Method for scanning threat features of application layer protection capability

Abstract

The application relates to a threat feature uniform scanning engine scanning promotion method of application layer protection capability, and belongs to the field of cloud security network communication.The method comprises the following steps: establishing respective feature description information storage data structures of each protection capability of the application layer, and generating a feature library; marking all feature rule IDs of the protection capability, and establishing a comprehensive feature engine library; performing application layer service protection processing; the service traffic is scanned through the comprehensive feature engine library, and all hit features are returned; the feature rule ID is reversely processed into features of respective protection capabilities, feature description information storage data structures of the respective protection capabilities are searched, hit feature information is obtained, log information is sent, the execution action of the features is processed, and it is judged whether the service traffic is prohibited or released. The method has efficient detection processing, so that the next-generation firewall under the cloud has the abilities of rich protection functions and efficient service detection.

Description

Technical Field

[0001] This invention belongs to the field of cloud security network communication technology, and in particular relates to a method for improving the scanning capabilities of a unified threat signature scanning engine for application layer protection. Background Technology

[0002] With the widespread adoption of cloud computing, more and more users are migrating their businesses to the cloud, making the security of cloud-based businesses increasingly important. Next-generation cloud firewalls provide protection for the boundaries of users' cloud businesses. In terms of application-layer protection, next-generation cloud firewalls need to have more protection functions (such as IPS, AV, WAF, threat intelligence, etc.) and more efficient protection processing in order to provide users with comprehensive and efficient cloud security protection.

[0003] Traditional next-generation firewalls offer a variety of application-layer protection capabilities, including but not limited to intrusion detection, virus protection, web application protection, and threat intelligence analysis. Cloud-based next-generation firewalls should also possess these application-layer protection capabilities. The mainstream approach is for each firewall to have its own signature database, and each database generates a signature engine. User business traffic is scanned and matched against each signature engine to determine whether it is threat traffic.

[0004] Next-generation cloud firewalls integrate multiple protection capabilities, requiring business traffic to be scanned across multiple signature engines. As the boundary protection mechanism for user cloud services, all cloud business traffic entering and leaving the cloud must pass through the next-generation cloud firewall. The more protection capabilities the next-generation cloud firewall possesses, the more signature engines cloud business traffic needs to be scanned through, resulting in slower processing speeds.

[0005] The next-generation cloud firewall provides protection for the boundaries of user cloud services. It integrates multiple application-layer protection capabilities. Business traffic passing through the next-generation cloud firewall must be inspected by multiple application-layer protection capabilities. User cloud services must pass through the next-generation cloud firewall when entering or leaving the cloud. It is a performance bottleneck for user services. Therefore, how to perform efficient detection and processing, so that the next-generation cloud firewall has rich protection functions and high efficiency in business detection, is a technical problem that needs to be solved. Summary of the Invention

[0006] In view of the shortcomings of the existing technology, the purpose of the invention is to provide a method for enhancing the unified scanning engine of threat signatures for application layer protection capabilities. This method has efficient detection and processing capabilities, enabling the next-generation cloud firewall to have rich protection functions and high efficiency in business detection.

[0007] This invention proposes a method for enhancing application-layer protection capabilities through a unified threat signature scanning engine, comprising:

[0008] S1, each protection capability in the application layer establishes its own feature description information storage data structure to generate a feature library; wherein, the feature library of each protection capability is independent, and the feature description information in the feature library uses the feature rule ID as the key to uniquely determine the feature;

[0009] S2, mark the feature rule IDs of all protection capabilities and establish a comprehensive feature engine library;

[0010] S3, execute application layer business protection processing. The business traffic is scanned by the comprehensive feature engine library and all hit features are returned. The feature rule ID is reverse-processed into the features of their respective protection capabilities. The feature description information storage data structure of each protection capability is searched to obtain the hit feature information. Log information is sent, the execution action of the feature is processed, and it is determined whether to prohibit or allow the business traffic.

[0011] Furthermore, in step S1, the feature rule ID number is 32 bits.

[0012] Furthermore, in step S1, each feature includes: feature description and feature content, wherein the feature description includes feature description information, feature priority and feature execution action; the feature content includes: key information on whether it is a threat.

