Abnormality processing method and device

Abstract

The invention provides an exception handling method and device, which are applied to the technical field of network security and are used for improving the security performance of an intrusion prevention system. The method comprises the steps of detecting whether an abnormal log appears in logs of the heterogeneous redundant system, and if yes, obtaining the abnormal log; the abnormal log is used for indicating that a novel attack which cannot be intercepted by an intrusion prevention rule appears in the heterogeneous redundant system; extracting flow information and session information related to the attack from the abnormal log; the flow information and the session information are input into a rule model, feature extraction is conducted on the flow information and the session information through the rule model, a first rule is generated based on the extracted features, and the first rule is used for intercepting the novel attack; and updating an intrusion prevention rule of the heterogeneous redundant system based on the first rule.

Description

Technical Field

[0001] The present application relates to the field of network security technology, and in particular to an exception handling method and device. Background Art

[0002] Software as a Service (SaaS) has become the main means for enterprises to access important applications. From the perspective of business development, there are many benefits to deploying applications and businesses on cloud platforms, including cost savings, increased agility, and flexible expansion capabilities. However, cloud-based applications all have security risks, and it is necessary to continuously evaluate and manage the business and data security risks residing in the SaaS platform. Network Intrusion Prevention System (NIPS) is usually used to formulate security protection rules and policies. However, traditional NIPS relies on manual rule writing, has delays, and is difficult to effectively and quickly identify attacks.

[0003] In view of this, how to improve the security protection performance of the intrusion prevention system is a technical problem that needs to be solved urgently. Summary of the invention

[0004] The present application provides an exception handling method and device for improving the security protection performance of an intrusion prevention system.

[0005] In a first aspect, an embodiment of the present application provides an exception handling method, which is applied to a network platform, and the method includes: Detect whether there are abnormal logs in the logs of the heterogeneous redundant system. If so, obtain the abnormal logs; the abnormal logs are used to indicate that a new type of attack that cannot be blocked by the intrusion prevention rules has occurred in the heterogeneous redundant system; Extract traffic information and session information related to the new attack from the exception log; Inputting the flow information and the session information into the rule model, extracting features of the flow information and the session information through the rule model, and generating a first rule based on the extracted features, wherein the first rule is used to intercept the new attack; The intrusion prevention rule of the heterogeneous redundant system is updated based on the first rule.

[0006] Optionally, before obtaining the exception log, the method further includes: receiving a user request, calling each application in the plurality of applications in the heterogeneous redundant system to respond to the request, and recording the response process and response result of each application through a log.

[0007] Optionally, the heterogeneous redundant system includes a multi-mode decision mechanism to detect whether abnormal logs appear in the logs of the heterogeneous redundant system, including: obtaining the response result of each application, identifying and judging each response result according to the multi-mode decision mechanism; if there are different first response results and second response results in the response results of multiple applications, the second response result is the other response result in the response result except the first response result, and the number of first response results is less than the number of second response results, then the second response result is fed back to the user, and the log recording the first response result is identified as an abnormal log.

[0008] Optionally, the flow information and session information are input into a rule model, and feature extraction is performed on the flow information and session information through the rule model, including: data cleaning of the flow information and session information through the rule model; parsing the cleaned flow information and session information, and extracting at least one abnormal feature contained in the flow information and session information, wherein the abnormal feature includes at least one of information on the communication link, information on the transmission message, and information on the communication protocol flag.

[0009] Optionally, generating a first rule based on the extracted features includes: parsing the extracted features based on a rule model, and generating the first rule according to preset rules; the rule model is a model pre-trained based on a pre-written snort rule data set and an abnormal feature data set, and the first rule is a snort rule.

[0010] Optionally, updating the intrusion defense rules of the heterogeneous redundant system based on the first rule includes: if there is no historical rule in the intrusion defense rules for defending attacks of the same type and function as the new attack, adding the first rule to the intrusion defense rules of the heterogeneous redundant system; or, if there is a historical rule in the intrusion defense rules for defending attacks of the same type and function as the new attack, updating the historical rule based on the first rule.

[0011] Optionally, the method also includes: periodically testing each rule in the intrusion defense rules of the heterogeneous redundant system, retaining the rules that are called more than a preset threshold number of times in each detection cycle or are generated in the current detection cycle, and discarding or disabling the rules that are called no more than a preset threshold number of times in each detection cycle and are not generated in the current detection cycle.

[0012] In a second aspect, an embodiment of the present application provides an exception handling device, including: The detection module is used to: detect whether an abnormal log appears in the log of the heterogeneous redundant system, and if so, obtain the abnormal log; the abnormal log is used to indicate that a new type of attack that cannot be intercepted by the intrusion prevention rules appears in the heterogeneous redundant system; The processing module is used to: extract flow information and session information related to the new attack from the exception log; input the flow information and session information into the rule model, perform feature extraction on the flow information and session information through the rule model, generate a first rule based on the extracted features, and the first rule is used to intercept the new attack; and update the intrusion defense rules of the heterogeneous redundant system based on the first rule.

[0013] Optionally, before obtaining the abnormality log, the detection module is further used to: receive a user request, call each application in the plurality of applications in the heterogeneous redundant system to respond to the request, and record the response process and response result of each application through a log.

