Network packet detection method and device and serial security system

Abstract

The application discloses a network data packet detection method and device and a serial security protection system, and is used for solving the problems of low efficiency, large network resource consumption and poor robustness and stability of a serial link of an existing network data packet detection method. The method is applied to a security device in a serial security protection system, the serial security protection system comprises a plurality of security devices which are sequentially connected in series, and the method comprises the following steps: acquiring identification information of a network data packet to be detected, the identification information being used for identifying a security device which has performed security detection on the network data packet in the serial security protection system; determining a detection mode for the network data packet based on the identification information, the detection mode being used for representing whether full-amount security detection is performed on the network data packet; performing security detection on the network data packet based on the detection mode to obtain a detection result; updating the identification information based on the detection result, and sending the network data packet to a next-hop security device which is adjacent to the security device in the serial security protection system.

Description

Technical Field

[0001] This application relates to the field of network security technology, and in particular to a network data packet detection method, apparatus, and serial security system. Background Technology

[0002] With the rapid growth in the number of small and medium-sized internet enterprises, external attacks on servers in the current network environment have become increasingly diversified and complex. The existing solution to this situation is to connect various types of security devices, such as Web Application Firewalls (WAFs) and firewalls, in a multi-layered protection and filtering approach. Each type of security device detects one type of security threat characteristic in network data packets, thereby achieving joint detection and defense against diverse and complex network attacks.

[0003] However, since various security devices have multiple security protection strategies, and some security devices have the same or similar security protection strategies, if a serial networking method is used, the same security monitoring items are easily monitored repeatedly in different security devices, which greatly consumes security monitoring time and network resources. In addition, the security devices in the serial link have inconsistent performance in forwarding, throughput, etc. If there is a security device with extremely low performance in the serial link, this extremely low-performance security device will become the performance bottleneck of the serial link, directly affecting the robustness and stability of the serial link. Summary of the Invention

[0004] The purpose of this application is to provide a network packet detection method, device, and serial security system to solve the problems of low efficiency, high network resource consumption, and poor robustness and stability of serial links in existing network packet detection methods.

[0005] To achieve the above objectives, the embodiments of this application adopt the following technical solutions:

[0006] In a first aspect, embodiments of this application provide a network data packet detection method, applied to security devices in a serially connected security system, wherein the serially connected security system includes multiple security devices connected in series, and the method includes:

[0007] Obtain the identification information of the network data packet to be detected, the identification information being used to identify the security device in the serial security system that has performed security detection on the network data packet;

[0008] Based on the identification information, a detection method is determined for the network data packet, wherein the detection method indicates whether to perform a full security inspection on the network data packet;

[0009] The network data packets are subjected to security detection based on the detection method to obtain the detection results;

[0010] Based on the detection results, the identification information is updated, and the network data packet is sent to the next-hop security device adjacent to the security device in the serial security system.

[0011] Secondly, embodiments of this application provide a network data packet detection device, applied to security devices in a serially connected security system, wherein the serially connected security system includes multiple security devices connected in series, and the device includes:

[0012] The acquisition unit is used to acquire the identification information of the network data packet to be detected, and the identification information is used to identify the security device in the serial security system that has performed security detection on the network data packet;

[0013] The determining unit is configured to determine a detection method for the network data packet based on the identification information, wherein the detection method indicates whether to perform a full security inspection on the network data packet;

[0014] The detection unit is used to perform security detection on the network data packets based on the detection method to obtain the detection result;

[0015] The sending unit is used to update the identification information based on the detection result, and to send the network data packet to the next-hop security device adjacent to the security device in the serial security system.

[0016] Thirdly, embodiments of this application provide a serial security system, including multiple security devices connected in series;

[0017] The security device is configured to acquire the identification information of the network data packet to be detected, perform security detection on the network data packet based on the detection method to obtain a detection result, update the identification information based on the detection result, and send the network data packet to the next-hop security device adjacent to the security device in the serial security system. The identification information is used to identify the security device in the serial security system that has performed security detection on the network data packet, and the detection method is used to indicate whether a full security detection is performed on the network data packet.

[0018] Fourthly, embodiments of this application provide a security device, including: a memory, a processor, and a computer program stored in the memory and executable on the processor, wherein the computer program, when executed by the processor, implements the steps of the method described in the first aspect.

[0019] Fifthly, embodiments of this application provide a computer-readable storage medium, characterized in that, when instructions in the storage medium are executed by a processor of a security device, the security device is able to perform the method described in the first aspect.

[0020] The above-described technical solutions adopted in the embodiments of this application can achieve the following beneficial effects:

[0021] For a cascaded security system consisting of multiple security devices connected in series, each security device performs security checks on the network data packets flowing through it. It then updates the identification information of these network data packets to indicate that it has performed security checks. This identification information allows the system to identify the security devices that have already performed security checks on the network data packets. After performing security checks, each security device also sends the network data packets to its next-hop security device. The next-hop security device determines whether to perform a full security check on the network data packets and further performs security checks based on the appropriate detection method. This process is repeated. This not only avoids requiring each security device in the cascaded security system to perform a full security check on the network data packets, thus preventing the same security monitoring items from being repeatedly monitored across different security devices and reducing system resource consumption, but also improves the performance of the security devices in the cascaded security system, thereby enhancing the robustness and stability of the system. Furthermore, the identification information of the network data packets facilitates the accurate and rapid location of abnormal security devices within the cascaded security system. Attached Figure Description

[0022] The accompanying drawings, which are included to provide a further understanding of this application and form part of this application, illustrate exemplary embodiments and are used to explain this application, but do not constitute an undue limitation of this application. In the drawings:

[0023] Figure 1 A schematic diagram of the implementation environment to which a network packet detection method provided for one or more embodiments of this application is applicable;

[0024] Figure 2 A flowchart illustrating a network packet detection method provided in one embodiment of this application;

[0025] Figure 3 A flowchart illustrating a network packet detection method provided for another embodiment of this application;

[0026] Figure 4 A flowchart illustrating a network packet detection method provided in yet another embodiment of this application;

[0027] Figure 5 A schematic diagram of a network data packet detection device provided in one embodiment of this application;

[0028] Figure 6 This is a schematic diagram of the structure of a safety device provided in one embodiment of this application. Detailed Implementation

[0029] To make the objectives, technical solutions, and advantages of this application clearer, the technical solutions of this application will be clearly and completely described below in conjunction with specific embodiments and corresponding drawings. Obviously, the described embodiments are only a part of the embodiments of this application, and not all of them. Based on the embodiments in this application, all other embodiments obtained by those skilled in the art without creative effort are within the scope of protection of this application.