[0013] Furthermore, in step S2, the establishment of the comprehensive feature engine library includes: modifying the feature rule ID for the features of all protection capabilities, taking the lower 24 bits of the feature rule ID, and setting the higher 8 bits from 0x01 to 0xFF as the classification of different protection capabilities, thereby using this as the protection classification to distinguish features. After modifying the feature rule ID based on this, the feature library rule ID of all protection capabilities is unique.

[0014] Furthermore, in step S2, a comprehensive feature engine is jointly established for all protection capabilities. The comprehensive feature engine is a finite state machine for multi-mode matching.

[0015] Furthermore, the comprehensive feature engine is generated using the AC algorithm or the hyperscan tool.

[0016] Furthermore, in step S3, the service traffic is scanned by the comprehensive feature engine. According to the multi-mode matching principle of the scanning engine, the service traffic is scanned by the comprehensive feature engine once, and all hit results are generated. The corresponding result is the hit feature rule ID. By traversing all the hit rule IDs, the ID obtained is the actual feature rule ID of this protection capability.

[0017] Furthermore, the actual feature rule ID is searched on the global radix tree Xxx_radix_tree of this protection capability, thereby obtaining the descriptive data structure of the feature.

[0018] Furthermore, iterate through all the matched feature rule IDs, check the high 8 bits of each feature rule ID to identify the category of protection capability, clear the high 8 bits of the feature rule ID to zero, and the resulting feature rule ID is the actual rule ID of this protection capability.

[0019] Furthermore, for all hit characteristics of the protection capability, information from the characteristic description data structure is extracted for attack hit log processing. Based on the priority of all characteristics, the characteristics that need to be executed are determined, and the action for that characteristic is performed.

[0020] The proposed method for enhancing application-layer protection capabilities through a unified threat signature scanning engine has the following advantages:

[0021] (1) The business content of the features in the feature library of all protection capabilities are used to jointly build a comprehensive feature engine. Business traffic only needs to pass through the comprehensive feature engine once to realize the security detection of all protection capabilities, improve business processing efficiency, and improve the detection efficiency of application layer protection.

[0022] (2) Multiple application-layer protection capabilities can be generated through manual classification, resulting in a comprehensive feature scanning engine. This engine can obtain the hit results of all protection capabilities with a single business packet scan. In other words, business traffic returns the results of all protections, i.e., the hit features, after a single scan of the engine library. This improves the scanning efficiency of business traffic through the feature engine library and increases the business processing speed of the next-generation cloud firewall. All features are used to create a unified feature engine library.

[0023] (3) Cloud next-generation firewall products can support a wide range of application layer protection capabilities, such as IPS, AV, WAF, threat intelligence analysis, etc.

[0024] (4) Specify the markings for multiple application layer protections, reconstruct the feature IDs of multiple protections, ensure that all feature IDs are unique and traceable to the protection to which the feature belongs. Attached Figure Description

[0025] The accompanying drawings are for illustrative purposes only and are not intended to limit the invention. Throughout the drawings, the same reference numerals denote the same parts. It is obvious that the drawings described below are merely some embodiments of the present invention, and those skilled in the art can obtain other drawings based on these drawings.

[0026] Figure 1This is a flowchart illustrating a method for enhancing application-layer protection capabilities using a unified threat signature scanning engine, according to an embodiment of the present invention.

[0027] Figure 2 This is a schematic diagram illustrating an example of feature rules in an embodiment of the present invention;

[0028] Figure 3 This is an example diagram of a protection capability feature information storage structure according to an embodiment of the present invention;

[0029] Figure 4 After processing the feature library IDs for all protection capabilities in this embodiment of the invention, a unified engine library example diagram is generated.

[0030] Figure 5 This is a flowchart illustrating the message processing of an embodiment of the present invention. Detailed Implementation

[0031] To enable those skilled in the art to better understand the technical solutions in the embodiments of the present invention, the technical solutions of the present invention will be clearly and completely described below with reference to the accompanying drawings. Obviously, the described embodiments are only some embodiments of the present invention, not all embodiments. It should be understood that these descriptions are merely exemplary and are not intended to limit the scope of the present invention. Based on the embodiments of the present invention, all other embodiments obtained by those skilled in the art without creative effort should fall within the scope of protection of the present invention.

[0032] Furthermore, descriptions of well-known structures and techniques are omitted in the following description to avoid unnecessarily obscuring the concepts disclosed in this invention.

