Network attack intrusion detection method and device

Abstract

The invention discloses a network attack intrusion detection method and device, and the method comprises the steps: carrying out the sorting and screening of rules in an initial rule library, obtaining an optimized rule library, carrying out the detection and defense of network threat intrusion according to the optimized rule library, and improving the detection and defense efficiency and accuracy of network attack intrusion.

Description

Technical Field

[0001] The present application relates to the field of network security technology, and in particular to a network attack intrusion detection method and device. Background Art

[0002] With the rapid development of the Internet, network security issues are becoming increasingly prominent. At present, network attack methods are constantly evolving, and network security vulnerabilities are also increasing. These factors have brought huge challenges to information security. Therefore, how to detect network attack methods and defend against them has become particularly important.

[0003] At present, network attack intrusion detection systems identify various types of network attacks through a large number of rules in the rule base. However, with the increase of network threats, the use of a large number of rules for identification will lead to a decline in system performance and low detection efficiency. Summary of the invention

[0004] The embodiments of the present application provide a network attack intrusion detection method and device to improve the detection efficiency and accuracy of network attack intrusion detection.

[0005] In a first aspect, an embodiment of the present application provides a network attack intrusion detection method, the method comprising: obtaining a first rule base, and sorting the rules in the first rule base to obtain a re-sorted second rule base; screening and optimizing the rules in the second rule base to obtain a third rule base; and performing intrusion detection on the network attack based on the third rule base.

[0006] In a possible implementation, sorting the rules in the first rule base to obtain a re-sorted second rule base includes:

[0007] Determine the hotspot scores of the rules included in the first rule base; sort the rules included in the first rule base in order from low to high according to the hotspot scores to obtain a second rule base.

[0008] In a possible implementation manner, determining the hotspot score of the rule included in the first rule base includes:

[0009] The hotspot scores of the rules included in the first rule base are determined according to the multi-dimensional data, wherein the multi-dimensional data includes cumulative priority, risk level, and prevalence.

[0010] In a possible implementation, the second rule base includes n rules, where n is a positive integer;

[0011] The rules in the second rule base are screened and optimized to obtain a third rule base, including:

[0012] According to the customer intranet device service information, m rules that are strongly related to the customer intranet device service information are filtered out from the second rule base, where m is a positive integer less than n; the m rules are arranged in the first m positions, and the remaining (nm) rules are arranged in the last (nm) positions; according to the maximum number of rules N that can be loaded by the customer intranet device, the first N rules are filtered out from the n rules, and the set consisting of the first N rules is used as the third rule base.

[0013] In a second aspect, the present application provides a network attack intrusion detection device, which may include an acquisition module, a processing module, and a detection module. The acquisition module is used to acquire a first rule base; the processing module is used to sort the rules in the first rule base to obtain a re-sorted second rule base, and to screen and optimize the rules in the second rule base to obtain a third rule base; the detection module is used to perform intrusion detection on network attacks based on the third rule base.

[0014] In a third aspect, the present application provides a network attack intrusion detection device, comprising: at least one processor, and a memory communicatively connected to the at least one processor, wherein:

[0015] The memory stores a computer program that can be executed by at least one processor, and the computer program is executed by the at least one processor so that the at least one processor can execute the above-mentioned first aspect and any possible design method of the first aspect.

[0016] In a fourth aspect, the present application also provides a storage medium. When the computer program in the storage medium is executed by a processor of a network attack intrusion detection device, the network attack intrusion detection device can execute the above-mentioned first aspect and any possible design method of the first aspect.

[0017] In a fifth aspect, the present application also provides a computer program product. When the computer program product runs on a network attack intrusion detection device, the network attack intrusion detection device executes the above-mentioned first aspect and any possible design method of the first aspect.

