A network attack intrusion detection method and device

Abstract

The application discloses a network attack intrusion detection method and device, rules in an initial rule library are sorted and filtered to obtain an optimized rule library, and then network threat intrusion detection and defense are performed according to the optimized rule library, so that the efficiency and accuracy of network attack intrusion detection and defense are improved.

Description

Technical Field

[0001] This application relates to the field of network security technology, and in particular to a method and apparatus for detecting network attack intrusions. Background Technology

[0002] With the rapid development of the internet, cybersecurity issues have become increasingly prominent. Current cyberattack methods are constantly evolving, and cybersecurity vulnerabilities are continuously increasing, all of which pose significant challenges to information security. Therefore, detecting and defending against cyberattacks has become particularly important.

[0003] Currently, network attack intrusion detection systems identify various network attacks using a large number of rules in a rule base. However, with the increase in network threats, using a large number of rules for identification can lead to a decrease in system performance and low detection efficiency. Summary of the Invention

[0004] This application provides a method and apparatus for detecting network attacks and intrusions, which improves the detection efficiency and accuracy of network attack and intrusion detection.

[0005] In a first aspect, embodiments of this application provide a network attack intrusion detection method, the method comprising: acquiring a first rule base and sorting the rules in the first rule base to obtain a reordered second rule base; filtering and optimizing the rules in the second rule base to obtain a third rule base; and performing intrusion detection on network attacks based on the third rule base.

[0006] In one possible implementation, the rules in the first rule base are sorted to obtain a reordered second rule base, including:

[0007] Determine the hot spot scores of the rules included in the first rule base; sort the rules included in the first rule base in ascending order of hot spot scores to obtain the second rule base.

[0008] In one possible implementation, determining the hotspot rating of the rules included in the first rule base includes:

[0009] The hot topic scores of the rules included in the first rule base are determined based on multi-dimensional data, including cumulative priority, risk level, and popularity.

[0010] In one possible implementation, the second rule base includes n rules, where n is a positive integer;

[0011] The rules in the second rule base are filtered and optimized to obtain the third rule base, which includes:

[0012] Based on the customer's intranet device service information, m rules strongly related to the customer's intranet device service information are selected from the second rule base, where m is a positive integer less than n; the m rules are arranged in the first m positions, and the remaining (nm) rules are arranged in the last (nm) positions; based on the maximum number of rules N that the customer's intranet device can load, the first N rules are selected from the n rules, and the set of the first N rules is used as the third rule base.

[0013] Secondly, this application provides a network attack intrusion detection device, which may include an acquisition module, a processing module, and a detection module. The acquisition module is used to acquire a first rule base; the processing module is used to sort the rules in the first rule base to obtain a reordered second rule base, and to filter and optimize the rules in the second rule base to obtain a third rule base; the detection module is used to perform intrusion detection on network attacks based on the third rule base.

[0014] Thirdly, this application provides a network attack intrusion detection device, comprising: at least one processor, and a memory communicatively connected to the at least one processor, wherein:

[0015] The memory stores a computer program that can be executed by at least one processor, such that the at least one processor is able to perform the methods described in the first aspect and any possible design of the first aspect.

[0016] Fourthly, this application also provides a storage medium in which, when a computer program in the storage medium is executed by a processor of a network attack intrusion detection device, the network attack intrusion detection device is capable of performing the methods described in the first aspect and any possible design of the first aspect.

[0017] Fifthly, this application also provides a computer program product that, when run on a network attack intrusion detection device, causes the network attack intrusion detection device to perform the methods described in the first aspect and any possible design of the first aspect.

[0018] It should be understood that the beneficial effects achieved by the second to fifth aspects of the technical solutions and corresponding feasible implementations of the embodiments of this application can be referred to the above-described technical effects of the first aspect and its corresponding possible implementations, and will not be repeated here. Attached Figure Description

[0019] Figure 1 This is a schematic diagram of an application scenario provided by an embodiment of this application;

[0020] Figure 2 A schematic block diagram of a network attack detection method provided in this application embodiment;

[0021] Figure 3 A flowchart of a network attack detection method provided in this application embodiment;

[0022] Figure 4 A schematic diagram of a rule change provided for an embodiment of this application;

[0023] Figure 5 A schematic diagram of a rule change provided for an embodiment of this application;

[0024] Figure 6 A schematic diagram of the structure of a network attack intrusion detection device provided in an embodiment of this application;

[0025] Figure 7 This is a schematic diagram of the structure of a network attack intrusion detection device provided in an embodiment of this application. Detailed Implementation

[0026] The preferred embodiments of this application are described below with reference to the accompanying drawings. It should be understood that the preferred embodiments described herein are for illustration and explanation only and are not intended to limit this application. Furthermore, the embodiments and features in the embodiments of this application can be combined with each other without conflict.

