-tier label corresponding to the source address is changed to the first-tier label.

[0088] Specifically, according to step S234 above, the second detection result is the detection result output by the second rule group. The second rule group is used to detect access requests corresponding to high confidence labels. Therefore, there is no need to set an observation period for its second detection result. Once a network attack is detected, the high confidence label of the corresponding source address is modified to a low confidence label.

[0089] Step S263: Modify the address label table based on the changed correspondence between the source address and the first-tier label or the second-tier label.

[0090] In this embodiment, by setting an observation period, the tags of the source addresses corresponding to the first-tier tags are updated, thereby improving the accuracy of the relationship between the source addresses and the credibility tags.

[0091] The present embodiment will now be described and illustrated through preferred embodiments.

[0092] Figure 3 This is a flowchart of the dynamic rule protection method of the network application firewall according to this preferred embodiment. Figure 3 As shown, this preferred embodiment includes the following steps:

[0093] Step S310: Perform security checks on the access request.

[0094] Step S320: If the detection result is successful, then access the target address through an access request.

[0095] This preferred embodiment further includes specific implementation steps for performing security checks on access requests in step S310. For example... Figure 4 As shown, step S310 involves performing a security check on the access request, including the following steps:

[0096] Step S410: Obtain the access request and the source address of the access request.

[0097] Step S420: Label allocation and detection processing.

[0098] Specifically, based on a preset address label table, the credibility label of the source address is obtained. Among them, there are three types of credibility labels: "high credibility label", "medium credibility label" and "low credibility label".

[0099] Specifically, based on the source address's trust label, a corresponding rule group is selected from the preset network application firewall rule groups, and the access request is detected using the rule group to obtain the detection result. The preset network application firewall rule groups include a first rule group and a second rule group. If the source address's trust label is a "low trust label" or a "medium trust label," the access request originating from that source address is sent to the first rule group for security detection; if the source address's trust label is a "high trust label," the access request originating from that source address is sent to the second rule group for security detection.

[0100] Step S430: Credibility statistics and updates.

[0101] Specifically, if the detection results of the rule group meet the dynamic update conditions, the credibility label corresponding to the source address is changed, and the address label table is modified accordingly.

[0102] Among them, the dynamic update conditions can be set with different update rules according to different credibility tags.

[0103] For low-confidence tags, if no network attack is detected in the access request corresponding to the low-confidence tag during the observation period, the corresponding source address will be changed from a low-confidence tag to a medium-confidence tag. For medium-confidence tags, if no network attack is detected in the access request corresponding to the medium-confidence tag during the observation period, the corresponding source address will be changed from a medium-confidence tag to a high-confidence tag. If a network attack occurs during the observation period in either of the above two cases, the observation period will be restarted.

[0104] For high-confidence tags, no observation period is set. Once a network attack is detected, the high-confidence tag of the corresponding source address is changed to a low-confidence tag.

[0105] In this preferred embodiment, by obtaining the trustworthiness label of the source address of the access request, a preliminary judgment is made on the compliance of the client's access request. Then, the network application firewall rule group corresponding to the trustworthiness label is used to perform a corresponding level of security detection on the access request. Only when the detection result is passed can the target address be accessed, thereby achieving a dynamic protection effect for each access request, reducing the operating pressure of the network application firewall itself, avoiding the long-term occupation of device performance by the security detection engine, and greatly ensuring the smooth continuity of access to network services.

[0106] It should be understood that although the steps in the flowcharts of the above embodiments are shown sequentially according to the arrows, these steps are not necessarily executed in the order indicated by the arrows. Unless explicitly stated herein, there is no strict order restriction on the execution of these steps, and they can be executed in other orders. Moreover, at least some steps in the flowcharts of the above embodiments may include multiple steps or multiple stages. These steps or stages are not necessarily completed at the same time, but can be executed at different times. The execution order of these steps or stages is not necessarily sequential, but can be performed alternately or in turn with other steps or at least some of the steps or stages of other steps.

[0107] Based on the same inventive concept, this embodiment also provides a dynamic rule protection device for a network application firewall. This system is used to implement the above embodiments and preferred embodiments, and details already described will not be repeated. The terms "module," "unit," "subunit," etc., used below can refer to combinations of software and / or hardware that achieve a predetermined function. Although the system described in the following embodiments is preferably implemented in software, hardware implementation, or a combination of software and hardware, is also possible and contemplated.

[0108] In one embodiment, such as Figure 5 As shown, a dynamic rule protection device for a network application firewall is provided, including: a request acquisition module 51, a tag acquisition module 52, a rule group detection module 53, and an access target address module 54, wherein:

[0109] The request acquisition module 51 is used to acquire the access request and the source address of the access request;

[0110] The tag acquisition module 52 is used to acquire the credibility tag of the source address based on a preset address tag table;

[0111] The rule group detection module 53 is used to select the corresponding rule group from the preset network application firewall rule groups based on the trustworthiness label of the source address, and use the rule group to detect the access request and obtain the detection result.