[0014] Optionally, the heterogeneous redundant system includes a multi-mode decision mechanism. When the detection module detects whether an abnormal log appears in the log of the heterogeneous redundant system, it is specifically used to: obtain the response result of each application, and identify and judge each response result according to the multi-mode decision mechanism; if there are different first response results and second response results in the response results of multiple applications, the second response result is the other response result in the response result except the first response result, and the number of first response results is less than the number of second response results, then the second response result is fed back to the user, and the log recording the first response result is identified as an abnormal log.

[0015] Optionally, when the processing module inputs the flow information and session information into the rule model and extracts features of the flow information and session information through the rule model, it is specifically used to: perform data cleansing on the flow information and session information through the rule model; parse the cleaned flow information and session information, and extract at least one abnormal feature contained in the flow information and session information, wherein the abnormal feature includes at least one of information on the communication link, information on the transmission message, and information on the communication protocol flag.

[0016] Optionally, when the processing module generates the first rule based on the extracted features, it is specifically used to: parse the extracted features based on the rule model, and generate the first rule according to the preset rules; the rule model is a model pre-trained based on a pre-written snort rule data set and an abnormal feature data set, and the first rule is a snort rule.

[0017] Optionally, when the processing module updates the intrusion defense rules of the heterogeneous redundant system based on the first rule, it is specifically used to: if there is no historical rule in the intrusion defense rules for defending attacks of the same type and function as the new attack, add the first rule to the intrusion defense rules of the heterogeneous redundant system; or, if there is a historical rule in the intrusion defense rules for defending attacks of the same type and function as the new attack, update the historical rule based on the first rule.

[0018] Optionally, the processing module is also used to: periodically detect each rule in the intrusion defense rules of the heterogeneous redundant system, retain the rules that are called more than a preset threshold number of times in each detection cycle or are generated in the current detection cycle, and discard or disable the rules that are called no more than a preset threshold number of times in each detection cycle and are not generated in the current detection cycle.

[0019] In a third aspect, an embodiment of the present application provides an electronic device, comprising at least one processor, wherein the at least one processor is used to execute a computer program stored in a memory so that a method as in the first aspect or any optional implementation of the first aspect is implemented.

[0020] In a fourth aspect, an embodiment of the present application provides a computer-readable storage medium, which is used to store instructions. When the instructions are executed, the method in the first aspect or any optional implementation of the first aspect is implemented.

[0021] In a fifth aspect, an embodiment of the present application provides a computer program product, including a computer program code, which, when executed on a computer, enables the method in the first aspect or any optional implementation of the first aspect to be implemented.

[0022] In this embodiment, by detecting the logs of the heterogeneous redundant system in real time, when an abnormal log is detected, the abnormal log is immediately obtained, and the flow information and session information related to the new attack in the abnormal log are extracted, so as to facilitate timely and comprehensive analysis of the attack behavior of the new attack; the flow information and session information are input into the rule model, and features are extracted through the rule model and a first rule for intercepting the new attack is generated based on the extracted features. The attack behavior of the new attack can be learned based on the rule model, and a rule for intercepting the attack is generated for the attack behavior. The original intrusion defense rule is updated based on the first rule, so that the new attack can be identified and learned in time, and the new attack can be prevented from further attacking the system in time based on the updated intrusion defense rule, thereby improving the security protection performance of the intrusion defense system; in addition, the response result of each application can be analyzed and compared based on the multi-mode decision mechanism, and the abnormal response result can be accurately determined, and then the log recording the abnormal response result is determined to be the abnormal log, thereby improving the accuracy of abnormal log detection and further improving the security of the heterogeneous redundant system. BRIEF DESCRIPTION OF THE DRAWINGS

[0023] Figure 1 A flow chart of an exception handling method provided in an embodiment of the present application; Figure 2 An example diagram of a complete exception handling process provided in an embodiment of the present application; Figure 3 A structural diagram of an exception handling device provided in an embodiment of the present application; Figure 4 A structural diagram of an electronic device provided in an embodiment of the present application. DETAILED DESCRIPTION

[0024] In the technical solution of this application, the collection, dissemination, and use of data are in compliance with the requirements of relevant national laws and regulations.

[0025] It should be noted that in the embodiments of the present application, certain software, components, models and other existing solutions in the industry may be mentioned, and they should be regarded as exemplary. Their purpose is only to illustrate the feasibility of implementing the technical solution of the present application, but it does not mean that the applicant has or will necessarily use the solution.

[0026] The technical solution of the present application is described in detail below through the accompanying drawings and specific embodiments. It should be understood that the embodiments of the present application and the specific features in the embodiments are detailed descriptions of the technical solution of the present application, rather than limitations on the technical solution of the present application. In the absence of conflict, the embodiments of the present application and the technical features in the embodiments can be combined with each other.

[0027] It should be understood that "multiple" in the description of the embodiment of the present application refers to two or more. "First", "second" etc. in the embodiment of the present application are used to distinguish different objects, rather than to describe a specific order. The term "and / or" in the embodiment of the present application is merely a kind of association relationship describing associated objects, indicating that three relationships may exist, for example, A and / or B, which may represent: A exists alone, A and B exist at the same time, and B exists alone. In addition, the term "includes" and any of their variations are intended to cover non-exclusive inclusions. For example, a process, method, system, product or device comprising a series of steps or units is not limited to the listed steps or units, but optionally also includes steps or units that are not listed, or optionally also includes other steps or units inherent to these processes, methods, products or devices. The module in the embodiment of the present application refers to a part with independent functions in a software system.