[0027] It should be understood that in the description of the embodiments of this application, the term "comprising" and similar terms should be understood as open-ended inclusion, i.e., "including but not limited to". The term "based on" should be understood as "at least partially based on". The term "one embodiment" or "this embodiment" should be understood as "at least one embodiment". The terms "first", "second", etc., can refer to different or the same objects. "At least one" means one or more, and "more" means two or more. "And / or" describes the relationship between related objects, indicating that three relationships can exist. For example, A and / or B can mean: A alone, A and B simultaneously, and B alone. "At least one of the following" or similar expressions refer to any combination of these items. For example, at least one of a, b, or c can mean: a, b, c, ab, ac, bc, or abc, where a, b, and c can be single or multiple.

[0028] For example, such as Figure 1 The diagram shown is an application scenario illustration provided by an embodiment of this application. (See attached image.) Figure 1 As shown, this application scenario may include a client 10 and a server 20. The client 10 can be a network attack intrusion detection device, and the server 20 can be a cloud-based application.

[0029] In some embodiments, server 20 can evaluate the initial rule base based on multi-dimensional data to determine the popularity and value of rules in the rule base, and then adjust the order of rules in the initial rule base. Next, it can further sort the rules based on customer needs, and finally select the number of rules corresponding to the maximum number of rules that the device can load from the sorted rules to obtain the final rule base, which is then sent to client 10. Client 10 receives the rule base sent by server 20, and then, when a security attack is detected, defends against the security attack based on the received rule base.

[0030] It should be understood that the initial rule base can be a traffic detection rule base, including but not limited to open-source rule formats such as Snort and Suricata, as well as private traffic detection rules with custom formats and detection methods. In this application, all kinds of predefined rules used to detect network traffic can be included within the protection scope of the rule base described in the embodiments of this application.

[0031] like Figure 2 The diagram shown is a schematic block diagram of a network attack detection method provided in an embodiment of this application. (See attached diagram.) Figure 2 As shown, this may include customer network attack intrusion detection equipment and cloud-based rule generation and distribution. It should be understood that customer network attack intrusion detection equipment can be understood as... Figure 1 The client 10 shown can be understood as the cloud rule generation and distribution being handled as follows: Figure 1 The server side 20 is shown.

[0032] Specifically, the cloud first initializes the rule base, and then adjusts the order of rules in the rule base based on a rule popularity scoring mechanism. Next, the cloud generates a customized customer rule base based on the intranet device service information sent by the asset service collection module of the customer's network attack and intrusion detection device. After obtaining the customized customer rule base, the final rules are selected from the customized customer rule base according to the maximum number of rules that the device can load, forming the final rule base, which is then sent to the customer's network attack and intrusion detection device.

[0033] Correspondingly, the network attack and intrusion detection module on the customer's network attack and intrusion detection device can identify and defend against security attacks based on the final rule base when a security attack is detected, thereby making the detection efficiency of security attacks higher and the defense against attacks in a timely manner.

[0034] The client's network attack and intrusion detection device may include an asset information collection and analysis module and a network attack and intrusion detection module. The asset information collection and analysis module may include internal network asset service collection and internal network asset list generation; the network attack and intrusion detection module may include a detection engine and an optimized rule base.

[0035] The asset information collection and analysis module utilizes Deep Packet Inspection (DPI) technology, application identification algorithms, and user-defined configurations to comprehensively monitor and collect asset information within the intranet. This asset information may include key security attributes such as asset type, operating system, application version, and open ports. The asset service list generation involves the client's intrusion device processing and integrating the collected asset information to form a detailed intranet asset service list. This list includes not only static asset information but may also include traffic behavior characteristics, providing a precise basis for the cloud-based rule generation and distribution system to create a customized rule base.

[0036] The client's network attack and intrusion detection device can also exchange data with the cloud-based rule generation and distribution end through secure communication protocols. The client's network attack and intrusion detection device can periodically upload updated asset service lists to the cloud, allowing the cloud to optimize the rule base based on this information. The client's network attack and intrusion detection device can also receive a customized rule base from the cloud based on the internal network asset service list. These rule bases are intelligently optimized by the cloud to ensure a high degree of matching with the device's network environment.

