A vulnerability defense method, device, system and storage medium

Abstract

The application discloses a vulnerability defense method, device, system and storage medium, relates to the technical field of information security, and can reduce deployment cost and further reduce vulnerability detection and defense cost while guaranteeing network communication. The specific scheme comprises the following steps: loading a plurality of pre-stored vulnerability detection components, wherein the vulnerability detection components are obtained by splitting expressions corresponding to vulnerability detection rules according to corresponding logical relationships; receiving a request message forwarded by a switch; matching the request message with the vulnerability detection components to obtain a matching result corresponding to each vulnerability detection component; performing synthetic processing on each matching result according to a logical relationship of the corresponding vulnerability detection rule to obtain a target matching result; if the target matching result indicates that the request message hits at least one vulnerability detection rule, generating a blocking message, and sending the blocking message to a server and a client, so that the server or the client blocks the request message based on the blocking message.

Description

Technical Field

[0001] This application relates to the field of information security technology, and in particular to a vulnerability defense method, device, system and storage medium. Background Technology

[0002] With the diversification of applications and the industrialization of vulnerabilities, the number of vulnerabilities worldwide continues to grow rapidly, and cybersecurity is currently facing a severe vulnerability crisis. In the daily security operations of enterprises, combating and managing vulnerability attacks has long been a challenge for administrators. The increasing severity of vulnerabilities ultimately stems from the existence of system vulnerabilities and their malicious exploitation by attackers. Vulnerability scanning equipment allows users to clearly understand which vulnerabilities exist in their IT systems, but most enterprises are unable to patch these vulnerabilities; even for vulnerabilities proven to pose significant risks, the patching rate is less than 20%. Faced with the risks of vulnerability patching gaps, the risk of patching critical business vulnerabilities, the lack of updates to patches for legacy systems, and regulatory compliance checks, the traditional approach of relying on vulnerability scanning to discover vulnerabilities and patching corresponding vulnerabilities is no longer sufficient to address the constantly emerging new problems. However, if effective means can be used to accurately, quickly, and conveniently detect and block vulnerability exploitation attempts, vulnerability exploitation can essentially be rendered ineffective.

[0003] Currently, vulnerability detection and defense are mainly carried out by deploying vulnerability defense devices such as intrusion detection systems, intrusion prevention systems, and firewalls in series in the network. However, this approach changes the existing network topology, and hardware and software failures of these vulnerability defense devices may affect normal network communication. In addition, the deployment cost is high, resulting in high costs for vulnerability detection and defense. Summary of the Invention

[0004] This application provides a vulnerability defense method, device, system, and storage medium that can reduce deployment costs, thereby reducing vulnerability detection and defense costs, without affecting network communication.

[0005] To achieve the above objectives, this application adopts the following technical solution:

[0006] In a first aspect, this application provides a vulnerability defense method applied to a vulnerability defense system. The vulnerability defense system includes: a client, a switch, a server, and an electronic device. The electronic device is communicatively connected to the server and the switch, respectively. The switch is used to forward request messages sent by the client to the server and the electronic device, respectively. The method includes:

[0007] The electronic device loads multiple pre-stored vulnerability detection components. Each vulnerability detection component is obtained by splitting the expression corresponding to each vulnerability detection rule according to the corresponding logical relationship.

[0008] Receive request packets forwarded by the switch, match the request packets with each vulnerability detection component, and obtain the matching result corresponding to each vulnerability detection component;

[0009] Each matching result is synthesized according to the logical relationship of the corresponding vulnerability detection rules to obtain the target matching result;

[0010] If the target matching result indicates that the request message matches at least one vulnerability detection rule, a blocking message is generated and sent to the server and client so that the server or client can block the request message based on the blocking message.

[0011] In one possible implementation, before the electronic device loads multiple pre-stored vulnerability detection components, the method further includes:

[0012] Obtain multiple vulnerability detection rules, split each vulnerability detection rule into multiple vulnerability detection components based on the logical relationship between the expressions of the vulnerability detection rules, and store multiple vulnerability detection components.