[0028] To facilitate understanding of the embodiments of the present application, the following is an introduction to some of the professional terms involved in the embodiments of the present application: 1. Software as a Service (SaaS) is a model for providing software applications through the Internet. In this model, the software is no longer a program that users install and run on their local computers, but a service provided through a cloud platform.

[0029] 2. Heterogeneous Redundancy refers to the use of components or technologies of different types and properties for redundancy in system design to improve the reliability and availability of the system. Specifically, heterogeneity refers to components with the same functional role that have abnormalities in structural construction, processing procedures and implementation methods. Redundancy refers to the existence of functionally equivalent components working simultaneously in the system.

[0030] 3. Intrusion Prevention System (IPS) is a system that uses various technologies and strategies to monitor, identify and prevent unauthorized access and malicious attacks on computer networks. Its main purpose is to protect the network and its resources and ensure the security and integrity of information.

[0031] 4. Security Operations Center (SOC), also known as Information Security Operations Center (ISOC), is a center that integrates personnel, processes and technology, responsible for 24 / 7 detection of all activities of endpoints, servers, databases, network applications, websites and other systems to discover potential threats in real time; prevent, analyze and respond to network security incidents to improve the company's network security posture.

[0032] 5. Snort rules. Snort is an open source intrusion detection system that can capture and analyze data packets on the network and determine whether these data packets contain malicious behavior based on predefined rules. Snort rules are divided into two main parts: rule header and rule options. The rule header contains information such as the rule action, protocol, source address and destination address, source port and destination port; the rule option part contains the alarm message content and the specific part of the data packet to be checked.

[0033] For more and more enterprises, Software as a Service (SaaS) has become the main means of accessing important business applications. From the perspective of business development, there are many benefits of "going to the cloud" (i.e., enterprises or institutions migrate their business data, application services and other related resources to the cloud platform), mainly including: cost savings, improved business processing agility and flexible expansion functions. However, all cloud-based applications have security risks. In the SaaS application protection scenario, attackers usually first confirm the relevant information of the target Web service through scanning and detection methods, such as middleware version, operating system version, surrounding network topology, open port number and other information, identify the vulnerabilities or loopholes on the target host based on the scanning and detection information, and then use the vulnerabilities or loopholes to elevate permissions; after the permissions are elevated, the attacker can perform mining operations on the customer host. To ensure the security of SaaS applications, enterprises need to continuously evaluate and manage the business and data security risks residing in the SaaS service platform, and can adopt a variety of security methods such as vulnerability scanning, penetration testing, and threat detection.

[0034] An intrusion prevention system (IPS) is a security threat detection system used to monitor potential intrusions in a computer network or system. Its main purpose is to promptly identify and respond to unauthorized access, malicious activities, abnormal behaviors, or security incidents, and provide corresponding alerts or response mechanisms. IPS is mainly based on a signature-based approach to identify known attacks through predefined attack features and attack patterns. This approach is similar to a virus scanner, which detects intrusions by matching signatures with known attacks. However, signature-based rules have the limitation of being unable to detect new attacks and zero-day vulnerabilities. When a new attack occurs, IPS can only write rule signatures to protect against intrusions after the network is attacked, and this method is very cumbersome and usually requires a professional security operations team to write rules, which is inefficient and costly.

[0035] The traditional method of writing IPS rules is as follows: First, the operation monitoring platform discovers an abnormality in the business host, such as a surge in CPU causing external services to become stuck or even unable to provide services; then, the operation personnel notify the SOC security R&D personnel to log in to the abnormal business host to conduct abnormal investigation: specifically, give priority to restoring customer services, then conduct security incident investigation and output emergency response reports; among them, the emergency response report generally includes the removal of abnormal phenomena, the source tracing analysis process and emergency avoidance methods; then, the security R&D personnel collect full-flow packets before and after the incident, and screen abnormal traffic manually or based on malicious traffic classification AI models. However, due to the persistence and confusion of attacks such as Advanced Persistent Threat (APT), AI classification will have obvious false alarms and cannot distinguish between normal traffic and abnormal traffic. Therefore, most of the full-flow packet analysis is currently done by security R&D personnel to lock the attacker's attack packet link in a large number of packets; finally, the security R&D personnel analyze the feature code stream in the packet and precipitate it into Snort-like rules, which are similar to signatures to resist certain BOTCC attacks. The more complicated the hacker's attack is, the more difficult it will be to write signature rules, and more professional security background knowledge will be required. This passive defense system and technical defects are the main reasons why the current cyberspace security is easy to attack but difficult to defend, and the defense delay phenomenon exists.

[0036] As can be seen from the above examples, traditional IPS lacks understanding of context and is difficult to update in time to deal with complex attack modes and unknown threats. Usually, after an accident occurs, security developers find attack messages from a large number of messages, summarize traffic characteristics, and then write Snort-like rules, which is very time-consuming and labor-intensive, and relies on the professional ability of security developers, and there are errors caused by subjective factors; and if the rules are too broad or not precise enough, normal traffic may be misjudged as attack traffic, affecting normal business operations; and IPS rule writing has a delay. If the rules cannot be updated quickly, hackers may continue to exploit vulnerabilities to create greater threats, or even move laterally within the intranet or spread Trojans on a large scale; further, due to the large number of traditional IPS rules, it is not conducive to maintenance, and the old IPS rule set has no expiration trigger mechanism, so security developers dare not easily delete the rules. Large-capacity rules will increase the time for threat detection, affect network performance, and cause business delays or reduced throughput.