[0033] In the description of this invention, it should be noted that, unless otherwise explicitly specified and limited, the terms "center," "upper," "lower," "left," "right," "vertical," "horizontal," "inner," and "outer," etc., indicating orientation or positional relationships based on the orientation or positional relationships shown in the accompanying drawings, are only for the convenience of describing the invention and simplifying the description, and do not indicate or imply that the device or element referred to must have a specific orientation, or be constructed and operated in a specific orientation, and therefore should not be construed as a limitation of the invention. Furthermore, the terms "first," "second," and "third" are used for descriptive purposes only and should not be construed as indicating or implying relative importance. The terms "installed," "connected," and "linked" should be interpreted broadly; for example, they can refer to a fixed connection, a detachable connection, or an integral connection; they can refer to a mechanical connection or an electrical connection; they can refer to a direct connection or an indirect connection through an intermediate medium; and they can refer to the internal communication of two components. Those skilled in the art can understand the specific meaning of the above terms in this invention based on the specific circumstances.

[0034] Exemplary embodiments will now be described in detail, examples of which are illustrated in the accompanying drawings. When the following description relates to the drawings, unless otherwise indicated, the same numerals in different drawings denote the same or similar elements. The embodiments described in the following exemplary embodiments do not represent all embodiments consistent with the present invention. Rather, they are merely examples of methods and systems consistent with some aspects of the invention as detailed in the appended claims.

[0035] The technical terms involved in this invention are explained below:

[0036] An IPS (Intrusion Prevention System) is a computer network security protection capability that monitors the network data transmission behavior of a network or network device. It can promptly interrupt, adjust, or isolate abnormal or harmful network data transmission behavior, identify malicious traffic, and proactively prevent such traffic from entering the assets of the protected object.

[0037] CVE (Common Vulnerabilities & Exposures) is a general vulnerability disclosure database. A CVE acts like a dictionary, providing a common name for widely recognized information security vulnerabilities or exposed weaknesses. Using a common name helps users share data across various independent vulnerability databases and vulnerability assessment tools, even though these tools are difficult to integrate. This makes CVE a "keyword" for security information sharing. If a vulnerability report specifies a vulnerability with a CVE name, you can quickly find corresponding patch information in any other CVE-compatible database to resolve the security issue.

[0038] like Figure 1 As shown, this invention provides a method for improving the scanning efficiency of a unified scanning engine for threat features of application-layer protection capabilities. This method is a way to improve the scanning efficiency of a unified scanning engine for the co-construction and sharing of threat features of multiple application-layer protection capabilities in the next-generation cloud firewall. It relates to the field of cloud security network communication technology, and in particular to the field of cloud security application-layer data security scanning and processing.

[0039] The method provided by this invention enables multiple application-layer protection capabilities of the next-generation cloud firewall. Instead of building a separate feature engine for each protection capability's feature library, the feature content of all protection capabilities' features in the feature library is used to jointly build a comprehensive feature engine. Business traffic only needs to pass through the comprehensive feature engine once to achieve security detection of all protection capabilities.

[0040] like Figure 1 As shown, the threat signature unified scanning engine scanning improvement method for application layer protection capabilities provided by this invention includes the following steps:

[0041] S1, each protection capability in the application layer establishes its own feature description information storage data structure to generate a feature library.

[0042] Specifically, it should be clarified that the feature library for each protection capability is independent, and the feature (rule) in the feature library is uniquely determined by the feature rule ID as the key.

[0043] In embodiments of the present invention, the feature rule ID number occupies 32 bits (4 bytes). Excluding the rule ID, each feature includes: a feature description and feature content. For example... Figure 2 As shown, the feature description includes a description of the feature (e.g., what type of CVE it is), the feature's priority, and the action the feature performs. The feature content includes key information about whether it constitutes a threat.

[0044] Each protection capability establishes its own feature description information storage data structure. Taking IPS capability as an example, the global radix tree Ips_radix_tree stores each feature in the IPS feature library, using {ID, description, priority, action} information, with the ID as the key, and attaches it to the Ips_radix_tree, such as... Figure 3 As shown.

[0045] S2 marks the feature rule IDs of all protection capabilities to establish a comprehensive feature engine library.

[0046] Specifically, a comprehensive feature engine is built for all protection capabilities. This engine is a finite state machine for multi-pattern matching, typically generated using the AC algorithm or the Hyperscan tool. The AC algorithm is a classic multi-pattern matching algorithm, while Hyperscan is a high-performance regular expression engine and a regular expression matching tool.