[0030] The terms "first," "second," etc., used in this specification and claims are used to distinguish similar objects and not to describe a specific order or sequence. It should be understood that such data can be interchanged where appropriate so that embodiments of this application can be implemented in orders other than those illustrated or described herein. Furthermore, in this specification and claims, "and / or" indicates at least one of the connected objects, and the character " / " generally indicates that the preceding and following objects are in an "or" relationship.

[0031] As mentioned earlier, existing network packet detection methods involve cascading various types of security devices, such as WAFs and firewalls, using a multi-layered protection and multiple filtering approach. Each type of security device detects one type of security threat characteristic in network data packets, thereby achieving joint detection and defense against diverse and complex network attacks. However, since various security devices possess multiple security protection strategies, and some of these strategies are identical or similar, cascading networking can easily lead to repeated monitoring of the same security items across different devices, significantly consuming security monitoring time and network resources. Furthermore, the forwarding and throughput performance of different security devices in a cascaded link varies. If a low-performance security device is present in the cascaded link, it will become the performance bottleneck, directly affecting the robustness and stability of the link.

[0032] In view of this, the embodiments of this application aim to propose a network data packet detection method, apparatus, and cascaded security system. For a cascaded security system composed of multiple security devices connected in series, each security device performs security detection on the network data packets flowing through it, and then updates the identification information of the network data packets to indicate that it has performed security detection. This allows the identification information of the network data packets to identify the security devices in the cascaded security system that have performed security detection. After performing security detection on the network data packets flowing through it, each security device also sends the network data packets to its adjacent next-hop security device, which then... The device determines whether to perform a full security inspection on network data packets, and further performs security inspection on network data packets based on the corresponding inspection method, repeating the above process. This not only avoids each security device in a serial security system performing a full security inspection on network data packets, thus avoiding repeated monitoring of the same security monitoring items on different security devices and reducing system resource consumption, but also helps improve the performance of security devices in a serial security system, thereby improving the robustness and stability of the serial security system. In addition, based on the identification information of network data packets, it is also convenient to accurately and quickly locate abnormal security devices in a serial security system.

[0033] The technical solutions provided by the various embodiments of this application are described in detail below with reference to the accompanying drawings.

[0034] To facilitate understanding, let's first combine... Figure 1 The implementation environment to which a network packet detection method provided in one or more embodiments of this application is applicable will be described. The network packet detection method provided in the embodiments of this application can be applied to a serially connected security system, which may include multiple security devices connected in series. For example, as... Figure 1 As shown, the serial security system includes n security devices connected in series, namely security device 1 to security device n.

[0035] The aforementioned security devices can be of different types, each with multiple security protection strategies, and some of these devices may have the same or similar security protection strategies. Therefore, by employing a serial networking approach, these security devices sequentially perform security checks on the network data packets to be inspected, achieving the goal of joint detection and defense against diverse and complex network attacks.

[0036] In practical applications, the types of the aforementioned security devices can be selected according to actual needs, and this application embodiment does not limit this. For example, the aforementioned security devices may include, but are not limited to, at least two of the following security devices: WAF, Intrusion Detection Systems (IDS), Intrusion Prevention Systems (IPS), security gateways, next-generation firewalls, etc.

[0037] The network packet detection method provided in this application will describe in detail how various security devices perform security detection on network packets. The network packet detection method provided in this application will be described below with reference to the accompanying drawings.

[0038] Please see Figure 2 This is a flowchart illustrating a network packet detection method according to an embodiment of this application. This method can be applied to security devices in a serially connected security system, such as... Figure 1 Any security device in the serially connected security system shown. For example... Figure 2 As shown, the method may include the following steps:

[0039] S202, Obtain the identification information of the network data packets to be detected.

[0040] Among them, network data packets can be message data packets generated by the client accessing the web application. The form of the message data packets can include, but is not limited to, Hypertext Transfer Protocol (HTTP) or Hypertext Transfer Protocol over Secure Socket Layer (HTTPS).

[0041] The identification information of network data packets is used to identify security devices in a serial security system that have performed security checks on network data packets. The identification information of network data packets can be used to mark security devices that have performed security checks on network data packets in any appropriate manner, and the specific method can be selected according to actual needs; this application embodiment does not limit this.

[0042] Optionally, to facilitate the differentiation of different security devices, the identification information of network data packets may include the device identifiers of the security devices that have performed security checks on the network data packets in the cascaded security system. Specifically, the device identifiers in the identification information of network data packets can be added to the identification information by the security devices that have performed security checks on the network data packets. That is, initially, the identification information of network data packets does not include the device identifiers of the security devices in the cascaded security system; each hop of the security device in the cascaded security system can add its own device identifier to the identification information of the network data packets after performing security checks on them.

[0043] Optionally, to differentiate between different security devices and the detection results of each security device on network packets, the identification information of the network packet can include the device identifier of the security device in the cascaded security system that has performed security detection on the network packet and whose detection result is passed. In other words, initially, the identification information of the network packet does not include the device identifiers of the security devices in the cascaded security system; each hop of the cascaded security system can add its own device identifier to the identification information of the network packet after performing security detection on the network packet and passing the detection result.