[0018] It should be understood that the beneficial effects achieved by the technical solutions of the second to fifth aspects of the embodiments of the present application and the corresponding feasible implementation methods can be referred to the technical effects of the first aspect and its corresponding possible implementation methods mentioned above, and will not be repeated here. BRIEF DESCRIPTION OF THE DRAWINGS

[0019] Figure 1 A schematic diagram of an application scenario provided for an embodiment of the present application;

[0020] Figure 2 A schematic block diagram of a network attack detection method provided in an embodiment of the present application;

[0021] Figure 3 A flow chart of a network attack detection method provided in an embodiment of the present application;

[0022] Figure 4 A schematic diagram of a rule change provided in an embodiment of the present application;

[0023] Figure 5 A schematic diagram of a rule change provided in an embodiment of the present application;

[0024] Figure 6 A schematic diagram of the structure of a network attack intrusion detection device provided in an embodiment of the present application;

[0025] Figure 7 A schematic diagram of the structure of a network attack intrusion detection device provided in an embodiment of the present application. DETAILED DESCRIPTION

[0026] The preferred embodiments of the present application are described below in conjunction with the drawings in the specification. It should be understood that the preferred embodiments described herein are only used to illustrate and explain the present application, and are not used to limit the present application. In addition, the embodiments and features in the embodiments of the present application may be combined with each other if there is no conflict.

[0027] It should be understood that in the description of the embodiments of the present application, the term "including" and similar terms should be understood as open inclusion, that is, "including but not limited to". The term "based on" should be understood as "based at least in part on". The term "one embodiment" or "the embodiment" should be understood as "at least one embodiment". The terms "first", "second", etc. can refer to different or identical objects. "At least one" means one or more, and "multiple" means two or more. "And / or" describes the association relationship of associated objects, indicating that three relationships may exist. For example, A and / or B can mean: including the existence of A alone, the existence of A and B at the same time, and the existence of B alone. "At least one of the following items" or similar expressions refers to any combination of these items. For example, at least one of a, b, or c can mean: a, b, c, ab, ac, bc, or abc, where a, b, c can be single or multiple.

[0028] For example, Figure 1 FIG. 1 is a schematic diagram of an application scenario provided by an embodiment of the present application. Figure 1 As shown, the application scenario may include a client 10 and a server 20. The client 10 may be a network attack intrusion detection device, and the server 20 may be a cloud.

[0029] In some embodiments, the server 20 can evaluate the initial rule base based on multi-dimensional data, determine the popularity and value of the rules in the rule base, and then adjust the order of the rules in the initial rule base. Then, the rules can be further sorted based on customer needs, and finally the number of rules corresponding to the maximum number of rules that the device can load is selected from the sorted rules to obtain the final rule base and send it to the client 10. The client 10 receives the rule base sent by the server 20, and then when a security attack is detected, it defends against the security attack based on the received rule base.

[0030] It should be understood that the initial rule base can be a traffic detection rule base, including but not limited to open source rule formats such as Snort, Suricata, and private traffic detection rules in custom formats and detection methods. In this application, all kinds of predefined rules for detecting network traffic can be included in the protection scope of the rule base described in the embodiments of this application.

[0031] like Figure 2 FIG. 1 is a schematic diagram of a network attack detection method provided by an embodiment of the present application. Figure 2 As shown, it may include a customer network attack intrusion detection device and cloud rule generation and distribution. It should be understood that the customer network attack intrusion detection device can be understood as Figure 1 On the client 10 side shown, the cloud rule generation and distribution can be understood as Figure 1 The service end 20 side is shown.

[0032] Specifically, the cloud first initializes the rule base, and then adjusts the order of rules in the rule base based on the rule heat scoring mechanism. Next, the cloud generates a customized customer rule base based on the intranet device service information sent by the asset service collection module of the customer network attack intrusion detection device. After obtaining the customized customer rule base, the final rules are filtered out from the customized customer rule base based on the maximum number of rules loaded on the device, forming the final rule base and sending it to the customer network attack intrusion detection device.

[0033] Correspondingly, the network attack intrusion detection module on the customer's network attack intrusion detection device can identify and defend against security attacks based on the final rule library when a security attack is detected, thereby making the detection efficiency of security attacks higher and being able to defend against attacks in a timely manner.