[0037] In view of this, an embodiment of the present application is proposed, which obtains the abnormal log when an abnormal log is detected in the log of a heterogeneous redundant system, and immediately extracts the traffic information and session information related to the new attack in the abnormal log, so as to facilitate comprehensive and timely analysis of the new attack; the traffic information and session information are input into the rule model, features are extracted through the rule model, and a first rule for intercepting the new attack is generated based on the extracted features, and the original intrusion defense rule is updated based on the first rule, so that the new attack can be identified and learned in time, thereby improving the security protection performance of the intrusion defense system.

[0038] The embodiments of the present application can be applied to any network exception handling scenario, including but not limited to the above-mentioned exception handling of SaaS application systems.

[0039] See also Figure 1 , is a flow chart of an exception handling method provided in an embodiment of the present application. The method can be applied to any network platform, such as a cloud computing platform, a social platform, a content platform, etc. Taking the scenario of applying to the above-mentioned exception handling of a system composed of SaaS applications as an example, the method includes steps S101 to S104: S101. Detect whether an abnormal log appears in the log of the heterogeneous redundant system. If so, obtain the abnormal log.

[0040] Among them, the exception log is used to indicate that a new type of attack that cannot be blocked by intrusion prevention rules has occurred in the heterogeneous redundant system.

[0041] For example, multiple SaaS applications are deployed on different underlying platforms according to a preset heterogeneous architecture to obtain a heterogeneous redundant system. The preset heterogeneous architecture can be a dynamic heterogeneous redundancy (DHR) model. Different underlying platforms include different operating systems, different hardware devices, etc., which can be configured according to actual needs.

[0042] The functions of multiple applications included in the heterogeneous redundant system are the same, but there are differences in structure, request processing methods, etc. In this way, the same attack method can be avoided from attacking multiple applications at the same time, thereby improving the security of the heterogeneous redundant system.

[0043] Monitor the logs of heterogeneous redundant systems in real time. If an abnormal log is added, obtain the abnormal log immediately.

[0044] In a possible embodiment, before obtaining the abnormal log, the method further includes: Receive user requests, call each application in multiple applications in the heterogeneous redundant system to respond to the request, and record the response process and response results of each application through logs.

[0045] It can be understood that after receiving the user's request, each application in the heterogeneous redundant system will respond to the request and output the response result. The response process and response result of each application will be recorded in the log to facilitate subsequent analysis of the abnormal log.

[0046] In a possible embodiment, the heterogeneous redundant system includes a multi-mode decision mechanism; then the specific implementation method of detecting whether an abnormal log appears in the log of the heterogeneous redundant system may be: Obtain the response result of each application, and identify and judge each response result according to the multi-mode decision-making mechanism; If there are different first response results and second response results in the response results of multiple applications, the second response results are response results other than the first response results in the response results, and the number of first response results is less than the number of second response results, then the second response result is fed back to the user, and the log recording the first response result is marked as an abnormal log.

[0047] Exemplarily, the multi-mode decision mechanism adopted in the embodiment of the present application includes common mode decision and differential mode decision. Common mode decision is also called collaborative decision, which is to reach a decision based on multiple response results, that is, each application responds to the request and outputs a response result, obtains all response results, and identifies and judges all response results; differential mode decision involves decision deviation, which is used to decide the gap between the actual state and the expected state, that is, to analyze the gap between each response result and determine the abnormal response result whose gap with the normal response result is greater than a threshold.

[0048] Usually, attackers will attack a vulnerability in a certain application. For example, the first application among multiple applications has a centos7 vulnerability. The attacker performs a structured query language (SQL) injection attack on the centos7 vulnerability. When each application responds to the attack, the response result of the first application (i.e., the first response result) may be an SQL echo (i.e., displaying the batch command being executed and the result of the execution). However, since the centos7 vulnerability does not exist in other applications except the first application among multiple applications, the response result is a normal reply (i.e., the second response result). By comparing the response results of each application through a multi-mode decision-making mechanism and voting for decision-making, for example, by adopting a minority-subordinates-majority strategy, it can be determined that the response result of the first application is an abnormal response result, and the log recording the response result of the first application is an abnormal log.

[0049] Optionally, after identifying the log recording the first response result as an exception log, the application to which the first response result belongs can also be identified as an abnormal application, and a scheduling strategy can be adopted for the abnormal application, such as disabling or taking the abnormal application offline, detecting and cleaning its data, etc. The specific scheduling strategy can be set according to actual needs, and the embodiment of the present application does not limit this.

[0050] S102: Extracting flow information and session information related to the new attack from the abnormal log.

[0051] For example, after extracting the traffic information related to the new attack, the traffic can be colored (i.e., labeled) to facilitate tracking the attack behavior of the new attack and timely offline cleaning of the attacked application; alarm information can also be sent to security operation and maintenance personnel, who can follow up in real time to defend against the attack.

[0052] Session information (i.e., session information) is used to store the attributes and configuration information required for the user session, the client's connection status, etc.