[0044] S204, Based on the identification information of network data packets, determine the detection method for network data packets.

[0045] The detection method for network data packets indicates whether a full security inspection is performed on the network data packets. Specifically, the detection method for network data packets can include full security inspection and sampling security inspection. Full security inspection refers to performing security inspection on all data in the network data packets, while sampling security inspection refers to performing security inspection on a portion of the data extracted from the network data packets.

[0046] Optionally, S204 may include the following steps: For each security device in the serially connected security devices, if the security device is the first-hop security device in a series of sequentially connected security devices or the identification information of the network data packet does not identify the previous-hop security device adjacent to the security device, then the detection method for the network data packet is determined to be sampling security detection; if the security device is not the first-hop security device in a series of sequentially connected security devices and the identification information of the network data packet identifies the previous-hop security device adjacent to the security device, then the detection method for the network data packet is determined to be full-scale security detection.

[0047] For example, with Figure 1Taking the cascaded security system as an example, after security device 1 performs a full inspection of the network data packets, it sends the network data packets to security device 2 and identifies security device 1 in the identification information of the network data packets. After receiving the network data packets, security device 2 first checks the identification information of the network data packets. If it detects that the identification information identifies security device 1, it performs a full security inspection of the network data packets. After the security inspection, it sends the network data packets to the next-hop security device and identifies security device 2 in the identification information of the network data packets. This process continues until all security devices in the cascaded security system have completed the security inspection of the network data packets.

[0048] For example, still using Figure 1 Taking the serial security system shown as an example, such as Figure 3 As shown, after security device 1 performs a full inspection of the network data packets, it sends the network data packets to the security device. If the inspection result indicates that the network data packets have failed the security inspection, the identification information of the network data packets is not processed. After receiving the network data packets, security device 2 first inspects the identification information of the network data packets. If the identification information does not identify security device 1, it performs a sampling security inspection on the network data packets. After the security inspection, it sends the network data packets to the next-hop security device and determines whether to identify security device 2 in the identification information based on the inspection result. This process continues until all security devices in the cascaded security system have completed the security inspection of the network data packets.

[0049] It is understandable that, through the above implementation method, the first-hop security device in the serial security system performs a full inspection of network data packets. Other security devices in the serial security system, based on whether the previous-hop security device has performed security inspections on the network data packets, determine the inspection method for each network data packet. This not only avoids each security device in the serial security system performing a full security inspection of the network data packets, thus avoiding repeated monitoring of the same security items on different security devices and reducing system resource consumption, but also improves the performance of the security devices in the serial security system, thereby enhancing the robustness and stability of the serial security system. Furthermore, it avoids security risks caused by missed network data packets.

[0050] Optionally, to improve the comprehensiveness of network data packet detection and avoid security risks caused by missed network data packets, the above S204 may include the following steps: For each security device in the serially connected security device, if the security device is the first hop security device in a series of security devices or the identification information does not identify any security devices located before the security device, then the detection method is determined to be sampling security detection; if the security device is not the first hop security device in a series of security devices and the identification information identifies at least one security device located before the security device, then the detection method is determined to be full-scale security detection.

[0051] This application embodiment illustrates a specific implementation of S204 described above. It should be understood that S204 can also be implemented in other ways, and this application embodiment does not limit this implementation.

[0052] S206, perform security inspection on network data packets based on the detection method to obtain the detection results.

[0053] The detection results can be used to indicate whether a network packet passes a security check. Furthermore, if a network packet fails a security check, the detection results can also be used to indicate the type of network threat present in the network packet.

[0054] Specifically, if the detection method is full-data security detection, a preset security protection strategy can be used to perform security detection on all data in the network data packets. If the network data packets have threat characteristics, it is determined that the network data packets have failed the security detection; if the network data packets do not have threat characteristics, it is determined that the network data packets have passed the security detection.

[0055] If the detection method is sampling security detection, a portion of the data is extracted from the network data packets as the data to be detected, and a preset security protection strategy is used to perform security detection on the data to be detected. If the data to be detected has threat characteristics, it is determined that the network data packet has failed the security detection; if the data to be detected does not have threat characteristics, it is determined that the network data packet has passed the sampling security detection.

[0056] Furthermore, to improve the accuracy and comprehensiveness of the detection, if the candidate detection results obtained from the sampling security detection of the data to be detected indicate that the data to be detected has failed the security detection, it indicates that other security devices located before the current security device have detection vulnerabilities or operational problems. Therefore, a full security detection is performed on the network data packets, and the detection results obtained in this instance are used as the detection results of the network data packets.

[0057] In practical applications, any appropriate method can be used to extract data from network data packets. The specific extraction method can be selected according to actual needs, and this application embodiment does not limit this. Optionally, data at a preset position can be extracted from network data packets as the data to be detected. Optionally, to further improve the reliability of the detection results, the data to be detected can be randomly extracted from network data packets, for example, by using a random sampling algorithm to randomly extract the data to be detected from network data packets.

[0058] Furthermore, when a security device determines that a network packet has failed security checks, it can also identify the type of network threat present in the network packet based on its threat characteristics. Specifically, there is a correspondence between network threat types and threat characteristics. Based on this correspondence, the security device can query the network threat type corresponding to the threat characteristics present in the network packet, and thus identify the network threat type present in the network packet.

[0059] Furthermore, if a network data packet fails the sampling security inspection of a certain security device, it indicates that other security devices preceding that security device are operating normally, and that the security defense strategies of these security devices are applicable to the current network data conditions. In this case, the current security device does not need to perform a full security inspection on the network data packet anymore, and can directly send the network data packet to its next-hop security device, which will then perform security inspection on the network data packet using the corresponding inspection method. This allows for the completion of serialized security inspection and management of network data packets with minimal network resource consumption.