[0034] Among them, the customer network attack intrusion detection device end may include an asset information collection and analysis module and a network attack intrusion detection module. The asset information collection and analysis module may include intranet asset service collection and intranet asset list table (asset service list generation); the network attack intrusion detection module may include a detection engine and an optimized rule base.

[0035] The asset information collection and analysis module is used to comprehensively monitor and collect asset information in the intranet using deep packet inspection (DPI) technology, application identification algorithms, and user-defined configurations. This asset information may include key security attributes such as asset type, operating system, application version, and open ports. The asset service list is generated by the customer's intrusion device end processing and integrating the collected asset information to form a detailed intranet asset service list. The list includes not only static asset information, but may also include traffic behavior characteristics, providing an accurate basis for the customized rule base for the cloud rule generation and sending end.

[0036] The client network attack intrusion detection device can also exchange data with the cloud rule generation and dispatching end through a secure communication protocol. The client network attack intrusion detection device can regularly upload updated asset service lists to the cloud so that the cloud can optimize the rule base based on this information. The client network attack intrusion detection device can also receive rule bases customized according to the intranet asset service list from the cloud. These rule bases are intelligently optimized by the cloud to ensure a high degree of match with the network environment of the device.

[0037] The customer network attack intrusion detection device loads and applies the issued customized rule base to monitor and analyze the traffic in real time. Once a potential security threat is detected, the customer network attack intrusion detection device will automatically take response measures such as blocking malicious traffic and recording security events according to the preset security policy, or prompt the network administrator for further processing. In this way, the customer network attack intrusion detection device can efficiently perform network security protection tasks while maintaining close coordination with the cloud rule generation and issuance end to ensure the real-time and effectiveness of the network security protection system.

[0038] It should be understood that in the embodiments of the present application, the generation of the rule base can be executed by the server or by the client, and there is no limitation on this. The server execution is merely used as an example for explanation.

[0039] The attack detection and defense process of the embodiment of the present application is described in detail below. Figure 3 As shown, it is a flow chart of a network attack detection method provided by an embodiment of the present application, see Figure 3 As shown, the method may include the following steps:

[0040] Step 301: Obtain a first rule base.

[0041] For the convenience of description, the initial rule base may be referred to as: the first rule base.

[0042] In some embodiments, the initial rule base may be a traffic detection rule base, such as a private traffic detection rule in an open source rule format such as Snort, Suricata, or a custom format and detection method. Assuming that the initial rule base includes n rules, the initial rule base is denoted as: R_n. Then, R_n may be (rule_1, rule_2, rule_3, ..., rule_n), and the order of the rules in R_n may be considered random.

[0043] Step 302: Adjust the order of the rules in the first rule base based on the multi-dimensional data to obtain a second rule base.

[0044] The multi-dimensional data may include cumulative priority, risk level, popularity, etc. In the embodiment of the present application, by calculating the multi-dimensional data of the rules in the initial rule base, the popularity and value of each rule can be determined, and then the rules in the initial rule base are sorted based on the popularity and value of the rules.

[0045] For the convenience of description, the rule base obtained in step 302 can be recorded as: the second rule base. Assume that the second rule base after adjusting the order based on the multi-dimensional data is recorded as: M_n, M_n is (rule_a1, rule_a2, rule_a3, ..., rule_an). For example, the heat of the i-th rule rule_ai in M_n can be recorded as score_ai, i∈[1, n], then the heat of the rules in M_n satisfies the following conditions: (score_a1≤score_a2≤score_a3≤...≤score_an).