[0037] The client's network attack and intrusion detection device loads and applies the distributed customized rule base to monitor and analyze traffic in real time. Once a potential security threat is detected, the client's network attack and intrusion detection device will automatically take response measures such as blocking malicious traffic and logging security events according to preset security policies, or prompt the network administrator for further processing. In this way, the client's network attack and intrusion detection device can efficiently perform network security protection tasks while maintaining close collaboration with the cloud-based rule generation and distribution end to ensure the real-time performance and effectiveness of the network security protection system.

[0038] It should be understood that in the embodiments of this application, the generation of the rule base can be performed by the server or the client, and there is no limitation on this; the example given is simply that the rule base is generated by the server.

[0039] The attack detection and defense process of this application embodiment is described in detail below. Figure 3 The diagram shown is a flowchart of a network attack detection method provided in an embodiment of this application. (See attached diagram.) Figure 3 As shown, the method may include the following steps:

[0040] Step 301: Obtain the first rule base.

[0041] For ease of description, the initial rule base can be referred to as: the first rule base.

[0042] In some embodiments, the initial rule base can be a traffic detection rule base, such as open-source rule formats like Snort and Suricata, or private traffic detection rules with custom formats and detection methods. Assuming the initial rule base contains n rules, denoted as R_n, then R_n can be (rule_1, rule_2, rule_3, ..., rule_n), where the order of the rules in R_n can be considered random.

[0043] Step 302: Adjust the order of rules in the first rule base based on multi-dimensional data to obtain the second rule base.

[0044] The multi-dimensional data can include cumulative priority, risk level, popularity, etc. In this embodiment, by calculating the multi-dimensional data of the rules in the initial rule base, the popularity and value of each rule can be determined, and then the rules in the initial rule base can be sorted based on the popularity and value of the rules.

[0045] For ease of description, the rule base obtained in step 302 can be denoted as the second rule base. Assume the second rule base after adjusting the order based on multi-dimensional data is denoted as M_n, where M_n is, for example, (rule_a1, rule_a2, rule_a3, ..., rule_an). For instance, the popularity of the i-th rule, rule_ai, in M_n can be denoted as score_ai, where i∈[1, n]. Then, the popularity of the rules in M_n satisfies the following condition: (score_a1≤score_a2≤score_a3≤...≤score_an).

[0046] In some embodiments, the hotspot rule score can be calculated using the following formula:

[0047] score = s p *p w +severity*s w +(year c -year n +y b )+accuracy*a w

[0048] +popu*popu w

[0049] Where: s p This represents the cumulative priority value of a rule, calculated by summing the priorities of multiple attribute tags corresponding to a specific rule. Assume rule r... i There are k labels (T1, T2, ..., T... k Each tag has a corresponding priority (p1, p2, ..., p).k If the rule r is true, then the rule r is true. i Cumulative priority s p It can be:

[0050]

[0051] Severity represents the risk level of a rule. For rules with a specific Common Vulnerabilities Exposures (CVE) number, the severity value is set according to the Common Vulnerability Scoring System (CVSS) score. For example, when CVSS ∈ [0, 4.0), the severity is 0; when CVSS ∈ [4.0, 7.0), the severity is 1; when CVSS ∈ [7.0, 9.0), the severity is 2; and when CVSS ∈ [9.0, 10.0], the severity is 3. For rules without a specific CVE number, the severity value corresponding to the rule classification Classtype is used.

[0052] year c Indicates the year the rule was created; year n This indicates the year in which rule filtering was performed; accuracy indicates the rule's precision level, describing the false positive rate; popu indicates the rule's popularity, assigned a value based on the matching frequency of a specific rule within a specified time window; p w s w a w popu w Indicates a specific weight; y b Indicates a specific bias.

[0053] The hotspot score of each rule in the initial rule base R_n can be obtained through the calculation using the above formula. Then, the rules in the initial rule base can be sorted in ascending order of their respective hotspot scores to obtain the rule base M_n. For example, as shown... Figure 4 The diagram shown is a schematic representation of a rule variation provided in an embodiment of this application. Figure 4 As can be seen, compared with M_n, the number of rules in the two rule bases R_n remains the same, only the order of the rules changes.

[0054] Step 303: Optimize the second rule base based on customer equipment information to obtain the third rule base.

[0055] In some embodiments, step 303 may include two sub-steps:

[0056] Sub-step 1: Further sort the rules in the second rule base based on the customer's intranet device service information.