[0060] This application embodiment illustrates a specific implementation of S206 described above. It should be understood that S206 can also be implemented in other ways, and this application embodiment does not limit this implementation.

[0061] S208, based on the detection results, update the identification information of network data packets.

[0062] Optionally, for any security device in a serial security system, if the detection result obtained by the security device indicates that the network data packet has passed the security detection, the device identifier of the security device can be added to the identification information of the network data packet to indicate that the security device has performed security detection on the network data packet and that the network data packet has passed the security detection implemented by the security device.

[0063] Of course, in some other alternative implementations, for any security device in a serial security system, after performing security checks on network data packets, the security device may not consider the check results but directly add its device identifier to the identification information of the network data packets to indicate that the security device has performed security checks on the network data packets.

[0064] For example, such as Figure 3 As shown, if security device 1 determines that a network data packet has failed the security test after performing a full security check on the network data packet, it inserts its own (i.e., security device 1's) device identifier into the identification information of the network data packet.

[0065] This application embodiment illustrates a specific implementation of S208 described above. It should be understood that S208 can also be implemented in other ways, and this application embodiment does not limit this implementation.

[0066] S210 sends network data packets to the next-hop security device adjacent to the security device in the serial security system.

[0067] Specifically, for any security device in a cascaded security system, after performing security checks on network data packets, the device can use a forwarding and pass-through mechanism to send the network data packets to the next-hop security device adjacent to it. For example, let's continue with... Figure 3 For example, after security device 1 performs security checks on network data packets, it can use a forwarding and transparent transmission mechanism to send the network data packets to security device 2.

[0068] In another embodiment of this application, to facilitate relevant personnel's timely understanding of the detection status of network data packets, so as to take effective measures to deal with security threats in a timely manner when network data packets pose a security threat, such as... Figure 4 As shown, after S206 above, the network packet detection method of this application embodiment may further include:

[0069] S212, if the detection result indicates that the network data packet has failed the security detection, then based on the detection result and the preset security threat handling strategy, the network data packet is processed and the first alarm information is sent to the monitoring platform.

[0070] The preset security threat handling strategy can be determined based on the network threat type indicated by the detection results. In other words, preset security threat handling strategies corresponding to different network threat types can be pre-configured in each security device. If the detection results indicate that a network packet fails the security detection, the corresponding preset security handling strategy can be queried based on the network threat type indicated by the detection results, and then the network packet can be processed based on the preset security handling strategy.

[0071] It should be noted that the preset security threat handling strategy can be any of the threat handling strategies commonly used in the field, which will not be described in detail in the embodiments of this application.

[0072] After determining that a network data packet has failed security detection, the security device can send a first alarm message to the monitoring platform based on the network threat type indicated by the detection result, to indicate that the network data packet failed security detection and the type of network threat present in the network data packet. Furthermore, the monitoring platform can display the first alarm message in any appropriate form, such as, but not limited to, one or more combinations of the following: sound, light, text, vibration, etc., which are not limited in this embodiment.

[0073] In another embodiment of this application, in order to facilitate the response to network threats posed by network data packets, after the above-described S206, the network data packet detection method provided in this application embodiment may further include:

[0074] S214 If the detection result indicates that the network packet failed the security detection, then based on the identification information of the network packet and the network threat type, determine the target security device related to the network threat type.

[0075] If the detection result indicates that the network packet failed the security detection, it means that the security device located before the current security device has a detection vulnerability or has an operational problem. Then, based on the security device that has performed security detection on the network packet identified in the network packet's identification information and the type of network threat present in the network packet, the target security device related to that type of network threat can be determined in order to effectively deal with the network threat of that type.

[0076] In an optional implementation, S214 may include: if the identification information of the network data packet identifies the device identifiers of multiple security devices located before the security device, then the security device used to detect the network threat type is determined from the multiple security devices as the target security device.

[0077] For example, suppose the fourth-hop security device in a serial security system detects a Distributed Denial of Service (DDoS) attack on network packets. Based on the identification information of the network packets, it can be determined that the first-hop, second-hop, and third-hop security devices all performed security checks on the network packets. However, only the first-hop and third-hop security devices were used to detect DDoS attacks. Therefore, it can be determined that the first-hop and third-hop security devices have detection vulnerabilities or operational problems, and thus can be identified as the target security devices.

[0078] If the identification information of a network data packet only identifies the device identifier of the previous hop security device adjacent to a certain security device, then starting from the previous hop security device adjacent to that security device, the security devices located before that security device are traversed. Based on the network threat type used by the currently traversed security device for detection and the network threat type present in the network data packet, it is determined whether the currently traversed security device is the target security device.

[0079] For example, suppose the fourth-hop security device in a cascaded security system detects a DDoS attack on a network data packet. Based on the identification information of the network data packet, it can be determined that only the third-hop security device performed security checks on the network data packet. In this case, starting from the third-hop security device, if the third-hop security device can be used to detect DDoS attacks, it can be determined that the third-hop security device has a detection vulnerability or an operational problem, and thus the third-hop security device is selected as the target security device. Next, the process is traversed to the second-hop security device. If the second-hop security device is not suitable for detecting DDoS attacks, the process continues to the first-hop security device. If the first-hop security device can be used to detect DDoS attacks, it can be determined that the first-hop security device also has a detection vulnerability or an operational problem, and thus the first-hop security device is also selected as the target security device.

[0080] Understandably, the above implementation method can not only achieve a complete closed loop of the security detection mechanism, but also detect and locate abnormal security devices with vulnerabilities or operational problems in the serial security system in real time, thereby providing direct and effective analytical evidence for troubleshooting.

[0081] This application embodiment illustrates one specific implementation of S214 described above. It should be understood that S214 can also be implemented in other ways, and this application embodiment does not limit this implementation.