[0046] In some embodiments, the hotspot rule score may be calculated by the following formula:

[0047] score=s p *p w +severity*s w +(year c -year n +y b )+accuracy*a w

[0048] +popu*popu w

[0049] Where: s p It represents the cumulative value of rule priority, which is accumulated according to the corresponding priorities of multiple attribute labels of a specific rule. Assume that rule r i There are k labels (T1, T2, ..., T k ), each tag has a corresponding priority (p1, p2, ..., pk ), then rule r i The cumulative priority of s p Can be:

[0050]

[0051] Severity indicates the risk level of the rule. For rules with specific Common Vulnerabilities Exposures (CVE) numbers, the severity value is set according to the Common Vulnerability Scoring System (CVSS) score. For example, when CVSS∈[0, 4.0), the severity is 0; when CVSS∈[4.0, 7.0), the severity is 1; when CVSS∈[7.0, 9.0), the severity is 2; when CVSS∈[9.0, 10.0], the severity is 3; for rules without specific CVE numbers, the risk level severity value corresponding to the rule classification Classtype is used.

[0052] year c Indicates the year the rule was created; year n Indicates the year when the rule screening is performed; accuracy indicates the accuracy level of the rule, describing the false positive situation of the rule; popu indicates the popularity of the rule, which is assigned according to the matching frequency of a specific rule within a specified time window; p w ,s w , a w , popu w represents a specific weight; y b Indicates a specific bias.

[0053] The above formula can be used to calculate the hotspot score of each rule in the initial rule base R_n, and then the rules in the initial rule base can be sorted from low to high according to the hotspot score, thereby obtaining the rule base M_n. For example, Figure 4 The figure is a schematic diagram of a rule change provided by an embodiment of the present application. Figure 4 It can be seen that compared with the two rule bases R_n and M_n, the number of rules in the rule base remains unchanged, only the order of the rules changes.

[0054] Step 303: Optimize the second rule base based on the client device information to obtain a third rule base.

[0055] In some embodiments, step 303 may include two sub-steps:

[0056] Sub-step 1: further sorting the rules in the second rule base based on the customer intranet device service information.

[0057] In this step, the client network attack intrusion detection device can send the intranet device service information to the server, and then adjust the order of the rules associated with specific manufacturers, products, versions, and ports based on the intranet device service information, so that the order of these related rules is ranked first. For example, assume that the rule obtained in sub-step 1 is recorded as: Q_n. Figure 5 The figure is a schematic diagram of a rule change provided by an embodiment of the present application. Figure 5 It can be seen that the number of rules in Q_n has not changed compared with M_n, but only the order of some rules has changed. The total number of rules is n. In sub-step 1, m strongly related rules are selected and placed in the first m positions of n rules. The remaining (nm) rules are arranged in order after the mth position.

[0058] Since different users have different network environments and security requirements, the dynamic rule sorting mechanism based on user internal assets in the embodiment of the present application can adjust the priority sorting of rules in the rule base in real time according to the asset characteristics of the user's network environment and the vulnerability risk assessment results, so as to ensure that the rule base is highly consistent with user needs and improve the accuracy and practicality of threat detection.

[0059] Sub-step 2: Optimize the rule base obtained in sub-step 1.

[0060] In this step, the rules in Q_n can be screened, and the first N rules in Q_n can be screened according to the maximum number of rules loaded by the device (for example, N), and the set of the first N rules is used as the third rule base. Figure 5 For example, assuming N is m, then the N rules rule_ax to rule_am in Q_n can be selected.

[0061] It should be understood that due to differences in client device models, system versions and other information, the maximum number of rules that can be loaded on a client device may also vary.

[0062] Sub-step 2 can solve the problem that some network attack intrusion detection / defense devices in the prior art cannot load a large number of rules due to hardware performance limitations. In the embodiment of the present application, through the rule sorting mechanism, the device can preferentially load high-value rules suitable for its performance characteristics, thereby achieving efficient threat detection and protection under resource-constrained conditions.

[0063] Step 304: Detect and defend against network attacks according to the third rule base.

[0064] In some embodiments, when a threat to network security is detected, the client may perform detection and defense according to the third rule base, thereby improving the efficiency and accuracy of detecting network security threats.