[0013] In one possible implementation, after obtaining the target matching result, the method further includes:

[0014] If the target matching result indicates that the request message does not match a vulnerability detection rule, the request message will be sent to the preset network threat detection engine for vulnerability detection to obtain the detection result;

[0015] If the detection result indicates that the request message has a vulnerability, a blocking message is generated and sent to the server and client so that the server or client can block the request message based on the blocking message;

[0016] Based on the request object of the request message, or based on the frequency with which the vulnerability is detected in the client address corresponding to the request message, determine whether to add the client address to the preset blacklist.

[0017] In one possible implementation, the blacklist includes multiple preset device address information, and the method further includes: [Further details about the method would be needed here, but the context is unclear.]

[0018] The client address is matched with the device address information in the blacklist. If a matching device address is found, a blocking message is generated and sent to the server and the client so that the server or the client can block the request message based on the blocking message.

[0019] In one possible implementation, after matching the client address with the device address information in the blacklist, the method further includes:

[0020] If the client address does not match the device address, the client address will be matched with the preset protection list. The protection list includes multiple protected device addresses, which are used to indicate device addresses with vulnerability risks.

[0021] If the client address matches the protection device address, the electronic device loads multiple pre-stored vulnerability detection components.

[0022] In one possible implementation, the electronic device includes a network interface card (NIC) and a vulnerability detection program that receives request messages forwarded by the switch, including:

[0023] The vulnerability detection program reads request packets in batches from the network interface card (NIC) based on the polling mode driven mechanism in the data plane development kit of the electronic device.

[0024] In one possible implementation, the electronic device includes a multi-core processor that matches request messages with various vulnerability detection components, including:

[0025] Based on a multi-core processor, the multi-core processing mechanism allows each processor core to simultaneously match the request message with one of multiple vulnerability detection components.

[0026] In a second aspect of this application, an electronic device is provided, including a memory and a processor. The memory stores a computer program, and when the computer program is executed by the processor, it implements the vulnerability defense method in the first aspect of this application.

[0027] A third aspect of this application provides a vulnerability defense system, which includes: a client, a switch, a server, and an electronic device;

[0028] Switches are used to forward request messages sent by clients to servers and electronic devices respectively;

[0029] The electronic device is used to execute the vulnerability defense method in the first aspect of the embodiments of this application.

[0030] A fourth aspect of this application provides a computer-readable storage medium having a computer program stored thereon, wherein the computer program, when executed by a processor, implements the vulnerability defense method of the first aspect of this application.

[0031] The beneficial effects of the technical solutions provided in this application include at least the following:

[0032] This application provides a vulnerability defense method applied to a vulnerability defense system. The vulnerability defense system includes a client, a switch, a server, and an electronic device. The electronic device is communicatively connected to the server and the switch, respectively. The switch forwards request packets sent by the client to the server and the electronic device. The electronic device loads multiple pre-stored vulnerability detection components. Each vulnerability detection component is obtained by decomposing the expression corresponding to each vulnerability detection rule according to its logical relationship. The electronic device receives the request packets forwarded by the switch and matches them with each vulnerability detection component to obtain a matching result for each component. The electronic device synthesizes each matching result according to the logical relationship of the corresponding vulnerability detection rule to obtain a target matching result. If the target matching result indicates that the request packet hits at least one vulnerability detection rule, a blocking message is generated and sent to the server and the client, so that the server or client blocks the request packet based on the blocking message. The vulnerability defense method provided in this application reduces deployment and vulnerability defense costs by deploying the electronic device outside the server and using it for bypass blocking, thus ensuring that network communication is not affected. Furthermore, by matching the request packet with the vulnerability detection components to determine the vulnerability detection result, vulnerability detection efficiency can be improved. Attached Figure Description

[0033] Figure 1 This application provides a structural diagram of a vulnerability defense system according to an embodiment of the present application.

[0034] Figure 2 A flowchart illustrating a vulnerability defense method provided in an embodiment of this application;

[0035] Figure 3 This is a schematic diagram of the internal structure of an electronic device provided in an embodiment of this application. Detailed Implementation

[0036] The technical solutions of the embodiments of this application will be clearly and completely described below with reference to the accompanying drawings. Obviously, the described embodiments are only some embodiments of this application, and not all embodiments. Based on the embodiments of this application, all other embodiments obtained by those of ordinary skill in the art without creative effort are within the scope of protection of this application.