[0082] In another embodiment of this application, after S214 described above, the network packet detection method provided in this application embodiment may further include:

[0083] S216, based on the device information of the target security device, send a second alarm message to the monitoring platform.

[0084] The second alarm message is used to alert the target security device to detection vulnerabilities or operational problems. Furthermore, the monitoring platform can display the second alarm message in any appropriate form, such as, but not limited to, one or more combinations of the following: sound, light, text, vibration, etc., which are not limited in this embodiment.

[0085] S218, responding to the restart command sent by the monitoring platform, executes a restart operation.

[0086] Based on the second alarm information, the monitoring platform can send a restart command to the target security device to instruct the target security device to restart and restore normal operation.

[0087] For each security device in a serially connected security system, if the security device receives a restart command from the monitoring platform, it will perform a restart operation.

[0088] Understandably, sending a second alarm message to the monitoring platform allows relevant personnel to promptly understand the operational status of each security device in the serial security system, enabling them to take effective countermeasures when individual security devices malfunction. Furthermore, by executing a restart operation upon receiving a restart command from the monitoring platform, the security devices can be restored to normal operation in a timely manner, thereby improving the robustness and stability of the serial security system.

[0089] The network data packet detection method provided in this application embodiment is for a cascaded security system composed of multiple security devices connected in series. Each security device performs security detection on the network data packets flowing through it and updates the identification information of the network data packets to indicate that it has performed security detection. This allows the identification information of the network data packets to identify the security devices in the cascaded security system that have performed security detection. After performing security detection on the network data packets flowing through it, each security device also sends the network data packets to its adjacent next-hop security device. The next-hop security device determines whether to perform a full security detection on the network data packets and further performs security detection based on the corresponding detection method, repeating the above process. This not only avoids each security device in the cascaded security system performing a full security detection on the network data packets, thus avoiding repeated monitoring of the same security monitoring items on different security devices and reducing system resource consumption, but also improves the performance of the security devices in the cascaded security system, thereby improving the robustness and stability of the cascaded security system. Furthermore, based on the identification information of the network data packets, it is also convenient to accurately and quickly locate abnormal security devices in the cascaded security system.

[0090] It should be noted that the network data packet detection method provided in this application embodiment can be embedded into the security device of a serial security system as a plug-in, or it can be deployed as an independent device system in the serial security system network. Therefore, it also has the technical effects of simple deployment and low application cost.

[0091] The foregoing has described specific embodiments of this specification. Other embodiments are within the scope of the appended claims. In some cases, the actions or steps recited in the claims may be performed in a different order than that shown in the embodiments and may still achieve the desired result. Furthermore, the processes depicted in the drawings do not necessarily require the specific or sequential order shown to achieve the desired result. In some embodiments, multitasking and parallel processing are possible or may be advantageous.

[0092] In addition, with the above Figure 2 Corresponding to the network packet detection method shown, this application embodiment also provides a serial security system, which may include multiple security devices connected in series.

[0093] The security device is configured to acquire the identification information of the network data packet to be detected, perform security detection on the network data packet based on the detection method to obtain a detection result, update the identification information based on the detection result, and send the network data packet to the next-hop security device adjacent to the security device in the serial security system. The identification information is used to identify the security device in the serial security system that has performed security detection on the network data packet, and the detection method is used to indicate whether a full security detection is performed on the network data packet.

[0094] Optionally, the security device determines a detection method for the network data packets based on the identification information, including:

[0095] If the security device is the first hop security device in a series of security devices or the identification information does not identify the preceding security device adjacent to the security device, then the detection method is determined to be sampling security detection.

[0096] If the security device is not the first hop security device among the multiple security devices connected in series, and the identification information identifies the previous hop security device adjacent to the security device, then the detection method is determined to be full security detection.

[0097] Optionally, if the detection method of the security device is sampling security detection, then the step of performing security detection on the network data packets based on the detection method to obtain the detection result includes:

[0098] Randomly obtain the data to be detected from the network data packets;

[0099] The data to be detected is subjected to security detection to obtain candidate detection results;

[0100] If the candidate detection result indicates that the data to be detected has failed the security detection, then a full security detection is performed on the network data packet to obtain the detection result of the network data packet.

[0101] Optionally, the security device, in updating the identification information based on the detection result, includes:

[0102] If the detection result indicates that the network data packet passes the security detection, then the device identifier of the security device is added to the identification information.

[0103] Optionally, the security device is further configured to, after performing security detection on the network data packet based on the detection method to obtain a detection result, if the detection result indicates that the network data packet has failed the security detection, process the network data packet based on the detection result and a preset security threat handling strategy, and send a first alarm message to the monitoring platform.

[0104] Optionally, the detection results may also be used to indicate the type of network threat present in the network data packets;

[0105] The security device is further configured to, after performing security detection on the network data packet based on the detection method to obtain a detection result, if the detection result indicates that the network data packet has failed the security detection, determine a target security device related to the network threat type based on the identification information and the network threat type.

[0106] Optionally, the security device, based on the identification information and the network threat type, determines a target security device related to the network threat type, including:

[0107] If the identification information identifies device identifiers of multiple security devices located before the security device, then the security device used to detect the network threat type is determined from among the multiple security devices and designated as the target security device;

[0108] If the identification information only identifies the device identifier of the previous hop security device adjacent to the security device, then starting from the previous hop security device, traverse the security devices located before the security device, and determine whether the currently traversed security device is the target security device based on the network threat type used by the currently traversed security device for detection and the network threat type present in the network data packet.

[0109] Optionally, the security device is further configured to, after determining the target security device related to the network threat type based on the identification information and the network threat type, send a second alarm message to the monitoring platform based on the device information of the target security device, and perform a restart operation in response to a restart command sent by the monitoring platform.