[0065] It should be understood that Figure 3 In the illustrated embodiment, steps 301 to 303 may be executed by the server, or by the client, which is not limited in this application. If executed by the server, then before step 304, the following may be included: the server sends the third rule base to the client, the client receives the third rule base, and then detects and defends against network security threats based on the third rule base.

[0066] In the embodiments of the present application, by optimizing the priority order of rules in the rule base, the overall performance of the network attack intrusion detection / defense system can be improved, including improving the accuracy of threat detection, reducing false alarm rate, shortening response time, etc., thereby improving system performance and the efficiency of threat detection, thereby effectively preventing various types of network security threats and ensuring the security of the network and data.

[0067] Based on the same technical concept, the embodiment of the present application also provides a network attack intrusion detection device. The principle of solving the problem by the device is similar to the above method. Therefore, the implementation of the device can refer to the implementation of the method, and the repeated parts will not be repeated.

[0068] Figure 6 A schematic diagram of the structure of a network attack intrusion detection device 600 provided in an embodiment of the present application, wherein the network attack intrusion detection device 600 may include an acquisition module 601 , a processing module 602 , and a detection module 603 .

[0069] Among them, the acquisition module 601 is used to obtain the first rule base; the processing module 602 is used to sort the rules in the first rule base to obtain the re-sorted second rule base, and screen and optimize the rules in the second rule base to obtain the third rule base; the detection module 603 is used to perform intrusion detection on network attacks based on the third rule base.

[0070] In a possible design, the processing module 602 is specifically configured to sort the rules in the first rule base in the following manner to obtain a re-sorted second rule base:

[0071] Determine the hotspot scores of the rules included in the first rule base; sort the rules included in the first rule base in order from low to high according to the hotspot scores to obtain a second rule base.

[0072] In a possible design, the processing module 602 is specifically configured to determine the hotspot score of the rule included in the first rule base in the following manner:

[0073] The hotspot scores of the rules included in the first rule base are determined according to the multi-dimensional data, wherein the multi-dimensional data includes cumulative priority, risk level, and prevalence.

[0074] In a possible design, the second rule base includes n rules, where n is a positive integer;

[0075] The processing module 602 is specifically used to filter and optimize the rules in the second rule base in the following manner to obtain a third rule base:

[0076] According to the customer intranet device service information, m rules that are strongly related to the customer intranet device service information are filtered out from the second rule base, where m is a positive integer less than n; the m rules are arranged in the first m positions, and the remaining (nm) rules are arranged in the last (nm) positions; according to the maximum number of rules N that can be loaded by the customer intranet device, the first N rules are filtered out from the n rules, and the set consisting of the first N rules is used as the third rule base.

[0077] The division of modules in the embodiments of the present application is schematic and is only a logical function division. There may be other division methods in actual implementation. In addition, the functional modules in the embodiments of the present application may be integrated in a processor, or may exist physically separately, or two or more modules may be integrated in one module. The coupling between the modules may be achieved through some interfaces, which are usually electrical communication interfaces, but it is not excluded that they may be mechanical interfaces or other forms of interfaces. Therefore, the modules described as separate components may or may not be physically separated, and may be located in one place or distributed to different locations of the same or different devices. The above-mentioned integrated modules may be implemented in the form of hardware or in the form of software functional modules.

[0078] As an example, when the acquisition module 601 is a transceiver, and the processing module 602 and the detection module 603 are processors, the network attack intrusion detection device 600 involved in the embodiment of the present application can be as follows: Figure 7 See Figure 7 As shown, a network attack intrusion detection device 700 provided in an embodiment of the present application is provided. The network attack intrusion detection device 700 may include a transceiver 701, a processor 702, and a memory 703. The memory 703 stores instructions or programs, and the processor 702 is used to execute the instructions or programs stored in the memory 703.