[0053] S103: Input the flow information and the session information into the rule model, extract features from the flow information and the session information through the rule model, and generate a first rule based on the extracted features.

[0054] In a possible embodiment, the flow information and the session information are input into a rule model, and feature extraction is performed on the flow information and the session information through the rule model, including: The flow information and session information are cleaned by using a rule model; the cleaned flow information and session information are parsed to extract at least one abnormal feature contained in the flow information and session information, wherein the abnormal feature includes at least one of the information of the communication link, the information of the transmission message, and the information of the communication protocol flag.

[0055] Exemplarily, the communication link information may include: establishment time of connection in fwd direction, disconnection time of connection in fwd direction, establishment time of connection in bwd direction, disconnection time of connection in bwd direction, flow duration, etc.; The information of the transmitted message may include: the total number of messages in the fwd direction, the total message length in the fwd direction (bytes), the total number of messages in the bwd direction, the total message length in the bwd direction (bytes), the minimum length of messages in the fwd direction (bytes), the maximum length of messages in the fwd direction (bytes), the minimum length of messages in the bwd direction (bytes), the maximum length of messages in the bwd direction (bytes), the number of flow bytes per second, the number of flow messages per second, the number of upstream messages per second, and the number of downstream messages per second. Number, minimum message length (bytes), maximum message length (bytes), average message length (bytes), message length standard deviation, message length variance, number of downlink messages, number of uplink messages, average length of messages in the fwd direction of the connection (bytes), standard deviation of the length of messages in the fwd direction of the connection (bytes), average length of messages in the bwd direction of the connection (bytes), standard deviation of the length of messages in the bwd direction of the connection (bytes), total length of headers of messages in the fwd direction of the connection, total length of headers of messages in the bwd direction of the connection, etc.; The information of the communication protocol flag bit may include: the number of times the push flag bit in the connection fwd direction message is effective (UDP is set to 0), the number of times the urg flag bit in the connection fwd direction message is effective (UDP is set to 0), the number of times the push flag bit in the connection bwd direction message is effective (UDP is set to 0), the number of times the urg flag bit in the connection bwd direction message is effective (UDP is set to 0), the number of messages with the cwr flag flag bit effective, the number of messages with the ece flag flag bit effective, the number of messages with the urg flag flag bit effective, the number of messages with the psh flag flag bit effective, the number of messages with the ack flag flag bit effective, the number of messages with the rst flag flag bit effective, the number of messages with the syn flag flag bit effective, the number of messages with the fin flag flag bit effective, etc.; Among them, fwd and bwd respectively indicate the forward direction (i.e., the communication direction from the user to the application) and the reverse direction (i.e., the communication direction from the application to the user).

[0056] It can be understood that the above abnormal features are only a possible example provided by the embodiment of the present application. In practice, only some of the above features can be used, or other features in the traffic information and session information can be extracted. The embodiment of the present application uses a rule model to extract features from the traffic information and session information. In actual applications, other models can also be trained to realize the function of feature extraction, and the embodiment of the present application does not limit this.

[0057] In a possible embodiment, generating a first rule based on the extracted features includes: The extracted features are parsed based on the rule model, and the first rule is generated according to the preset rule; the rule model is a model pre-trained based on a pre-written snort rule data set and an abnormal feature data set, and the first rule is a snort rule.

[0058] It is understood that the rule model can be trained by a deep learning model (such as a large language model, etc.), for example, by training it with a pre-written snort rule data set and anomaly feature data set. It can be used to generate the first rule based on the features in the traffic information and session information extracted above.

[0059] The embodiment of the present application uses a snort rule data set to train the rule model. In actual applications, other rule data sets can be used to train the rule model according to needs. Accordingly, the first rule obtained matches the types of other rules.

[0060] Optionally, after the first rule is generated, the parameters of the rule model are updated based on the first rule, that is, the rule model is optimized based on the first rule to make the rule model more sophisticated, improve the recognition ability of the rule model and the accuracy and comprehensiveness of the generated rules.

[0061] S104: Update the intrusion prevention rule of the heterogeneous redundant system based on the first rule.

[0062] Specifically, if there is no historical rule in the intrusion prevention rule for defending against attacks of the same type and function as the new attack, then the first rule is added to the intrusion prevention rule of the heterogeneous redundant system; Or, if there is a historical rule in the intrusion prevention rule for defending against attacks of the same type and function as the new attack, the historical rule is updated based on the first rule.

[0063] It can be understood that if the new attack is an improved version of a historical attack of the same type and function that has appeared in the historical records, that is, the intrusion defense rules contain historical rules for defending against the type and function; or before the new attack attacks the heterogeneous redundant system, the security operation and maintenance personnel predict in advance and write historical rules for attacks of the same type and function as the new attack, then the first rule can be used to update the historical rule; if the historical rule does not exist, the first rule can be directly added to the intrusion defense rules. In this way, it is possible to avoid the appearance of multiple redundant rules with the same defense objects and reduce the difficulty of maintaining the intrusion defense rules.

[0064] Optionally, each rule in the intrusion defense rules of the heterogeneous redundant system is periodically tested, and the rules that are called more than a preset threshold number of times in each detection cycle or are generated in the current detection cycle are retained, and the rules that are called less than a preset threshold number of times in each detection cycle and are not generated in the current detection cycle are discarded or disabled.