[0057] In this step, the customer's network attack intrusion detection device can send internal network device service information to the server, and then adjust the order of rules associated with specific vendors, products, versions, and ports based on the internal network device service information, so that these related rules are listed first. For example, suppose the rule obtained in sub-step 1 is denoted as Q_n. Figure 5 The diagram shown is a schematic representation of a rule variation provided in an embodiment of this application. Figure 5 As can be seen, the number of rules in Q_n remains unchanged compared to M_n; only the order of some rules has changed. The total number of rules is n. In sub-step 1, m strongly related rules are selected and placed in the first m positions of the n rules. The remaining (nm) rules are then arranged sequentially after the m-th position.

[0058] Since different users have different network environments and security needs, the dynamic rule sorting mechanism based on user internal assets in this application embodiment can adjust the priority sorting of rules in the rule base in real time according to the asset characteristics of the user's network environment and the vulnerability risk assessment results, so as to ensure that the rule base is highly consistent with the user's needs and improve the accuracy and practicality of threat detection.

[0059] Sub-step 2: Optimize the rule base obtained in sub-step 1.

[0060] In this step, the rules in Q_n can be filtered. The top N rules in Q_n are selected based on the maximum number of rules the device can load (e.g., N), and this set of the top N rules is used as the third rule base. For example, using... Figure 5 For example, assuming N is m, then the N rules from rule_ax to rule_am in Q_n can be selected.

[0061] It should be understood that due to differences in customer device models, system versions, and other information, the maximum number of rules that a customer device can load also varies.

[0062] Sub-step 2 addresses the problem in existing network attack intrusion detection / defense devices that cannot load a large number of rules due to hardware performance limitations. In this embodiment, a rule sorting mechanism allows the device to prioritize loading high-value rules suitable for its performance characteristics, thereby achieving efficient threat detection and protection under resource constraints.

[0063] Step 304: Detect and defend against network attacks based on the third rule base.

[0064] In some embodiments, when a network security threat is detected, the client can perform detection and defense based on a third rule base, which can improve the efficiency and accuracy of network security threat detection.

[0065] It should be understood that Figure 3 In the illustrated embodiment, steps 301 to 303 can be executed by the server, or by the client; this application does not limit this. If executed by the server, then before step 304, the process may further include: the server sending a third rule base to the client, the client receiving the third rule base, and then detecting and defending against network security threats based on the third rule base.

[0066] In this embodiment of the application, by optimizing the priority order of rules in the rule base, the overall performance of the network attack intrusion detection / defense system can be improved, including improving the accuracy of threat detection, reducing the false alarm rate, and shortening the response time, thereby improving system performance and the efficiency of threat detection, effectively preventing various network security threats and ensuring the security of the network and data.

[0067] Based on the same technical concept, this application also provides a network attack intrusion detection device. The principle of the device in solving the problem is similar to that of the above method. Therefore, the implementation of the device can refer to the implementation of the method, and the repeated parts will not be described again.

[0068] Figure 6 This is a schematic diagram of the structure of a network attack intrusion detection device 600 provided in an embodiment of this application. The network attack intrusion detection device 600 may include an acquisition module 601, a processing module 602, and a detection module 603.

[0069] The acquisition module 601 is used to acquire a first rule base; the processing module 602 is used to sort the rules in the first rule base to obtain a reordered second rule base, and to filter and optimize the rules in the second rule base to obtain a third rule base; the detection module 603 is used to perform intrusion detection on network attacks based on the third rule base.

[0070] In one possible design, the processing module 602 is specifically used to sort the rules in the first rule base in the following manner to obtain a reordered second rule base:

[0071] Determine the hot spot scores of the rules included in the first rule base; sort the rules included in the first rule base in ascending order of hot spot scores to obtain the second rule base.

[0072] In one possible design, the processing module 602 is specifically used to determine the hotspot scores of the rules included in the first rule base in the following manner:

[0073] The hot topic scores of the rules included in the first rule base are determined based on multi-dimensional data, including cumulative priority, risk level, and popularity.

[0074] In one possible design, the second rule base includes n rules, where n is a positive integer;

[0075] The processing module 602 is specifically used to filter and optimize the rules in the second rule base in the following manner to obtain a third rule base:

[0076] Based on the customer's intranet device service information, m rules strongly related to the customer's intranet device service information are selected from the second rule base, where m is a positive integer less than n; the m rules are arranged in the first m positions, and the remaining (nm) rules are arranged in the last (nm) positions; based on the maximum number of rules N that the customer's intranet device can load, the first N rules are selected from the n rules, and the set of the first N rules is used as the third rule base.