[0037] Hereinafter, the terms "first" and "second" are used for descriptive purposes only and should not be construed as indicating or implying relative importance or implicitly specifying the number of indicated technical features. Thus, a feature defined as "first" or "second" may explicitly or implicitly include one or more of that feature. In the description of embodiments of this disclosure, unless otherwise stated, "a plurality of" means two or more.

[0038] In addition, the use of “based on” or “according to” implies openness and inclusivity, because processes, steps, calculations or other actions “based on” or “according to” one or more conditions or values ​​can in practice be based on additional conditions or values ​​beyond those conditions.

[0039] With the diversification of applications and the industrialization of vulnerabilities, the number of vulnerabilities worldwide continues to grow rapidly, and cybersecurity is currently facing a severe vulnerability crisis. In the daily security operations of enterprises, combating and managing vulnerability attacks has long been a challenge for administrators. The increasing severity of vulnerabilities ultimately stems from the existence of system vulnerabilities and their malicious exploitation by attackers. Vulnerability scanning equipment allows users to clearly understand which vulnerabilities exist in their IT systems, but most enterprises are unable to patch these vulnerabilities; even for vulnerabilities proven to pose significant risks, the patching rate is less than 20%. Faced with the risks of vulnerability patching gaps, the risk of patching critical business vulnerabilities, the lack of updates to patches for legacy systems, and regulatory compliance checks, the traditional approach of relying on vulnerability scanning to discover vulnerabilities and patching corresponding vulnerabilities is no longer sufficient to address the constantly emerging new problems. However, if effective means can be used to accurately, quickly, and conveniently detect and block vulnerability exploitation attempts, vulnerability exploitation can essentially be rendered ineffective.

[0040] Currently, vulnerability detection and defense are mainly carried out by deploying vulnerability defense devices such as intrusion detection systems, intrusion prevention systems, and firewalls in series in the network. However, this approach changes the existing network topology, and hardware and software failures of these vulnerability defense devices may affect normal network communication. In addition, the deployment cost is high, resulting in high costs for vulnerability detection and defense.

[0041] This application provides a vulnerability defense method. By deploying electronic devices outside the server in a bypass manner and using the electronic devices for bypass blocking, deployment costs and vulnerability defense costs are reduced without affecting network communication. In addition, vulnerability detection efficiency can be improved by matching request messages with vulnerability detection components to determine vulnerability detection results.

[0042] like Figure 1As shown in the embodiment of this application, the vulnerability defense method is applied to a vulnerability defense system. The system includes a client 10, a switch 20, a server 30, and an electronic device 40. The electronic device 40 is communicatively connected to both the server 30 and the switch 20. The client 10 sends a request message to the switch 20. The switch 20 forwards the request message sent by the client 10 to the server 30 and sends a mirror image of the request message to the electronic device 40. The electronic device 40 performs vulnerability detection on the request message. If the electronic device 40 detects a vulnerability in the request message, it generates a blocking message and sends it to both the server 30 and the client 10. The server 30 or the client 10 blocks the request message based on the blocking message to achieve the purpose of vulnerability defense. If the electronic device 40 does not detect a vulnerability in the request message, it generates a notification message and sends it to the server 30. After receiving the notification message, the server 30 executes the request message and obtains the execution result, which is then sent to the client 10.

[0043] Based on such Figure 1 The vulnerability defense system shown in this application provides a vulnerability defense method, such as... Figure 2 As shown, the method includes:

[0044] Step 201: The electronic device loads multiple pre-stored vulnerability detection components. The vulnerability detection components are obtained by splitting the expressions corresponding to each vulnerability detection rule according to the corresponding logical relationship.

[0045] Optionally, before performing step 201, the method further includes: obtaining multiple vulnerability detection rules, splitting each vulnerability detection rule into multiple vulnerability detection components according to the logical relationship between the expressions of the vulnerability detection rules, and storing the multiple vulnerability detection components.