[0065] It can be understood that due to the large number of intrusion defense rules in heterogeneous redundant systems, maintenance is difficult, and there may be many redundant rules with the same or similar functions. Therefore, according to the method of the embodiment of the present application, non-hotspot (i.e., infrequently used) rules are regularly abandoned or disabled, which can reduce the maintenance difficulty and enable the intrusion defense rules to more efficiently defend against attack behaviors.

[0066] In practical applications, the above embodiments can be used separately or in combination. The following application provides an example of a method combining all the above embodiments, see Figure 2 , which is an example diagram of a complete exception handling process provided in an embodiment of the present application.

[0067] First, the user sends a request to the heterogeneous redundant system that carries a new type of attack that cannot be identified by the intrusion prevention rules. After the heterogeneous redundant system receives the request, the IPS calls the stored intrusion prevention rules to identify the request, and the identification result is normal.

[0068] Since the intrusion prevention rule cannot identify the new attack carried in the request, the identification result is normal.

[0069] Second, the IPS sends the request to the executor proxy, which calls all executors (i.e. Figure 2 Executor 1, Executor 2, Executor 3 and Executor 4 in the program respond to and process the request, and obtain the output and log of each executable body.

[0070] Understandably, Figure 4 Each execution body in the system includes a hardware device, an operating system and an application. Taking execution body 1 as an example, the application of execution body 1 is APP, the operating system is Linux, and the hardware device is x86.

[0071] Among them, the application of each executable body is the same, but the hardware device and / or operating system where each application is located is different, thus forming a heterogeneous architecture.

[0072] Subsequently, the output (i.e., response result) and log of each executor are input into the multi-modal decision-making mechanism. After the multi-modal decision-making mechanism identifies and judges them, it determines the abnormal log and feeds back the normal response output by the executor to the user through the executor agent.

[0073] Among them, the multi-mode decision mechanism can include a common-mode decision mechanism and a differential-mode decision mechanism. The specific functions thereof can be referred to the records in the above embodiments and will not be repeated here.

[0074] Next, the multi-mode decision-making mechanism sends the exception log to the analysis center, which extracts the traffic information and session information related to the attack from the exception log and performs IPS fingerprint extraction. At the same time, the analysis center sends the information of the abnormal execution body to which the exception log belongs to the scheduling module, which schedules and cleans the abnormal execution body.

[0075] Among them, the IPS fingerprint is used to indicate the features extracted from the traffic information and session information mentioned in the above embodiments. The tool for extracting features can be the rule model mentioned in the above embodiments or other models that can be used for feature extraction; the information of the execution body includes an identifier used to indicate the identity of the execution body.

[0076] Finally, the IPS fingerprint (i.e., feature) is input into the IPS rule generation model (i.e., the rule model mentioned in the above embodiment) to generate a first rule, and the IPS rule management module updates the intrusion prevention rule in the IPS based on the first rule; at the same time, the parameters of the IPS rule generation model can also be optimized based on the first rule.

[0077] The above is only a possible example provided in the embodiment of the present application and is not limited thereto.

[0078] The method provided by the embodiment of the present application is introduced above, and the device provided by the embodiment of the present application is introduced below.

[0079] Based on the same technical concept, an embodiment of the present application provides an exception handling device, which includes a module / unit / means for executing the method executed by the network platform in the above method embodiment. The module / unit / means can be implemented by software, or by hardware, or the corresponding software can be implemented by hardware.

[0080] For example, Figure 3 As shown, the device 300 includes: The detection module 301 is used to detect whether an abnormal log appears in the log of the heterogeneous redundant system, and if so, obtain the abnormal log; the abnormal log is used to indicate that a new type of attack that cannot be intercepted by the intrusion prevention rules appears in the heterogeneous redundant system; The processing module 302 is used to: extract the flow information and session information related to the new attack from the exception log; input the flow information and session information into the rule model, perform feature extraction on the flow information and session information through the rule model, generate a first rule based on the extracted features, and the first rule is used to intercept the new attack; update the intrusion defense rules of the heterogeneous redundant system based on the first rule.

[0081] Optionally, before obtaining the abnormality log, the detection module 301 is further used to: receive a user request, call each application in the plurality of applications in the heterogeneous redundant system to respond to the request, and record the response process and response result of each application through a log.

[0082] Optionally, the heterogeneous redundant system includes a multi-mode decision mechanism. When detecting whether an abnormal log appears in the log of the heterogeneous redundant system, the detection module 301 is specifically used to: obtain the response result of each application, and identify and judge each response result according to the multi-mode decision mechanism; if there are different first response results and second response results in the response results of multiple applications, the second response result is the other response result in the response result except the first response result, and the number of first response results is less than the number of second response results, then the second response result is fed back to the user, and the log recording the first response result is identified as an abnormal log.

[0083] Optionally, when the processing module 302 inputs the flow information and session information into the rule model and extracts features of the flow information and session information through the rule model, it is specifically used to: perform data cleansing on the flow information and session information through the rule model; parse the cleaned flow information and session information, and extract at least one abnormal feature contained in the flow information and session information, wherein the abnormal feature includes at least one of the information of the communication link, the information of the transmission message, and the information of the communication protocol flag.