[0077] The module division in this application embodiment is illustrative and only represents one logical functional division. In actual implementation, other division methods are possible. Furthermore, the functional modules in each embodiment of this application can be integrated into a single processor, exist as separate physical entities, or be integrated into a single module. Coupling between modules can be achieved through interfaces, typically electrical communication interfaces, but mechanical interfaces or other types of interfaces are also possible. Therefore, modules described as separate components may or may not be physically separate; they can be located in one place or distributed across different locations on the same or different devices. The integrated modules described above can be implemented in hardware or as software functional modules.

[0078] As an example, when the acquisition module 601 is a transceiver, and the processing module 602 and the detection module 603 are processors, the network attack and intrusion detection device 600 involved in this application embodiment can be as follows: Figure 7 As shown. See also Figure 7 The image shows a network attack and intrusion detection device 700 provided in an embodiment of this application. The network attack and intrusion detection device 700 may include a transceiver 701, a processor 702, and a memory 703. The memory 703 stores instructions or programs, and the processor 702 executes the instructions or programs stored in the memory 703.

[0079] It should be understood that the network attack and intrusion detection device 600 or network attack and intrusion detection equipment 700 according to the embodiments of this application can be the client (client network attack and intrusion detection equipment) or server (cloud) as described in the embodiments, and the operation and / or function of each module in the network attack and intrusion detection device 600 or network attack and intrusion detection equipment 700 are respectively for implementing Figure 3 The corresponding processes in the illustrated embodiments will not be described in detail here for the sake of brevity.

[0080] It should be understood that the processor mentioned in the embodiments of this application can be a central processing unit (CPU), or other general-purpose processors, digital signal processors (DSPs), application-specific integrated circuits (ASICs), field-programmable gate arrays (FPGAs), or other programmable logic devices, discrete gate or transistor logic devices, discrete hardware components, etc. A general-purpose processor can be a microprocessor or any conventional processor.

[0081] It should also be understood that the memory mentioned in the embodiments of this application can be volatile memory or non-volatile memory, or may include both volatile and non-volatile memory. The non-volatile memory can be read-only memory (ROM), programmable read-only memory (PROM), erasable programmable read-only memory (EPROM), electrically erasable programmable read-only memory (EEPROM), or flash memory. The volatile memory can be random access memory (RAM), which is used as an external cache. By way of example, but not limitation, many forms of RAM are available, such as static random access memory (SRAM), dynamic random access memory (DRAM), synchronous dynamic random access memory (SDRAM), double data rate synchronous dynamic random access memory (DDR SDRAM), enhanced synchronous dynamic random access memory (ESDRAM), synchronous linked dynamic random access memory (SLDRAM), and direct rambus RAM (DR RAM).

[0082] It should be noted that when the processor is a general-purpose processor, DSP, ASIC, FPGA, or other programmable logic device, discrete gate or transistor logic device, or discrete hardware component, the memory (storage module) is integrated into the processor.

[0083] It should be noted that the memories described herein are intended to include, but are not limited to, these and any other suitable types of memories.

[0084] Based on the same inventive concept, embodiments of this application also provide a storage medium storing computer instructions that, when executed on a computer, cause the computer to perform the data granularity adjustment method described above.

[0085] This application also provides a computer program product, including instructions that, when run on a computer, cause the computer to execute the methods provided in the above embodiments.

[0086] In some possible implementations, various aspects of the data granularity adjustment method provided in this application can also be implemented in the form of a program product, which includes program code that, when the program product is run on a device, causes the device to perform the steps in the risk identification method according to the various exemplary embodiments of this application described above.

[0087] Those skilled in the art will understand that embodiments of this application can be provided as methods, systems, or computer program products. Therefore, this application can take the form of a completely hardware embodiment, a completely software embodiment, or an embodiment combining software and hardware aspects. Furthermore, this application can take the form of a computer program product embodied on one or more computer-usable storage media (including but not limited to disk storage, CD-ROM, optical storage, etc.) containing computer-usable program code.

[0088] This application is described with reference to flowchart illustrations and / or block diagrams of methods, apparatus (systems), and computer program products according to embodiments of this application. It will be understood that each block of the flowchart illustrations and / or block diagrams, and combinations of blocks in the flowchart illustrations and / or block diagrams, can be implemented by computer program instructions. These computer program instructions can be provided to a processor of a general-purpose computer, special-purpose computer, embedded processor, or other programmable data processing apparatus to produce a machine, such that the instructions, which execute via the processor of the computer or other programmable data processing apparatus, generate instructions for implementing the flowchart... Figure 1 One or more processes and / or boxes Figure 1 A device that provides the functions specified in one or more boxes.