[0110] It should be noted that the functions implemented by each security device in the serial security system provided in this application embodiment can be found in the specific implementation of the corresponding steps in the above-mentioned network data packet detection method. Since the principle is the same, it will not be repeated here.

[0111] In addition, with the above Figure 2 Corresponding to the network packet detection method shown, this application embodiment also provides a network packet detection device 500, which can be applied to security devices in a serialized security system, such as... Figure 1 Any security device in the serially connected security system shown. For example... Figure 5 As shown, the device 500 may include:

[0112] The acquisition unit 510 is used to acquire the identification information of the network data packet to be detected. The identification information is used to identify the security device in the serial security system that has performed security detection on the network data packet.

[0113] The determining unit 520 is used to determine a detection method for the network data packet based on the identification information, wherein the detection method indicates whether to perform a full security inspection on the network data packet;

[0114] The detection unit 530 is used to perform security detection on the network data packets based on the detection method to obtain the detection result;

[0115] The sending unit 540 is used to update the identification information based on the detection result, and to send the network data packet to the next-hop security device adjacent to the security device in the serial security system.

[0116] Optionally, the determining unit determines the detection method for the network data packet based on the identification information, including:

[0117] If the security device is the first hop security device in a series of security devices or the identification information does not identify the preceding security device adjacent to the security device, then the detection method is determined to be sampling security detection.

[0118] If the security device is not the first hop security device among the multiple security devices connected in series, and the identification information identifies the previous hop security device adjacent to the security device, then the detection method is determined to be full security detection.

[0119] Optionally, if the detection method is sampling security detection, the step of performing security detection on the network data packets based on the detection method to obtain a detection result includes:

[0120] Randomly obtain the data to be detected from the network data packets;

[0121] The data to be detected is subjected to security detection to obtain candidate detection results;

[0122] If the candidate detection result indicates that the data to be detected has failed the security detection, then a full security detection is performed on the network data packet to obtain the detection result of the network data packet.

[0123] Optionally, the sending unit updates the identification information based on the detection result, including:

[0124] If the detection result indicates that the network data packet passes the security detection, then the device identifier of the security device is added to the identification information.

[0125] Optionally, the sending unit is further configured to: after the detection unit performs security detection on the network data packet based on the detection method to obtain a detection result, if the detection result indicates that the network data packet has failed the security detection, then process the network data packet based on the detection result and a preset security threat handling strategy, and send a first alarm message to the monitoring platform.

[0126] Optionally, the detection results may also be used to indicate the type of network threat present in the network data packets;

[0127] The detection unit is further configured to, after performing security detection on the network data packet based on the detection method to obtain a detection result, if the detection result indicates that the network data packet has failed the security detection, determine a target security device related to the network threat type based on the identification information and the network threat type.

[0128] Optionally, the detection unit, based on the identification information and the network threat type, determines the target security device related to the network threat type, including:

[0129] If the identification information identifies device identifiers of multiple security devices located before the security device, then the security device used to detect the network threat type is determined from among the multiple security devices and designated as the target security device;

[0130] If the identification information only identifies the device identifier of the previous hop security device adjacent to the security device, then starting from the previous hop security device, traverse the security devices located before the security device, and determine whether the currently traversed security device is the target security device based on the network threat type used by the currently traversed security device for detection and the network threat type present in the network data packet.

[0131] Optionally, the sending unit is further configured to send a second alarm message to the monitoring platform based on the device information of the target security device after the detection unit determines the target security device related to the network threat type based on the identification information and the network threat type;

[0132] The network packet detection device further includes:

[0133] The restart unit is used to respond to a restart command sent by the monitoring platform and perform a restart operation;

[0134] The sending unit is also used to send a second alarm message to the monitoring platform based on the device information of the target security device.

[0135] Obviously, the network packet detection device provided in this application embodiment can serve as... Figure 2 The execution entity of the network packet detection method shown is, for example, Figure 2 In the network packet detection method shown, step S202 can be performed by... Figure 5 The acquisition unit in the network packet detection device shown executes step S204, which can be executed by the determination unit in the network packet detection device. Step S206 can be executed by the detection unit in the network packet detection device. Steps S208 and S210 can be executed by the sending unit in the network packet detection device.

[0136] According to another embodiment of this application, Figure 5 The network packet detection device shown can be composed of various units, either individually or entirely, combined into one or more other units. Alternatively, some of the units can be further divided into several functionally smaller units. This achieves the same operation without affecting the technical effects of the embodiments of this application. The above-mentioned units are based on logical function division. In practical applications, the function of one unit can be implemented by multiple units, or the function of multiple units can be implemented by one unit. In other embodiments of this application, the network packet detection device may also include other units. In practical applications, these functions can also be implemented with the assistance of other units, and can be implemented collaboratively by multiple units.

[0137] According to another embodiment of this application, a general-purpose computing device, such as a computer, including processing elements and storage elements such as a central processing unit (CPU), random access memory (RAM), and read-only memory (ROM), can run an application capable of performing tasks such as... Figure 2 The computer program (including program code) for each step involved in the corresponding method shown, to construct such... Figure 5 The network packet detection apparatus shown herein, and the network packet detection method for implementing the embodiments of this application, are described. The computer program may be recorded on, for example, a computer-readable storage medium, and may be transferred to a security device via the same medium and run therein.

[0138] The network packet detection device provided in this application embodiment is designed for a cascaded security system composed of multiple security devices connected in series. Each security device performs security detection on the network packets flowing through it and updates the identification information of the network packets to indicate that it has performed security detection. This allows the identification information of the network packets to identify the security devices in the cascaded security system that have performed security detection. After performing security detection on the network packets flowing through it, each security device also sends the network packets to its adjacent next-hop security device. The next-hop security device determines whether to perform a full security detection on the network packets and further performs security detection based on the corresponding detection method, repeating the above process. This not only avoids each security device in the cascaded security system performing a full security detection on the network packets, thus avoiding repeated monitoring of the same security items on different security devices and reducing system resource consumption, but also improves the performance of the security devices in the cascaded security system, thereby improving the robustness and stability of the cascaded security system. Furthermore, based on the identification information of the network packets, it is also convenient to accurately and quickly locate abnormal security devices in the cascaded security system.