[0084] Optionally, when the processing module 302 generates the first rule based on the extracted features, it is specifically used to: parse the extracted features based on the rule model, and generate the first rule according to the preset rules; the rule model is a model pre-trained based on a pre-written snort rule data set and an abnormal feature data set, and the first rule is a snort rule.

[0085] Optionally, when the processing module 302 updates the intrusion defense rules of the heterogeneous redundant system based on the first rule, it is specifically used to: if there is no historical rule in the intrusion defense rules for defending attacks of the same type and function as the new attack, add the first rule to the intrusion defense rules of the heterogeneous redundant system; or, if there is a historical rule in the intrusion defense rules for defending attacks of the same type and function as the new attack, update the historical rule based on the first rule.

[0086] Optionally, the processing module 302 is also used to: periodically detect each rule in the intrusion defense rules of the heterogeneous redundant system, retain the rules that are called more than a preset threshold number of times in each detection cycle or are generated in the current detection cycle, and discard or disable the rules that are called less than a preset threshold number of times in each detection cycle and are not generated in the current detection cycle.

[0087] It should be understood that all relevant contents of each step involved in the above method embodiment can be referred to the functional description of the corresponding functional module and will not be repeated here.

[0088] Based on the same technical concept, see Figure 4 The embodiment of the present application further provides an electronic device 400, including: At least one processor 401; and a communication interface 403 that is communicatively connected to the at least one processor 401; the at least one processor 401 executes instructions stored in the memory 402, so that the electronic device 400 executes the method steps performed by the billboard in the above method embodiment through the communication interface 403.

[0089] Optionally, the memory 402 is located outside the electronic device 400 .

[0090] Optionally, the electronic device 400 includes the memory 402, the memory 402 is connected to the at least one processor 401, and the memory 402 has instructions that can be executed by the at least one processor 401. Figure 4 The dashed lines indicate that the memory 402 is optional for the electronic device 400 .

[0091] The at least one processor 401 and the memory 402 may be coupled via an interface circuit or may be integrated together, which is not limited here.

[0092] The specific connection medium between the at least one processor 401, the memory 402 and the communication interface 403 is not limited in the embodiment of the present application. Figure 4 In the embodiment, at least one processor 401, a memory 402 and a communication interface 403 are connected via a bus 404. Figure 4 The connection between other components is only for schematic illustration and is not intended to be limiting. The bus part may be an address bus, a data bus, a control bus, etc. For ease of representation, Figure 4 It is represented by only one thick line, but it does not mean that there is only one bus or one type of bus.

[0093] It should be understood that the processor mentioned in the embodiments of the present application can be implemented by hardware or by software. When implemented by hardware, the processor can be a logic circuit, an integrated circuit, etc. When implemented by software, the processor can be a general-purpose processor implemented by reading software code stored in a memory.

[0094] Exemplarily, the processor may be a central processing unit (CPU), or other general-purpose processors, digital signal processors (DSP), application-specific integrated circuits (ASIC), field programmable gate arrays (FPGA) or other programmable logic devices, discrete gate or transistor logic devices, discrete hardware components, etc. The general-purpose processor may be a microprocessor or the processor may also be any conventional processor, etc.

[0095] It should be understood that the memory mentioned in the embodiments of the present application may be a volatile memory or a non-volatile memory, or may include both a volatile memory and a non-volatile memory. Among them, the non-volatile memory may be a read-only memory (ROM), a programmable read-only memory (PROM), an erasable programmable read-only memory (EPROM), an electrically erasable programmable read-only memory (EEPROM), or a flash memory. The volatile memory may be a random access memory (RAM), which acts as an external cache. By way of example and not limitation, many forms of RAM are available, such as static random access memory (SRAM), dynamic random access memory (DRAM), synchronous dynamic random access memory (SDRAM), double data rate synchronous dynamic random access memory (DDR SDRAM), enhanced synchronous dynamic random access memory (ESDRAM), synchronous link dynamic random access memory (SLDRAM) and direct memory bus random access memory (DirectRambus RAM, DR RAM).

[0096] It should be noted that when the processor is a general-purpose processor, DSP, ASIC, FPGA or other programmable logic device, discrete gate or transistor logic device, discrete hardware component, the memory (storage module) can be integrated into the processor.

[0097] It should be noted that the memory described herein is intended to include, but is not limited to, these and any other suitable types of memory.

[0098] Based on the same technical concept, an embodiment of the present application also provides a computer-readable storage medium, which is used to store instructions. When the instructions are executed, the computer executes the method steps executed by any device in the above method embodiments.

[0099] Based on the same technical concept, an embodiment of the present application also provides a computer program product, including computer program code. When the computer program code is executed on a computer, the method steps executed by any device in the above method embodiment are implemented.

[0100] Those skilled in the art will appreciate that the embodiments of the present application may be provided as methods, systems, or computer program products. Therefore, the present application may adopt the form of a complete hardware embodiment, a complete software embodiment, or an embodiment combining software and hardware. Moreover, the present application may adopt the form of a computer program product implemented on one or more computer-usable storage media (including but not limited to disk storage, CD-ROM, optical storage, etc.) containing computer-usable program codes.