[0089] These computer program instructions may also be stored in a computer-readable storage medium that can direct a computer or other programmable data processing device to function in a particular manner, such that the instructions stored in the computer-readable storage medium produce an article of manufacture including instruction means, which are implemented in a process Figure 1 One or more processes and / or boxes Figure 1 The function specified in one or more boxes.

[0090] These computer program instructions may also be loaded onto a computer or other programmable data processing equipment to cause a series of operational steps to be performed on the computer or other programmable equipment to produce a computer-implemented process, thereby providing instructions that execute on the computer or other programmable equipment for implementing the process. Figure 1 One or more processes and / or boxes Figure 1 The steps of the function specified in one or more boxes.

[0091] Obviously, those skilled in the art can make various modifications and variations to this application without departing from the spirit and scope of this application. Therefore, if such modifications and variations fall within the scope of the claims of this application and their equivalents, this application also intends to include such modifications and variations.

Claims

1. A method for detecting network attack intrusions, characterized in that, include: Obtain a first rule base and sort the rules in the first rule base to obtain a reordered second rule base, wherein the second rule base includes n rules, where n is a positive integer; The rules in the second rule base are filtered and optimized to obtain the third rule base; Intrusion detection of network attacks is performed based on the aforementioned third rule base; The process of filtering and optimizing the rules in the second rule base to obtain a third rule base includes: Based on the customer's intranet device service information, m rules strongly correlated with the customer's intranet device service information are selected from the second rule base, where m is a positive integer less than n. The customer's intranet device service information is determined by the asset service list, which is generated by collecting static asset information and traffic behavior characteristics of intranet devices using deep packet inspection technology and application recognition algorithms. Arrange the m rules in the first m positions, and arrange the remaining (nm) rules in the last (nm) positions; Based on the maximum number of rules N that the customer's intranet devices can load, the top N rules are selected from the n rules, and the set of the top N rules is used as the third rule base.

2. The method as described in claim 1, characterized in that, The rules in the first rule base are sorted to obtain a reordered second rule base, which includes: Determine the hot spot scores of the rules included in the first rule base; The rules included in the first rule base are sorted in order of hot spot scores from low to high to obtain the second rule base.

3. The method as described in claim 2, characterized in that, Determining the hotspot rating of the rules included in the first rule base includes: The hot topic scores of the rules included in the first rule base are determined based on multi-dimensional data, including cumulative priority, risk level, and popularity.

4. A network attack and intrusion detection device, characterized in that, include: The acquisition module is used to acquire the first rule base; The processing module is used to sort the rules in the first rule base to obtain a reordered second rule base, and to filter and optimize the rules in the second rule base to obtain a third rule base, wherein the second rule base includes n rules, where n is a positive integer; The detection module is used to perform intrusion detection on network attacks based on the third rule base; The processing module is specifically used to filter and optimize the rules in the second rule base in the following manner to obtain the third rule base: Based on the customer's intranet device service information, m rules that are strongly correlated with the customer's intranet device service information are selected from the second rule base, where m is a positive integer less than n; Arrange the m rules in the first m positions, and arrange the remaining (nm) rules in the last (nm) positions; Based on the maximum number of rules N that the customer's intranet devices can load, the top N rules are selected from the n rules, and the set of the top N rules is used as the third rule base.

5. The apparatus as described in claim 4, characterized in that, The processing module is specifically used to sort the rules in the first rule base in the following manner to obtain a reordered second rule base: Determine the hot spot scores of the rules included in the first rule base; sort the rules included in the first rule base in order of hot spot scores from low to high to obtain the second rule base.

6. The apparatus as claimed in claim 5, characterized in that, The processing module is specifically used to determine the hotspot scores of the rules included in the first rule base in the following manner: The hot topic scores of the rules included in the first rule base are determined based on multi-dimensional data, including cumulative priority, risk level, and popularity.

7. A network attack and intrusion detection device, characterized in that, include: At least one processor, and a memory communicatively connected to said at least one processor, wherein: The memory stores a computer program that can be executed by the at least one processor to enable the at least one processor to perform the method as described in any one of claims 1-3.

8. A storage medium, characterized in that, When the computer program in the storage medium is executed by the processor of the network attack intrusion detection device, the network attack intrusion detection device is able to perform the method as described in any one of claims 1-3.

Images