[0139] Figure 6 This is a schematic diagram of the structure of a safety device according to an embodiment of this application. Please refer to it. Figure 6 At the hardware level, the security device includes a processor, and optionally also an internal bus, network interface, and memory. The memory may include main memory, such as high-speed random-access memory (RAM), or non-volatile memory, such as at least one disk drive. Of course, the security device may also include other hardware required for other business operations.

[0140] The processor, network interface, and memory can be interconnected via an internal bus, which can be an ISA (Industry Standard Architecture) bus, a PCI (Peripheral Component Interconnect) bus, or an EISA (Extended Industry Standard Architecture) bus, etc. This bus can be divided into address bus, data bus, control bus, etc. For ease of representation, Figure 6 The symbol is represented by a single double-headed arrow, but this does not mean that there is only one bus or one type of bus.

[0141] Memory is used to store programs. Specifically, programs may include program code, which includes computer operation instructions. Memory may include main memory and non-volatile memory, and provides instructions and data to the processor.

[0142] The processor reads the corresponding computer program from non-volatile memory into main memory and then runs it, forming a network packet inspection device at the logical level. The processor executes the program stored in memory and specifically performs the following operations:

[0143] Obtain the identification information of the network data packet to be detected. The identification information is used to identify the security device in the serial security system that has performed security detection on the network data packet. The serial security system includes multiple security devices connected in series.

[0144] Based on the identification information, a detection method is determined for the network data packet, wherein the detection method indicates whether to perform a full security inspection on the network data packet;

[0145] The network data packets are subjected to security detection based on the detection method to obtain the detection results;

[0146] Based on the detection results, the identification information is updated, and the network data packet is sent to the next-hop security device adjacent to the security device in the serial security system.

[0147] The above is as stated in this application. Figure 2The method executed by the network packet detection device disclosed in the illustrated embodiment can be applied to a processor or implemented by a processor. The processor may be an integrated circuit chip with signal processing capabilities. During implementation, each step of the above method can be completed by integrated logic circuits in the processor's hardware or by instructions in software form. The processor can be a general-purpose processor, including a Central Processing Unit (CPU), a Network Processor (NP), etc.; it can also be a Digital Signal Processor (DSP), an Application Specific Integrated Circuit (ASIC), a Field-Programmable Gate Array (FPGA), or other programmable logic devices, discrete gate or transistor logic devices, or discrete hardware components. It can implement or execute the methods, steps, and logic block diagrams disclosed in the embodiments of this application. The general-purpose processor can be a microprocessor or any conventional processor. The steps of the method disclosed in the embodiments of this application can be directly embodied in the execution of a hardware decoding processor, or executed by a combination of hardware and software modules in the decoding processor. The software module can reside in a mature storage medium in the field, such as random access memory, flash memory, read-only memory, programmable read-only memory, electrically erasable programmable memory, or registers. This storage medium is located in memory, and the processor reads information from the memory and, in conjunction with its hardware, completes the steps of the above method.

[0148] This safety device can also perform Figure 2 The method, and implement the network packet detection device in Figures 2 to 4 The functions of the embodiments shown are not described in detail here.

[0149] Of course, in addition to software implementation, the security device of this application does not exclude other implementation methods, such as logic devices or a combination of hardware and software, etc. In other words, the execution subject of the following processing flow is not limited to each logic unit, but can also be hardware or logic devices.

[0150] This application also proposes a computer-readable storage medium that stores one or more programs, the programs including instructions that, when executed by a portable security device including multiple applications, enable the portable security device to perform... Figure 2 The method of the illustrated embodiment is specifically used to perform the following operations:

[0151] Obtain the identification information of the network data packet to be detected. The identification information is used to identify the security device in the serial security system that has performed security detection on the network data packet. The serial security system includes multiple security devices connected in series.

[0152] Based on the identification information, a detection method is determined for the network data packet, wherein the detection method indicates whether to perform a full security inspection on the network data packet;

[0153] The network data packets are subjected to security detection based on the detection method to obtain the detection results;

[0154] Based on the detection results, the identification information is updated, and the network data packet is sent to the next-hop security device adjacent to the security device in the serial security system.

[0155] In summary, the above description is merely a preferred embodiment of this application and is not intended to limit the scope of protection of this application. Any modifications, equivalent substitutions, improvements, etc., made within the spirit and principles of this application should be included within the scope of protection of this application.

[0156] The systems, devices, modules, or units described in the above embodiments can be implemented by computer chips or entities, or by products with certain functions. A typical implementation device is a computer. Specifically, a computer can be, for example, a personal computer, laptop computer, cellular phone, camera phone, smartphone, personal digital assistant, media player, navigation device, email device, game console, tablet computer, wearable device, or any combination of these devices.

[0157] Computer-readable media includes both permanent and non-permanent, removable and non-removable media that can store information using any method or technology. Information can be computer-readable instructions, data structures, modules of programs, or other data. Examples of computer storage media include, but are not limited to, phase-change memory (PRAM), static random access memory (SRAM), dynamic random access memory (DRAM), other types of random access memory (RAM), read-only memory (ROM), electrically erasable programmable read-only memory (EEPROM), flash memory or other memory technologies, CD-ROM, digital versatile optical disc (DVD) or other optical storage, magnetic tape, magnetic disk storage or other magnetic storage devices, or any other non-transferable medium that can be used to store information accessible by a computing device. As defined herein, computer-readable media does not include transient computer-readable media, such as modulated data signals and carrier waves.