[0046] In actual execution, vulnerability detection rules can be in JSON format. Each rule consists of a set of expressions with predefined logical relationships (supporting AND, OR, NOT, and parentheses) (expressions support regular expressions, strings, and hexadecimal). By analyzing the logical relationships between each rule, the expression corresponding to each rule is decomposed into multiple vulnerability detection components. Each component is a time-independent expression, allowing for parallel matching during the matching process.

[0047] It should be noted that the above vulnerability detection rules are frequently used vulnerability detection rules, and the protocols supported by these vulnerability detection rules are protocols with high usage frequency.

[0048] Optionally, the blacklist includes multiple preset device address information. Before and after the electronic device loads multiple pre-stored vulnerability detection components, the method further includes: matching the client address with the device address information in the blacklist; if a matching device address is found, a blocking message is generated and sent to the server and client, so that the server or client can block the request message based on the blocking message. Furthermore, when a matching device address is found, the electronic device will also generate a prompt message to alert the administrator that the request message contains a vulnerability.

[0049] In actual execution, after receiving a request message, the electronic device parses the network layer header of the request message to obtain the source IP, destination IP, source port, destination port transport protocol, and payload information. Specifically, it checks whether the source IP matches a blacklist. If it does, a blocking message is constructed. It should be noted that the construction of the blocking message is based on the protocol type. For example, if the transport layer protocol is TCP, a TCP REST message is constructed; for other protocols, an ICMP Destination Unreachable message is constructed for blocking, and a notification message is sent to the administrator.

[0050] Optionally, after matching the client address with device address information in the blacklist, the method further includes: if the client address does not match a device address, then matching the client address with a preset protection list, which includes multiple protected device addresses used to indicate device addresses with vulnerability risks; if the client address matches a protected device address, then the electronic device loads multiple pre-stored vulnerability detection components. If the client address does not match a protected device address, then a notification message is generated and sent to the server. After receiving the notification message, the server executes the request message and obtains the execution result, and then sends the execution result to the client.

[0051] The protection list is a list of protected device IP addresses and ports, which are derived from vulnerability reports generated by vulnerability scanning tools.

[0052] Step 202: Receive the request message forwarded by the switch, match the request message with each vulnerability detection component, and obtain the matching result corresponding to each vulnerability detection component.

[0053] Optionally, the electronic device includes a network interface card (NIC) and a vulnerability detection program, which receive request packets forwarded by the switch, including:

[0054] The vulnerability detection program reads request packets in batches from the network interface card (NIC) based on the polling mode driven mechanism in the data plane development kit of the electronic device.

[0055] The Poll Mode Driver (PMD) mechanism in the Data Plane Development Kit (DPDK) reads packets from the network card in a zero-copy manner. Since PMD bypasses the operating system kernel protocol stack and communicates directly with the network card, it reduces the number of context switches between user mode and kernel mode, thereby achieving lower latency and higher throughput.

[0056] Optionally, the electronic device includes a multi-core processor that matches request messages with various vulnerability detection components, including:

[0057] Based on a multi-core processor, the multi-core processing mechanism allows each processor core to simultaneously match the request message with one of multiple vulnerability detection components.

[0058] In actual execution, by utilizing the processor's caching mechanism, multiple request messages are processed in batches each time. The request messages that are about to be processed (in terms of time or space) are prefetched into the processor's cache, which greatly reduces the processing time of a single request message and improves performance.

[0059] Step 203: Combine each matching result according to the logical relationship of the corresponding vulnerability detection rules to obtain the target matching result.

[0060] Optionally, after obtaining the target matching result, the method further includes: if the target matching result indicates that the request message does not match a vulnerability detection rule, then the request message is sent to a preset network threat detection engine for vulnerability detection to obtain the detection result; if the detection result indicates that the request message has a vulnerability, then a blocking message is generated and sent to the server and the client so that the server or the client blocks the request message based on the blocking message; and whether to add the client address to a preset blacklist based on the request object of the request message or the frequency of vulnerability detection of the client address corresponding to the request message.

[0061] Specifically, the process of determining whether to add a client address to a preset blacklist based on the request object of the request message or the frequency with which the client address corresponding to the request message is detected to have a vulnerability is as follows: if the request object of the request message is a high-risk behavior, or if the client address of the request message is frequently detected to have a vulnerability, then the client address is added to the preset blacklist.