[0047] The comprehensive feature engine records all processed feature rule IDs, which is essentially a feature rule ID library for subsequent matching.

[0048] It should be noted that the method provided in this invention does not elaborate on the principle of the finite state machine, but only uses it.

[0049] like Figure 4As shown, for the features of all protection capabilities' feature libraries, the feature rule IDs are first modified. Based on experience, the feature library size for each protection capability is limited. The rule ID is 32 bits, and the lower 24 bits, i.e., 0xFFFFFF, have a size of 16,777,215, which satisfies any feature library specification. Therefore, theoretically, the higher 8 bits of the rule ID should always be 0. Using this 8-bit information, the higher 8 bits, from 0x01 to 0xFF, are manually assigned to classify different protection capabilities. This serves as the protection classification to distinguish features. After modifying the feature rule IDs based on this, the feature library rule IDs for all protection capabilities are unique.

[0050] For example, in IPS capabilities, the high 8 bits of the rule ID for each IPS feature can be specified as 0x01, which is used to distinguish the protection classification of the feature.

[0051] It should be noted that the method provided by this invention calculates that the number of protection capabilities of the next-generation cloud firewall does not exceed 16, so 8 bits (1 byte) are sufficient for differentiation. If the number of protection capabilities exceeds 16, bits can be borrowed from higher bits, for example, the high 8 bits can be changed to the high 10 bits, and the low 22 bits can still meet the feature specifications.

[0052] S3 executes application-layer business protection processing. Business traffic is scanned by the comprehensive feature engine library, and all hit features are returned. The feature rule IDs are reverse-processed into features of their respective protection capabilities. The feature description information storage data structure of each protection capability is searched to obtain the hit feature information. Log information is sent, the execution action of the features is processed, and it is determined whether to block or allow the business traffic.

[0053] like Figure 5 As shown, the business traffic is scanned by the comprehensive feature engine. According to the principle of multi-mode matching of the scanning engine, the business traffic passes through the scanning engine once, and all hit results are generated. The corresponding feature rule ID is the hit feature rule ID. All hit feature rule IDs are traversed, and the high 8 bits of each ID are checked to identify the category of protection capability. The high 8 bits of the feature rule ID are cleared to zero. The resulting feature rule ID is the actual rule ID of this protection capability.

[0054] On the global radix tree Xxx_radix_tree of this protection capability, find the actual feature rule ID, and then obtain the feature description data structure {ID, descript, priority, action}. For all hit features of this protection capability, extract the information of the feature description data structure to perform attack hit log processing. Based on the priority of all features, determine the feature to be executed and execute the action of the feature, that is, determine whether to block or allow the traffic of this service.

[0055] The proposed method for enhancing the unified scanning engine of threat features for application-layer protection capabilities is to create a description information storage structure for the feature libraries of various protection capabilities of the next-generation cloud firewall, with each protection capability as a unit. After feature rule ID tagging and processing, a unified feature engine library is established for all protection capability feature libraries, thereby improving the efficiency of processing business traffic in the engine library and applying it to the application-layer protection services of the next-generation cloud firewall.

[0056] The proposed method for enhancing application-layer protection capabilities through a unified threat signature scanning engine can be applied to scenarios such as cloud security, cloud firewalls, and network security, enabling deep packet inspection of application-layer packet data.

[0057] The proposed method for enhancing application-layer protection capabilities through a unified threat signature scanning engine has the following advantages:

[0058] (1) The business content of the features in the feature library of all protection capabilities are used to jointly build a comprehensive feature engine. Business traffic only needs to pass through the comprehensive feature engine once to realize the security detection of all protection capabilities, improve business processing efficiency, and improve the detection efficiency of application layer protection.

[0059] (2) Multiple application-layer protection capabilities can be generated through manual classification, resulting in a comprehensive feature scanning engine. This engine can obtain the hit results of all protection capabilities with a single business packet scan. In other words, business traffic returns the results of all protections, i.e., the hit features, after a single scan of the engine library. This improves the scanning efficiency of business traffic through the feature engine library and increases the business processing speed of the next-generation cloud firewall. All features are used to create a unified feature engine library.