[0079] It should be understood that the network attack intrusion detection device 600 or the network attack intrusion detection device 700 according to the embodiment of the present application can be the client (client network attack intrusion detection device) or the server (cloud) described in the embodiment, and the operation and / or function of each module in the network attack intrusion detection device 600 or the network attack intrusion detection device 700 are respectively to achieve Figure 3 For the sake of brevity, the corresponding processes in the illustrated embodiment will not be described in detail here.

[0080] It should be understood that the processor mentioned in the embodiments of the present application may be a central processing unit (CPU), or other general-purpose processors, digital signal processors (DSP), application specific integrated circuits (ASIC), field programmable gate arrays (FPGA) or other programmable logic devices, discrete gate or transistor logic devices, discrete hardware components, etc. A general-purpose processor may be a microprocessor or the processor may also be any conventional processor, etc.

[0081] It should also be understood that the memory mentioned in the embodiments of the present application may be a volatile memory or a non-volatile memory, or may include both volatile and non-volatile memories. Among them, the non-volatile memory may be a read-only memory (ROM), a programmable read-only memory (PROM), an erasable programmable read-only memory (EPROM), an electrically erasable programmable read-only memory (EEPROM), or a flash memory. The volatile memory may be a random access memory (RAM), which is used as an external cache. By way of example and not limitation, many forms of RAM are available, such as static RAM (SRAM), dynamic RAM (DRAM), synchronous DRAM (SDRAM), double data rate synchronous dynamic random access memory (doubledatarate SDRAM, DDR SDRAM), enhanced synchronous dynamic random access memory (enhanced SDRAM, ESDRAM), synchronous link dynamic random access memory (synchlink DRAM, SLDRAM), and direct rambus RAM (DR RAM).

[0082] It should be noted that when the processor is a general-purpose processor, DSP, ASIC, FPGA or other programmable logic device, discrete gate or transistor logic device, discrete hardware component, the memory (storage module) is integrated in the processor.

[0083] It should be noted that the memory described herein is intended to include, but is not limited to, these and any other suitable types of memory.

[0084] Based on the same inventive concept, an embodiment of the present application further provides a storage medium, which stores computer instructions. When the computer instructions are executed on a computer, the computer executes the data granularity adjustment method discussed above.

[0085] A computer program product is also provided in an embodiment of the present application, including instructions, which, when executed on a computer, enable the computer to execute the method provided in the above embodiment.

[0086] In some possible implementations, various aspects of the data granularity adjustment method provided in the present application can also be implemented in the form of a program product, which includes a program code. When the program product is run on a device, the program code is used to enable the device to execute the steps of the risk identification method according to various exemplary embodiments of the present application described above in this specification.

[0087] Those skilled in the art will appreciate that the embodiments of the present application may be provided as methods, systems, or computer program products. Therefore, the present application may adopt the form of a complete hardware embodiment, a complete software embodiment, or an embodiment in combination with software and hardware. Moreover, the present application may adopt the form of a computer program product implemented in one or more computer-usable storage media (including but not limited to disk storage, CD-ROM, optical storage, etc.) that include computer-usable program code.

[0088] The present application is described with reference to the flowcharts and / or block diagrams of the methods, devices (systems), and computer program products according to the embodiments of the present application. It should be understood that each process and / or box in the flowchart and / or block diagram, as well as the combination of the processes and / or boxes in the flowchart and / or block diagram, can be implemented by computer program instructions. These computer program instructions can be provided to a processor of a general-purpose computer, a special-purpose computer, an embedded processor, or other programmable data processing device to generate a machine, so that the instructions executed by the processor of the computer or other programmable data processing device generate instructions for implementing the processes in the flowchart and / or block diagram. Figure 1 A process or multiple processes and / or boxes Figure 1 A device that provides the functions specified in a block or multiple blocks.

[0089] These computer program instructions may also be stored in a computer-readable memory capable of directing a computer or other programmable data processing device to operate in a specific manner, so that the instructions stored in the computer-readable memory produce an article of manufacture comprising an instruction device, which implements the process Figure 1 A process or multiple processes and / or boxes Figure 1 A function specified in one or more boxes.