[0112] The target address access module 54 is used to access the target address via an access request if the detection result is successful.

[0113] In one embodiment, the tag acquisition module 52 is further configured to search for the source address in a preset address tag table; if the source address has a record in the pre-stored address tag table, the credibility tag of the source address is obtained from the record.

[0114] In one embodiment, the tag acquisition module 52 is further configured to assign a first tag to the source address if the source address is not recorded in the address tag table; wherein the first tag is the tag with the lowest credibility among the credibility tags.

[0115] In one embodiment, the rule group detection module 53 is further configured to include a first-tier label and a second-tier label in the credibility label; wherein the credibility of the first-tier label is lower than that of the second-tier label; the first-tier label includes low-credibility labels and medium-credibility labels; the second-tier label includes high-credibility labels; the preset network application firewall rule group includes a first rule group and a second rule group; wherein the protection strictness of the first rule group is higher than that of the second rule group; if the credibility label of the source address is a first-tier label; then the access request is detected using the first rule group to obtain a first detection result; if the credibility label of the source address is a second-tier label; then the access request is detected using the second rule group to obtain a second detection result.

[0116] In one embodiment, the dynamic rule protection method of the network application firewall further includes a dynamic update module. The dynamic update module is used to retain the current correspondence between the source address and the trust label in the address label table if the detection result does not meet the dynamic update conditions; and to change the trust label corresponding to the source address and modify the address label table accordingly if the detection result meets the dynamic update conditions.

[0117] In one embodiment, the dynamic update module is further configured to, when a first detection result is obtained, if there is no network attack behavior in the first detection result during the observation period, change the first echelon label corresponding to the source address; when a second detection result is obtained, if there is network attack behavior in the second detection result, change the second echelon label corresponding to the source address to the first echelon label; and modify the address label table based on the changed correspondence between the source address and the first echelon label or the second echelon label.

[0118] In one embodiment, the dynamic update module is further configured to, when the first detection result is obtained, if the first detection result shows network attack behavior during the observation period, recalculate the observation period and retain the correspondence between the source address and the current first-tier label; if the first detection result does not show network attack behavior during the observation period, change the first-tier label corresponding to the source address.

[0119] The modules in the dynamic rule protection device of the aforementioned network application firewall can be implemented entirely or partially through software, hardware, or a combination thereof. These modules can be embedded in the processor of a computer device in hardware form or independent of it, or stored in the memory of the computer device in software form, so that the processor can call and execute the corresponding operations of each module.

[0120] In one embodiment, a computer device is provided, including a memory and a processor, wherein the memory stores a computer program, and the processor executes the computer program to implement the dynamic rule protection method of the network application firewall in any of the above embodiments.

[0121] In one embodiment, a computer-readable storage medium is provided having a computer program stored thereon, which, when executed by a processor, implements the dynamic rule protection method of the network application firewall in any of the above embodiments.

[0122] In one embodiment, a computer program product is provided, including a computer program that, when executed by a processor, implements the dynamic rule protection method of the network application firewall in any of the above embodiments.

[0123] It should be noted that the user information (including but not limited to user device information, user personal information, etc.) and data (including but not limited to data used for analysis, data stored, data displayed, etc.) involved in this application are all information and data authorized by the user or fully authorized by all parties.

[0124] Those skilled in the art will understand that all or part of the processes in the methods of the above embodiments can be implemented by a computer program instructing related hardware. The computer program can be stored in a non-volatile computer-readable storage medium, and when executed, it can include the processes of the embodiments of the above methods. Any references to memory, databases, or other media used in the embodiments provided in this application can include at least one of non-volatile and volatile memory. Non-volatile memory can include read-only memory (ROM), magnetic tape, floppy disk, flash memory, optical memory, high-density embedded non-volatile memory, resistive random access memory (ReRAM), magnetic random access memory (MRAM), ferroelectric random access memory (FRAM), phase change memory (PCM), graphene memory, etc. Volatile memory can include random access memory (RAM) or external cache memory, etc. By way of illustration and not limitation, RAM can take many forms, such as Static Random Access Memory (SRAM) or Dynamic Random Access Memory (DRAM). The databases involved in the embodiments provided in this application may include at least one type of relational database and non-relational database. Non-relational databases may include, but are not limited to, blockchain-based distributed databases. The processors involved in the embodiments provided in this application may be general-purpose processors, central processing units, graphics processing units, digital signal processors, programmable logic devices, quantum computing-based data processing logic devices, etc., and are not limited to these.