[0062] In addition, an alert message will be generated after the detection result indicates that the request message has a vulnerability, so as to remind the administrator that the request message has a vulnerability.

[0063] The network threat detection engine can be the Suricata detection engine, which is capable of real-time intrusion detection (IDS), inline intrusion prevention (IPS), network security monitoring (NSM), and offline pcap processing. Suricata uses a powerful and extensive rules and signature language to inspect network traffic and provides strong Lua scripting support to detect complex threats, automatically detecting application protocols.

[0064] Step 204: If the target matching result indicates that the request message hits at least one vulnerability detection rule, a blocking message is generated and sent to the server and client so that the server or client can block the request message based on the blocking message.

[0065] This application provides a vulnerability defense method applied to a vulnerability defense system. The vulnerability defense system includes a client, a switch, a server, and an electronic device. The electronic device is communicatively connected to the server and the switch, respectively. The switch forwards request packets sent by the client to the server and the electronic device. The electronic device loads multiple pre-stored vulnerability detection components. Each vulnerability detection component is obtained by decomposing the expression corresponding to each vulnerability detection rule according to its logical relationship. The electronic device receives the request packets forwarded by the switch and matches them with each vulnerability detection component to obtain a matching result for each component. The electronic device synthesizes each matching result according to the logical relationship of the corresponding vulnerability detection rule to obtain a target matching result. If the target matching result indicates that the request packet hits at least one vulnerability detection rule, a blocking message is generated and sent to the server and the client, so that the server or client blocks the request packet based on the blocking message. The vulnerability defense method provided in this application reduces deployment and vulnerability defense costs by deploying the electronic device outside the server and using it for bypass blocking, thus ensuring that network communication is not affected. Furthermore, by matching the request packet with the vulnerability detection components to determine the vulnerability detection result, vulnerability detection efficiency can be improved.

[0066] Furthermore, the vulnerability defense method provided in this application can block connections in real time, detect vulnerability exploitation behavior, and immediately prevent it, thereby minimizing security risks and losses. By fully utilizing the performance advantages of data processing and Suricata's support for application protocols, the entire vulnerability detection process is divided into a two-level vulnerability detection mechanism, leveraging the strengths of each, resulting in a significant improvement in overall performance and enabling support for high-traffic business scenarios. The blocking intensity can be flexibly controlled, allowing for blocking of individual vulnerabilities or direct blocking of attacker IPs.

[0067] This application also provides a vulnerability defense system, such as... Figure 1As shown, the system includes: client 10, switch 20, server 30 and electronic device 40;

[0068] Switch 20 is used to forward request messages sent by client 10 to server 30 and electronic device 40 respectively.

[0069] Electronic device 40 is used to: load multiple pre-stored vulnerability detection components, wherein the vulnerability detection components are obtained by splitting the expressions corresponding to each vulnerability detection rule according to the corresponding logical relationship;

[0070] Receive request packets forwarded by switch 20, match the request packets with each vulnerability detection component, and obtain the matching result corresponding to each vulnerability detection component;

[0071] Each matching result is synthesized according to the logical relationship of the corresponding vulnerability detection rules to obtain the target matching result;

[0072] If the target matching result indicates that the request message hits at least one vulnerability detection rule, a blocking message is generated and sent to server 30 and client 10 so that server 30 or client 10 can block the request message based on the blocking message.

[0073] In one embodiment, the electronic device 40 is further configured to: acquire multiple vulnerability detection rules, split each vulnerability detection rule into multiple vulnerability detection components according to the logical relationship between the expressions of the vulnerability detection rules, and store the multiple vulnerability detection components.

[0074] In one embodiment, the electronic device 40 is further configured to: if the target matching result indicates that the request message does not match a vulnerability detection rule, send the request message to a preset network threat detection engine for vulnerability detection and obtain the detection result;

[0075] If the detection result indicates that the request message has a vulnerability, a blocking message is generated and sent to server 30 and client 10, so that server 30 or client 10 can block the request message based on the blocking message;

[0076] Based on the request object of the request message, or based on the frequency with which the vulnerability is detected in the client address corresponding to the request message, determine whether to add the client address to the preset blacklist.