[0060] (3) Cloud next-generation firewall products can support a wide range of application layer protection capabilities, such as IPS, AV, WAF, threat intelligence analysis, etc.

[0061] (4) Specify the markings for multiple application layer protections, reconstruct the feature IDs of multiple protections, ensure that all feature IDs are unique and traceable to the protection to which the feature belongs.

[0062] Finally, it should be noted that the above embodiments are only used to illustrate the technical solutions of the embodiments of the present invention, and are not intended to limit them. Although the present invention has been described in detail with reference to the foregoing embodiments, those skilled in the art should understand that modifications can still be made to the technical solutions described in the foregoing embodiments, or equivalent substitutions can be made to some of the technical features; and these modifications or substitutions do not cause the essence of the corresponding technical solutions to deviate from the spirit and scope of the technical solutions of the embodiments of the present invention. Any changes or substitutions that can be easily conceived by those skilled in the art within the scope of the technology disclosed in the present invention should be included within the protection scope of the present invention.

Claims

1. A method for enhancing application-layer protection capabilities using a unified threat signature scanning engine, characterized in that, include: S1, each protection capability in the application layer establishes its own feature description information storage data structure to generate a feature library; wherein, the feature library of each protection capability is independent, and the feature description information in the feature library uses the feature rule ID as the key to uniquely determine the feature; S2, mark the feature rule IDs of all protection capabilities and establish a comprehensive feature engine library; The establishment of the comprehensive feature engine library includes: modifying the feature rule IDs for the features of all protection capabilities, taking the lower 24 bits of the feature rule ID and setting the higher 8 bits from 0x01 to 0xFF as the classification of different protection capabilities, and using this as the protection classification to distinguish features. After modifying the feature rule IDs based on this, the feature library rule IDs of all protection capabilities are unique. S3, execute application layer business protection processing. The business traffic is scanned by the comprehensive feature engine library and all hit features are returned. The feature rule ID is reverse-processed into the features of their respective protection capabilities. The feature description information storage data structure of each protection capability is searched to obtain the hit feature information. Log information is sent, the execution action of the feature is processed, and it is determined whether to prohibit or allow the business traffic.

2. The method for enhancing application-layer protection capabilities using a unified threat signature scanning engine according to claim 1, characterized in that, In step S1, the feature rule ID is 32 bits.

3. The method for enhancing application-layer protection capabilities using a unified threat signature scanning engine according to claim 1 or 2, characterized in that, In step S1, Each feature includes: feature description and feature content, wherein the feature description includes feature description information, feature priority, and feature execution action; the feature content includes: key information on whether it is a threat.

4. The method for enhancing application-layer protection capabilities using a unified threat signature scanning engine according to claim 3, characterized in that, In step S2, A comprehensive feature engine is established for all protection capabilities, and the comprehensive feature engine is a multi-mode matching finite state machine.

5. The method for enhancing application-layer protection capabilities using a unified threat signature scanning engine according to claim 4, characterized in that, The comprehensive feature engine is generated using the AC algorithm or the hyperscan tool.

6. The method for enhancing application-layer protection capabilities using a unified threat signature scanning engine according to claim 1, characterized in that, In step S3, the service traffic is scanned by the comprehensive feature engine. According to the multi-mode matching principle of the scanning engine, the service traffic is scanned by the comprehensive feature engine once, and all hit results are generated. The corresponding result is the hit feature rule ID. By traversing all the hit rule IDs, the ID obtained is the actual feature rule ID of this protection capability.

7. The method for enhancing application-layer protection capabilities using a unified threat signature scanning engine according to claim 6, characterized in that, The actual feature rule ID is searched on the global radix tree Xxx_radix_tree of this protection capability, and then the descriptive data structure of the feature is obtained.

8. The method for enhancing application-layer protection capabilities using a unified threat signature scanning engine according to claim 6, characterized in that, Iterate through all the matched feature rule IDs, check the high 8 bits of each feature rule ID to identify the category of protection capability, clear the high 8 bits of the feature rule ID to zero, and the resulting feature rule ID is the actual rule ID of this protection capability.

9. The method for enhancing application-layer protection capabilities using a unified threat signature scanning engine according to claim 6, characterized in that, For all hit characteristics of the protection capability, extract the information of the feature description data structure for attack hit log processing, determine the features that need to be executed according to the priority of all features, and execute the action for that feature.

Images