[0101] The present application is described with reference to the flowcharts and / or block diagrams of the methods, devices (systems), and computer program products according to the present application. It should be understood that each process and / or block in the flowchart and / or block diagram, as well as the combination of processes and / or blocks in the flowchart and / or block diagram, can be implemented by computer program instructions. These computer program instructions can be provided to a processor of a general-purpose computer, a special-purpose computer, an embedded processor, or other programmable data processing device to produce a machine, so that the instructions executed by the processor of the computer or other programmable data processing device generate instructions for implementing the processes in the flowchart and / or block diagram. Figure 1 A process or multiple processes and / or boxes Figure 1 A device that provides the functions specified in a block or multiple blocks.

[0102] These computer program instructions may also be stored in a computer-readable memory capable of directing a computer or other programmable data processing device to operate in a specific manner, so that the instructions stored in the computer-readable memory produce an article of manufacture comprising an instruction device, which implements the process Figure 1 A process or multiple processes and / or boxes Figure 1A function specified in one or more boxes.

[0103] These computer program instructions can also be loaded onto a computer or other programmable data processing device so that a series of operating steps are executed on the computer or other programmable device to produce a computer-implemented process, thereby providing instructions for implementing the process. Figure 1 A process or multiple processes and / or boxes Figure 1 A step that specifies a function in one or more boxes.

[0104] Obviously, those skilled in the art can make various changes and modifications to the present application without departing from the scope of the present application. Thus, if these modifications and variations of the present application fall within the scope of the claims of the present application and their equivalents, the present application is also intended to include these modifications and variations.

Claims

1. An exception handling method, characterized in that: include: Detect whether an abnormal log appears in the log of the heterogeneous redundant system, and if so, obtain the abnormal log; The abnormal log is used to indicate that a new type of attack that cannot be intercepted by the intrusion prevention rules has occurred in the heterogeneous redundant system; Extracting traffic information and session information related to the new attack from the abnormal log; Inputting the flow information and the session information into a rule model, extracting features from the flow information and the session information through the rule model, and generating a first rule based on the extracted features, wherein the first rule is used to intercept the new attack; The intrusion prevention rule of the heterogeneous redundant system is updated based on the first rule.

2. The method according to claim 1, characterized in that Before obtaining the abnormal log, the method further includes: A user's request is received, each application in the plurality of applications in the heterogeneous redundant system is called to respond to the request, and a response process and a response result of each application are recorded through a log.

3. The method according to claim 2, characterized in that The heterogeneous redundant system includes a multi-mode decision-making mechanism, and the detecting whether an abnormal log appears in the log of the heterogeneous redundant system includes: Obtaining a response result of each application, and identifying and judging each response result according to the multi-mode decision mechanism; If there are different first response results and second response results in the response results of the multiple applications, the second response results are other response results in the response results except the first response results, and the number of the first response results is less than the number of the second response results, then the second response result is fed back to the user, and the log recording the first response result is identified as the exception log.

4. The method according to claim 1, characterized in that The step of inputting the flow information and the session information into a rule model and extracting features from the flow information and the session information through the rule model includes: The flow information and the session information are cleansed by using the rule model; the cleaned flow information and the session information are parsed to extract at least one abnormal feature contained in the flow information and the session information, wherein the abnormal feature includes at least one of information of the communication link, information of the transmission message, and information of the communication protocol flag.

5. The method according to claim 4, characterized in that The generating a first rule based on the extracted features comprises: The extracted features are parsed based on the rule model, and the first rule is generated according to the preset rule; the rule model is a model pre-trained based on a pre-written snort rule data set and an abnormal feature data set, and the first rule is a snort rule.

6. The method according to claim 1, characterized in that The updating of the intrusion prevention rule of the heterogeneous redundant system based on the first rule includes: If there is no historical rule in the intrusion prevention rule for defending against attacks of the same type and function as the new attack, adding the first rule to the intrusion prevention rule; Alternatively, if there is a historical rule in the intrusion prevention rule for defending against attacks of the same type and function as the new attack, the historical rule is updated based on the first rule.

7. The method according to claim 6, characterized in that The method further comprises: Periodically detect each rule in the intrusion defense rules of the heterogeneous redundant system, retain the rules whose number of calls in each detection cycle is greater than a preset threshold or are generated in the current detection cycle, and discard or disable the rules whose number of calls in each detection cycle is not greater than the preset threshold and are not generated in the current detection cycle.

8. An exception handling device, characterized in that: include: The detection module is used to: detect whether an abnormal log appears in the log of the heterogeneous redundant system, and if so, obtain the abnormal log; The abnormal log is used to indicate that a new type of attack that cannot be intercepted by the intrusion prevention rules has occurred in the heterogeneous redundant system; A processing module, configured to: extract flow information and session information related to the new attack from the abnormal log; input the flow information and the session information into a rule model, perform feature extraction on the flow information and the session information through the rule model, and generate a first rule based on the extracted features, wherein the first rule is used to intercept the new attack; The intrusion prevention rule of the heterogeneous redundant system is updated based on the first rule.

9. An electronic device, characterized in that: include: A memory for storing program instructions; A processor is used to call the program instructions stored in the memory, and execute the steps included in the method according to any one of claims 1 to 7 according to the obtained program instructions.

10. A computer-readable storage medium, characterized in that: The computer-readable storage medium is used to have a computer program, wherein the computer program includes program instructions, and when the program instructions are executed by a computer, the method according to any one of claims 1 to 7 is implemented.

Images