[0077] In one embodiment, the blacklist includes multiple preset device address information, and the electronic device 40 is further used for:

[0078] The client address is matched with the device address information in the blacklist. If a matching device address is found, a blocking message is generated and sent to server 30 and client 10 so that server 30 or client 10 can block the request message based on the blocking message.

[0079] In one embodiment, the electronic device 40 is further configured to: if the client address does not match a device address, match the client address with a preset protection list, the protection list including multiple protected device addresses, the protected device address being used to indicate a device address with vulnerability risk;

[0080] If the client address matches the protection device address, the electronic device 40 loads multiple pre-stored vulnerability detection components.

[0081] In one embodiment, electronic device 40 includes a network interface card (NIC) and a vulnerability detection program, and electronic device 40 is specifically used for:

[0082] The vulnerability detection program reads request packets in batches from the network card based on the polling mode driven mechanism in the data plane development kit of the electronic device 40.

[0083] In one embodiment, the electronic device 40 includes a multi-core processor, and the electronic device 40 is specifically used for: a multi-core processing mechanism based on the multi-core processor, wherein each processor core simultaneously executes a matching of a request message with one of a plurality of vulnerability detection components.

[0084] The vulnerability defense system provided in this embodiment can execute the method embodiments described above, and its implementation principle and technical effects are similar, so they will not be repeated here. Specific limitations of the vulnerability defense system can be found in the limitations of the vulnerability defense method described above, and will not be repeated here.

[0085] The vulnerability defense method provided in this application can be implemented by an electronic device, which can be a computer device, a terminal device, a server or a server cluster. This application does not specifically limit this.

[0086] Figure 3 This is a schematic diagram of the internal structure of an electronic device provided in an embodiment of this application. Figure 3 As shown, the electronic device includes a processor and a memory connected via a system bus. The processor provides computing and control capabilities. The memory may include a non-volatile storage medium and internal memory. The non-volatile storage medium stores an operating system and computer programs. These computer programs can be executed by the processor to implement the steps of the vulnerability defense methods provided in the various embodiments above. The internal memory provides a cached runtime environment for the operating system and computer programs in the non-volatile storage medium.

[0087] Those skilled in the art will understand that Figure 3The diagram shown is an internal structure diagram of an electronic device, which is only a block diagram of a part of the structure related to the present application and does not constitute a limitation on the electronic device to which the present application is applied. A specific electronic device may include more or fewer components than shown in the figure, or combine certain components, or have different component arrangements.

[0088] In another embodiment of this application, a computer-readable storage medium is also provided, on which a computer program is stored, wherein when the computer program is executed by a processor, it implements the steps of the vulnerability defense method as described in the embodiments of this application.

[0089] In another embodiment of this application, a computer program product is also provided, which includes computer instructions that, when executed on an electronic device, cause the electronic device to perform each step of the vulnerability defense method in the method flow shown in the above method embodiment.

[0090] In the above embodiments, implementation can be achieved, in whole or in part, through software, hardware, firmware, or any combination thereof. When implemented using software programs, implementation can be, in whole or in part, in the form of a computer program product. This computer program product includes one or more computer instructions. When these computer instructions are loaded and executed on a computer, all or part of the flow or function according to the embodiments of this application is generated. The computer can be a general-purpose computer, a special-purpose computer, a computer network, or other programmable device. The computer instructions can be stored in a computer-readable storage medium or transmitted from one computer-readable storage medium to another. For example, computer instructions can be transmitted from one website, computer, server, or data center to another via wired (e.g., coaxial cable, fiber optic, digital subscriber line (DSL)) or wireless (e.g., infrared, wireless, microwave, etc.) means. The computer-readable storage medium can be any available medium accessible to a computer or a data storage device containing one or more servers, data centers, etc., that can be integrated with the medium. The available media can be magnetic media (e.g., floppy disks, hard disks, magnetic tapes), optical media (e.g., DVDs), or semiconductor media (e.g., solid-state disks, SSDs).