[0090] These computer program instructions can also be loaded onto a computer or other programmable data processing device so that a series of operating steps are executed on the computer or other programmable device to produce a computer-implemented process, thereby providing instructions for implementing the process. Figure 1 A process or multiple processes and / or boxes Figure 1 The steps for the functions specified in one or more boxes.

[0091] Obviously, those skilled in the art can make various changes and modifications to the present application without departing from the spirit and scope of the present application. Thus, if these modifications and variations of the present application fall within the scope of the claims of the present application and their equivalents, the present application is also intended to include these modifications and variations.

Claims

1. A network attack intrusion detection method, characterized in that: include: Acquire a first rule base, and sort the rules in the first rule base to obtain a re-sorted second rule base; Screening and optimizing the rules in the second rule base to obtain a third rule base; Intrusion detection is performed on network attacks based on the third rule base.

2. The method according to claim 1, characterized in that Sorting the rules in the first rule base to obtain a reordered second rule base includes: Determining hotspot scores of rules included in the first rule base; The rules included in the first rule base are sorted in order from low to high according to the hotspot scores to obtain a second rule base.

3. The method according to claim 2, characterized in that The determining of the hotspot scores of the rules included in the first rule base includes: The hotspot scores of the rules included in the first rule base are determined according to the multi-dimensional data, wherein the multi-dimensional data includes cumulative priority, risk level, and prevalence.

4. The method according to claim 1, characterized in that The second rule base includes n rules, where n is a positive integer; The rules in the second rule base are screened and optimized to obtain a third rule base, including: Filtering out m rules in the second rule base that are strongly related to the customer intranet device service information according to the customer intranet device service information, where m is a positive integer less than n; Arrange the m rules in the first m positions, and arrange the remaining (nm) rules in the last (nm) positions; According to the maximum number of rules N that can be loaded by the customer's intranet device, the first N rules are screened out from the n rules, and the set consisting of the first N rules is used as the third rule base.

5. A network attack intrusion detection device, characterized in that: include: An acquisition module, used for acquiring a first rule base; A processing module, configured to sort the rules in the first rule base to obtain a re-sorted second rule base, and to screen and optimize the rules in the second rule base to obtain a third rule base; A detection module is used to perform intrusion detection on network attacks based on the third rule base.

6. The device according to claim 5, characterized in that The processing module is specifically configured to sort the rules in the first rule base in the following manner to obtain a re-sorted second rule base: Determine the hotspot scores of the rules included in the first rule base; sort the rules included in the first rule base in order from low to high according to the hotspot scores to obtain a second rule base.

7. The device according to claim 6, characterized in that The processing module is specifically configured to determine the hotspot scores of the rules included in the first rule base in the following manner: A hotspot score of the rules included in the first rule base is determined according to multi-dimensional data, wherein the multi-dimensional data includes cumulative priority, risk level, and prevalence.

8. The device according to claim 5, characterized in that The second rule base includes n rules, where n is a positive integer; The processing module is specifically used to filter and optimize the rules in the second rule base in the following manner to obtain a third rule base: Filtering out m rules in the second rule base that are strongly related to the customer intranet device service information according to the customer intranet device service information, where m is a positive integer less than n; Arrange the m rules in the first m positions, and arrange the remaining (nm) rules in the last (nm) positions; According to the maximum number of rules N that can be loaded by the customer's intranet device, the first N rules are screened out from the n rules, and the set consisting of the first N rules is used as the third rule base.

9. A network attack intrusion detection device, characterized in that: include: at least one processor, and a memory communicatively connected to the at least one processor, wherein: The memory stores a computer program executable by the at least one processor, and the computer program is executed by the at least one processor so as to enable the at least one processor to perform the method according to any one of claims 1 to 4.

10. A storage medium, characterized in that: When the computer program in the storage medium is executed by a processor of a network attack intrusion detection device, the network attack intrusion detection device can execute the method according to any one of claims 1 to 4.

Images