[0158] It should also be noted that the terms "comprising," "including," or any other variations thereof are intended to cover non-exclusive inclusion, such that a process, method, article, or apparatus that comprises a list of elements includes not only those elements but also other elements not expressly listed, or elements inherent to such a process, method, article, or apparatus. Without further limitation, an element defined by the phrase "comprising one..." does not exclude the presence of other identical elements in the process, method, article, or apparatus that includes said element.

[0159] The various embodiments in this specification are described in a progressive manner. Similar or identical parts between embodiments can be referred to interchangeably. Each embodiment focuses on describing the differences from other embodiments. In particular, the system embodiments are basically similar to the method embodiments, so the description is relatively simple; relevant parts can be referred to the descriptions in the method embodiments.

Claims

1. A method for detecting network data packets, characterized in that, A security device applied in a serially connected security system, wherein the serially connected security system includes multiple security devices connected in series, and the method includes: Obtain the identification information of the network data packet to be detected, the identification information being used to identify the security device in the serial security system that has performed security detection on the network data packet; Based on the identification information, a detection method for the network data packet is determined. The detection method includes full security detection or sampling security detection. Sampling security detection refers to extracting a portion of data from the network data packet for security detection. Specifically, the first-hop security device in the serial security system performs full security detection on the network data packet, and other security devices besides the first-hop security device determine the detection method for the network data packet based on whether the previous-hop security device performed security detection on the network data packet. The network data packets are subjected to security detection based on the detection method to obtain the detection results; Based on the detection results, the identification information is updated, and the network data packet is sent to the next-hop security device adjacent to the security device in the serial security system.

2. The method according to claim 1, characterized in that, The step of determining the detection method for the network data packet based on the identification information includes: If the security device is the first hop security device among the multiple security devices connected in series, or if the identification information does not identify the preceding security device adjacent to the security device, then the detection method is determined to be full security detection; If the security device is not the first hop security device in the series of multiple security devices connected in sequence, and the identification information identifies the previous hop security device adjacent to the security device, then the detection method is determined to be sampling security detection.

3. The method according to claim 1, characterized in that, If the detection method is sampling security detection, then the security detection of the network data packets based on the detection method to obtain the detection result includes: Randomly obtain the data to be detected from the network data packets; The data to be detected is subjected to security detection to obtain candidate detection results; If the candidate detection result indicates that the data to be detected has failed the security detection, then a full security detection is performed on the network data packet to obtain the detection result of the network data packet.

4. The method according to claim 1, characterized in that, The step of updating the identification information based on the detection results includes: If the detection result indicates that the network data packet passes the security detection, then the device identifier of the security device is added to the identification information.

5. The method according to claim 1, characterized in that, After performing security detection on the network data packets based on the detection method to obtain the detection result, the method further includes: If the detection result indicates that the network data packet has failed the security detection, then based on the detection result and the preset security threat handling strategy, the network data packet is processed, and a first alarm message is sent to the monitoring platform.

6. The method according to claim 1, characterized in that, The detection results are also used to indicate the type of network threat present in the network data packets; After performing security detection on the network data packets based on the detection method to obtain the detection result, the method further includes: If the detection result indicates that the network data packet has failed the security detection, then based on the identification information and the network threat type, a target security device related to the network threat type is determined.

7. The method according to claim 6, characterized in that, The step of determining the target security device related to the network threat type based on the identification information and the network threat type includes: If the identification information identifies device identifiers of multiple security devices located before the security device, then the security device used to detect the network threat type is determined from among the multiple security devices and designated as the target security device; If the identification information only identifies the device identifier of the previous hop security device adjacent to the security device, then starting from the previous hop security device, traverse the security devices located before the security device, and determine whether the currently traversed security device is the target security device based on the network threat type used by the currently traversed security device for detection and the network threat type present in the network data packet.

8. The method according to claim 6, characterized in that, After determining the target security device related to the network threat type based on the identification information and the network threat type, the method further includes: Based on the device information of the target security device, a second alarm message is sent to the monitoring platform; In response to the restart command sent by the monitoring platform, a restart operation is performed.

9. A network data packet detection device, characterized in that, A security device applied in a serially connected security system, wherein the serially connected security system includes multiple security devices connected in series, the device comprising: The acquisition unit is used to acquire the identification information of the network data packet to be detected, and the identification information is used to identify the security device in the serial security system that has performed security detection on the network data packet; The determining unit is configured to determine a detection method for the network data packet based on the identification information. The detection method includes full-scale security detection or sampling security detection. Sampling security detection refers to extracting a portion of data from the network data packet for security detection. Specifically, the first-hop security device in the serialized security system performs full-scale security detection on the network data packet, and other security devices besides the first-hop security device determine the detection method for the network data packet based on whether the previous-hop security device performed security detection on the network data packet. The detection unit is used to perform security detection on the network data packets based on the detection method to obtain the detection result; The sending unit is used to update the identification information based on the detection result, and to send the network data packet to the next-hop security device adjacent to the security device in the serial security system.

10. A serial security system, characterized in that, This includes multiple safety devices connected in series; The security device is used to acquire identification information of the network data packet to be detected. The identification information is used to identify the security device in the serial security system that has performed security detection on the network data packet. The device performs security detection on the network data packet based on a detection method to obtain a detection result. Based on the detection result, it updates the identification information and sends the network data packet to the next-hop security device adjacent to the security device in the serial security system. The identification information identifies the security device in the serial security system that has performed security detection on the network data packet. The detection method includes full security detection or sampling security detection. Sampling security detection refers to extracting a portion of the data packet for security detection. Specifically, the first-hop security device in the serial security system performs full security detection on the network data packet. Other security devices besides the first-hop security device determine the detection method for the network data packet based on whether the previous-hop security device performed security detection on the network data packet.

Images