[0091] The technical features of the above embodiments can be combined in any way. For the sake of brevity, not all possible combinations of the technical features in the above embodiments are described. However, as long as there is no contradiction in the combination of these technical features, they should be considered to be within the scope of this specification.

[0092] The above embodiments merely illustrate several implementation methods of this application, and while the descriptions are relatively specific and detailed, they should not be construed as limiting the scope of the patent. It should be noted that those skilled in the art can make various modifications and improvements without departing from the concept of this application, and these all fall within the protection scope of this application. Therefore, the protection scope of this patent application should be determined by the appended claims.

Claims

1. A vulnerability defense method, characterized in that, An application is made in a vulnerability defense system, the vulnerability defense system comprising: a client, a switch, a server, and an electronic device, wherein the electronic device is communicatively connected to the server and the switch respectively, and the switch is used to forward request messages sent by the client to the server and the electronic device respectively, the method comprising: The electronic device loads multiple pre-stored vulnerability detection components, which are obtained by splitting the expressions corresponding to each vulnerability detection rule according to their corresponding logical relationships. Receive the request message forwarded by the switch, match the request message with each of the vulnerability detection components, and obtain the matching result corresponding to each vulnerability detection component; Each matching result is synthesized according to the logical relationship of the corresponding vulnerability detection rules to obtain the target matching result; If the target matching result indicates that the request message matches at least one of the vulnerability detection rules, a blocking message is generated and sent to the server and the client, so that the server or the client blocks the request message based on the blocking message; Before the electronic device loads the pre-stored multiple vulnerability detection components, the method further includes: Obtain multiple vulnerability detection rules, and split each vulnerability detection rule into multiple vulnerability detection components according to the logical relationship between the expressions of the vulnerability detection rules, and store multiple vulnerability detection components; The electronic device includes a multi-core processor, and the step of matching the request message with each of the vulnerability detection components includes: Based on the multi-core processing mechanism of the multi-core processor, each processor core simultaneously executes the matching of the request message with one of the multiple vulnerability detection components.

2. The method according to claim 1, characterized in that, After obtaining the target matching result, the method further includes: If the target matching result indicates that the request message does not match one of the vulnerability detection rules, the request message is sent to a preset network threat detection engine for vulnerability detection to obtain the detection result; If the detection result indicates that the request message has a vulnerability, a blocking message is generated and sent to the server and the client, so that the server or the client can block the request message based on the blocking message; Based on the request object of the request message, or based on the frequency with which the client address corresponding to the request message is detected to have a vulnerability, determine whether to add the client address to a preset blacklist.

3. The method according to claim 2, characterized in that, The blacklist includes multiple preset device address information. Before the electronic device loads multiple pre-stored vulnerability detection components, the method further includes: The client address is matched with the device address information in the blacklist. If a matching device address is found, a blocking message is generated and sent to the server and the client so that the server or the client can block the request message based on the blocking message.

4. The method according to claim 3, characterized in that, After matching the client address with the device address information in the blacklist, the method further includes: If the client address does not match a device address, the client address is matched with a preset protection list, which includes multiple protected device addresses, and the protected device addresses are used to indicate device addresses with vulnerability risks. If the client address matches the protection device address, the electronic device loads multiple pre-stored vulnerability detection components.

5. The method according to claim 1, characterized in that, The receiving of the request message forwarded by the switch includes: The electronic device runs a vulnerability detection program, which reads the request packets in batches from the network card of the electronic device based on the polling mode driven mechanism in the data plane development kit of the electronic device.

6. An electronic device, characterized in that, It includes a memory and a processor, the memory storing a computer program that, when executed by the processor, implements the vulnerability defense method according to any one of claims 1-5.

7. A vulnerability defense system, characterized in that, The system includes: a client, a switch, a server, and an electronic device; the electronic device is communicatively connected to the server and the switch respectively; the switch is used to forward request messages sent by the client to the server and the electronic device respectively. The electronic device is used to perform the vulnerability defense method according to any one of claims 1-5.

8. A computer-readable storage medium, characterized in that, It stores a computer program, which, when executed by a processor, implements the vulnerability defense method according to any one of claims 1-5.

Images