[0125] The technical features of the above embodiments can be combined in any way. For the sake of brevity, not all possible combinations of the technical features in the above embodiments are described. However, as long as there is no contradiction in the combination of these technical features, they should be considered to be within the scope of this specification.

[0126] The embodiments described above are merely illustrative of several implementation methods of this application, and while the descriptions are specific and detailed, they should not be construed as limiting the scope of this patent application. It should be noted that those skilled in the art can make various modifications and improvements without departing from the concept of this application, and these all fall within the protection scope of this application. Therefore, the protection scope of this application should be determined by the appended claims.

Claims

1. A dynamic rule-based protection method for network application firewalls, characterized in that, The method includes: Obtain the access request and the source address of the access request; Based on a preset address label table, the credibility label of the source address is obtained; wherein, the credibility label includes a first tier label and a second tier label; the credibility of the first tier label is lower than that of the second tier label; the first tier label includes low credibility label and medium credibility label; the second tier label includes high credibility label; Based on the trustworthiness label of the source address, a corresponding rule group is selected from the preset network application firewall rule group, and the access request is detected using the rule group to obtain the detection result; The preset network application firewall rule group includes a first rule group and a second rule group; the first rule group has a higher level of protection than the second rule group. If the credibility tag of the source address is the first tier tag, then the access request is detected using the first rule group to obtain a first detection result; the first detection result is used as the detection result. If the credibility label of the source address is the second tier label, then the access request is detected using the second rule group to obtain a second detection result; the second detection result is used as the detection result. If the detection result is successful, the target address is accessed through the access request.

2. The dynamic rule protection method for network application firewalls according to claim 1, characterized in that, The process of obtaining the credibility tag of the source address based on a preset address tag table includes: Search the source address in the preset address label table; If the source address has a record in the pre-stored address label table, obtain the credibility label of the source address from the record.

3. The dynamic rule protection method for network application firewalls according to claim 2, characterized in that, After searching for the source address in the preset address label table, the method further includes: If the source address is not recorded in the address label table, then the source address is assigned a first label; wherein the first label is the label with the lowest credibility among the credibility labels.

4. The dynamic rule protection method for network application firewalls according to claim 3, characterized in that, Also includes: If the detection result does not meet the dynamic update conditions, the current correspondence between the source address and the credibility label is retained in the address label table; If the detection result meets the dynamic update condition, then the credibility label corresponding to the source address is changed, and the address label table is modified accordingly.

5. The dynamic rule protection method for network application firewalls according to claim 4, characterized in that, If the detection result meets the dynamic update condition, then the confidence tag corresponding to the source address is modified, and the address tag table is modified accordingly, including: When the first detection result is obtained, if there is no network attack behavior in the first detection result during the observation period, the first echelon label corresponding to the source address will be changed; When the second detection result is obtained, if the second detection result indicates network attack behavior, the second echelon label corresponding to the source address is changed to the first echelon label; Based on the changed correspondence between the source address and the first echelon label or the second echelon label, the address label table is modified.

6. The dynamic rule protection method for network application firewalls according to claim 5, characterized in that, When the first detection result is obtained, if there is no network attack behavior during the observation period, the first-tier label corresponding to the source address is changed, including: When the first detection result is obtained, if the first detection result shows network attack behavior during the observation period, the observation period is recalculated, and the correspondence between the source address and the current first-tier label is retained; If the first detection result does not show any network attack behavior during the observation period, the first-tier label corresponding to the source address will be changed.

7. A dynamic rule protection device for a network application firewall, characterized in that, The device includes: The request acquisition module is used to acquire the access request and the source address of the access request; The tag acquisition module is used to acquire the credibility tags of the source address based on a preset address tag table; wherein, the credibility tags include first-tier tags and second-tier tags; the credibility of the first-tier tags is lower than that of the second-tier tags; the first-tier tags include low-credibility tags and medium-credibility tags; the second-tier tags include high-credibility tags; The rule group detection module is used to select a corresponding rule group from a preset network application firewall rule group based on the trustworthiness label of the source address, and use the rule group to detect the access request to obtain the detection result; The preset network application firewall rule group includes a first rule group and a second rule group; the first rule group has a higher level of protection than the second rule group. If the credibility tag of the source address is the first tier tag, then the access request is detected using the first rule group to obtain a first detection result; the first detection result is used as the detection result. If the credibility label of the source address is the second tier label, then the access request is detected using the second rule group to obtain a second detection result; the second detection result is used as the detection result. The target address access module is used to access the target address through the access request if the detection result is successful.

8. A computer device comprising a memory and a processor, wherein the memory stores a computer program, characterized in that, When the processor executes the computer program, it implements the steps of the method according to any one of claims 1 to 6.

9. A computer-readable storage medium having a computer program stored thereon, characterized in that, When the computer program is executed by a processor, it implements the steps of the method according to any one of claims 1 to 6.

Images